How To Prevent Spoofing From Postfix/local Part
Apr 29, 2009
I have similar problem that explained [url]
The detail of my problem is below:
Some people sent spoofing mails from our mail users sent to our user from Postfix/local that is listed in maillog like below:
Apr 29 16:57:02 ns1 postfix/local[3075]: EC2153565E3: to=<user-mydomain.com@ns1.mydns.com>, orig_to=<user@mydomain.com>, relay=local, delay=486, status=sent (delivered to command: /usr/bin/procmail-wrapper -o -a $DOMAIN -d $LOGNAME)
Bu i do not know how to prevent this people not to use my Postfix/local delivery part. How can i prevent this attack?
When i connect to my mail server to sent or receive my mail it look like
Apr 29 17:25:28 ns1 dovecot: pop3-login: Login: user=<user@mydomain.com>, method=PLAIN, rip=***.***.***.***, lip=***.***.***.***
....
Apr 29 17:25:55 ns1 dovecot: POP3(user@mydomain.com): Disconnected: Logged out top=0/0, retr=0/0, del=0/0, size=0....
But the attackers connect directly like below:
Apr 29 17:29:59 ns1 postfix/local[2456]: 3192E357FD9: to=<user-mydomain.com@ns1.mydns.com>, orig_to=<user@mydomain.com>, relay=local, delay=261, status=sent (delivered to command: /usr/bin/procmail-wrapper -o -a $DOMAIN -d $LOGNAME)
....
Apr 29 17:29:59 ns1 postfix/qmgr[2218]: 3192E357FD9: removed
How can the spammer connect to Postfix/local part? My mail server not open relay. i test it from internet.
View 2 Replies
ADVERTISEMENT
Nov 29, 2007
I try to enhance my server security and prevent local hack but it seem useless.
I tried to chmod home/user/public_html to 711; disable functions; enable php open_basedir.
I can stop some popular shell such as c99shell.php but server can be hacked local.
Anyway to prevent it completely?
View 5 Replies
View Related
Nov 12, 2014
We set up a Plesk 12 server for web hosting purposes only.
All mail-related services, exception from "smtp server" and "Plesk milter" are disabled or uninstalled.
For specific domains, we want to prevent the useage of the php mail function with "localhost" to avoid problems with outgoing spam by unsecured scripts. Instead, we want to force webmasters to use external smtp servers.
Is there any directive or setting on domain-level that we allow for this limitation?
View 4 Replies
View Related
Jul 2, 2014
My issue started ince a couple of months seemed to increase with update to Plesk 12.0 (though I can't guarantee it).I am using Centos 6.5, all updated. What happens is that postfix usage starts to increase without any apparent reason (during week-ends for example). Then postfix is not responding anymore.
Code:
top - 13:27:13 up 3 days, 18:44, 0 users, load average: 0.73, 0.33, 0.32
Tasks: 238 total, 2 running, 236 sleeping, 0 stopped, 0 zombie
Cpu(s): 0.3%us, 0.6%sy, 0.1%ni, 98.7%id, 0.3%wa, 0.0%hi, 0.0%si, 0.0%st
Mem: 32917292k total, 8982212k used, 23935080k free, 1899416k buffers
Swap: 1046520k total, 0k used, 1046520k free, 4905884k cached
[code]....
View 1 Replies
View Related
Aug 4, 2008
I got an email "failure delivery notification" but i did not sent that email. It had my email address though.
So I contacted host and got a very quick reply:
Quote:
The is caused due to the email spoofing. Someone was spoofing your email account and sending mails by adding the mail header so that the appears to have originated from the actual source. By setting SPF record correctly in the DNS zone of the domain, we can almost prevent this.
Here The SPF record was not setup correctly. Now we have made some changes in the SPF record in the DNS zone file "/var/named/domainname.com.db".
------------
v=spf1 a mx ip4:67.21.1.226 ?all -----> v=spf1 a mx ip4:67.21.1.226 ~all
------------
Now I can understand that they have quickly fixed the problem. BUT I need to learn more on what is going on here.
I can understand that email spoofing is that spammer is sending email with header that shows it is my email address (which it is not).
But I dont understand the second part that a DNS record fix it.
What does that DNS line mean,
DNS stuff is really complicated and am lost when it comes to it.
View 8 Replies
View Related
Apr 16, 2008
I got a bounced back message that I never sent. I was profoundly shocked to discover (through the header info) that the message originated from dotworlds.net; a site that ostensibly is a spoof email service provider.
Should such sites be allowed to exist?
View 2 Replies
View Related
Aug 10, 2008
How do you defend against browser spoofing? From the tutorials shown at [url]. it seems really easy to spoof a firefox useragent.
View 5 Replies
View Related
Nov 8, 2007
I'm concerned about dns spoofing
As explained here:
w w w. securesphere(dot)net/download/papers/dnsspoof.htm
I note the recommendations:
- To limit the cache and check that it's not keeping additional records.
- Not to make security systems to use/rely on DNS.
- Use cryptography like SSL, even if the problem remains the same, it increase difficulty level for the attacker (See article on Man in the Middle)
I did not on another site that the latest version of BIND for DNS should be installed.
I'm quite sure I'm being attacked in this way by a guy on the same network as my numerous commercial websites.
I'm setting a new server. I'm getting my own name server.
What steps should I take to best protect my self and my business against these attacks please?
(firewall? tips etc beside the above?) Please let me know as I want to set up and have a better than even bet I have shaken the guy.
View 2 Replies
View Related
May 4, 2007
Is there any way to stop spammers from spoofing my address? I've had issues ever since I started this server with getting bounced spam where the "From:" field was (jibberish)@mydomain.com which was annoying but not that constant.
I came online this morning to check my mail and had over 1200 e-mails and all of them have "online@wellsfargo.com" as the "From:" address, but the message-ID has my domain name in it..
Quote:
------ This is a copy of the message, including all the headers. ------
Return-path: <nobody@host.mydomain.com>
Received: from nobody by host.mydomain.com with local (Exim 4.63)
(envelope-from <nobody@host.mydomain.com>)
id 1Hju9b-0002y3-TH
for lwilder1999@yahoo.com; Fri, 04 May 2007 05:32:43 -0400
To: lwilder1999@yahoo.com
Subject: Update Your Account Records
From: Wells Fargo Online <online@wellsfargo.com>
Reply-To:
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
Message-Id: <E1Hju9b-0002y3-TH@host.mydomain.com>
Date: Fri, 04 May 2007 05:32:43 -0400
There's gotta be some way (make that 1204.. just got 4 more bounces) to block spammers from doing this. Could someone help a newbie out?
View 6 Replies
View Related
May 28, 2009
I have a website that can be seen in a part of the world but not on the other. How can I troubleshoot this issue. Is there a web utility that can help me figure out what is the problem?
View 1 Replies
View Related
Jul 8, 2008
Is security really that critical? If so, why are some of the largest software companies providing such a bad example for the rest of the industry? Why would someone want to target my website? Why is security often overlooked?
These are all common questions that arise on a daily basis within the online industry.
The rest of this article will provide some detailed answers, along with practical examples and true scenarios.
I've spoken with numerous hackers over the past short while. I can't count the number of times I've heard the line "Ignorant site owners deserve to be hacked". In my opinion, that's like claiming that cars without alarms deserve to be stolen, or homes without alarm systems deserve to be burglarized. It's not just wrong - it's illegal.
Security risks and vulnerabilities affect the entire online industry. When a single website is hacked, there are usually multiple other victims. This is most commonly seen with widely distributed software. A potential attacker has the ability to install the software on a test environment, locate the vulnerabilities, then attack random victims even before anyone else is aware of the potential exploits. Once a vulnerability is located, the attacker simply needs to search for other environments using the same software, and within minutes there are hundreds, often thousands of potential victims.
Typically, in the race to market, software providers are encouraged to release their products as soon as the applications are usable. Critical development procedures are often overlooked or intentionally bypassed. One such miss is an application vulnerability assessment. Although the product may be usable, the effects of a vulnerable application could be severe.
Sadly, nobody is "off limits" when it comes to hacking. Most hackers feel safe committing online crime, since the online industry has evolved much faster than the security industry. Many applications are not created with the intent to recognize hacking attempts. Some hackers view their actions as a competition - Who can attack the most valuable website? Who can exploit the most user databases? In many cases, these attacks are bragged about within the hacker's immediate network. The competitive nature of these hacking groups has become so severe, there have been reports of attacks between competing organizations.
You might ask, "If I use industry standards, won't my environment be secure?". The short answer: no, but it helps. Hackers are not restricted by industry standards. Most security companies only implement new standards once at least one victim is reported. This often gives hackers plenty of time to locate other vulnerable environments, and before long, the number of victims can increase rapidly. Hackers are some of the most innovative individuals within the online industry. The most logical way to combat them is to use similar methodology for security purposes.
View 2 Replies
View Related
Oct 1, 2008
One of the most reliable & dependable webhosts around: Aussie Bob's Dotable is now a part of the UK2Group.
Read announcement:
[url]
The new plans unfortunately resemble that of a typical overselling host.
View 14 Replies
View Related
Jun 4, 2007
I am having trouble finding a good sysadmin for my needs. Has anyone else been in a similar situation? Does anyone have any advice on how to find somebody like this?
SITUATION:
I am having trouble finding a reliable RH sysadmin. I have a handful of clustered HA setups for customers (6+ servers & load-balancers) and a number of single-server dedicated hosting customers. I do a lot of the work myself. The additional sysadmin usually only has a small amount of actual worked hours per month, dependent on new installs. But, they need to be reliable, available, and familiar with the complexities of the setups.
From what I have seen, some sort of server management company wouldn't be able to be familiar with the setups well enough to not regularly make errors or modify setups correctly due to the amount of clients they have.
View 14 Replies
View Related
Aug 7, 2008
Should/home be its own partition when using r1soft, or can it be part of/?
View 7 Replies
View Related
Jun 16, 2008
I have a small dns cluster with 4 servers, the problem is that when i want to update a dns registry one of them doesnt sync, i have to try like 6 or 8 times to get that server to sync with all the others, and im concern because the one who gets trouble to sync is my secondary dns server
View 2 Replies
View Related
Mar 3, 2009
Is bandwidth going to be my most expensive cost if I open up a video hosting site? Is there a inexpensive alternative? Is there an inexpensive web host with low cost bandwidth allocation?
View 9 Replies
View Related
May 6, 2009
A few people have asked me to give feedback on my experience with VolumeDrive so I decided I will be posting a 3 part review on them:
Part 1 - initial impressions
Part 2 - three month review
Part 3 - one year review (hopefully)
-------------
When I first got in contact with VD, contact was slow: about an email a day. It was very annoying to say the least. However when VD realized that I was genuinely interested in purchasing a server, and not just a window shopper, contact was more frequent and acceptable.
After looking around and comparing, I ended up ordering the following server from VD for a whopping $105 per month:
Q6600
4 GB DDR2 800 RAM
500 GB HDD
10 Mbps dedicated unmetered
5 IP addresses
Plesk 30 domain
Full managed services
Well just at face value, I don't think anyone will argue with me when I say you cannot beat the price. Where else will you find that kind of server w/ full management for $105 a month?
In the ordering process there were a few forgivable annoyances:
1) VD does not have any sort of automated, order online system for their "good" deals. I had to order via email and manually pay from PayPal. I was, however, emailed an invoice confirming my purchase after I paid.
2) It took VD 2 hours to send me my order request after I said "I am ready to purchase". Now it was late at night, so they probably only had a skeleton staff on hand, so this is understandable; however this point is sort of related to the lack of an automated system point mentioned above.
So after I paid and all, I was told they were building me a new server and it would take 3 business days to arrive. I was bummed out upon hearing this but this was understandable and justifiable - if they don't have the parts on hand, they don't have the parts, no big deal. I did appreciate the fact that they were honest with me upfront instead of trying to con me into giving me a different server (like I have been hearing stories about with other hosts).
So I waited. I was told my server would be setup on Tuesday afternoon and it was. The actual time between order and setup was about 5 and a half days: 3 days for the parts to arrive + Saturday + Sunday + time to build the server.
On Tuesday I was informed that my server has a Q8200 instead of a Q6600. To me this was not a big deal so I didn't object but if you are going to order from VD and you want one specific CPU I would be very clear with them that you won't accept any alternative. What did make me chuckle, however, is the fact that I was told "I received a free upgrade" to Q8200. It made me chuckle because I don't consider it a "free upgrade" when I was offered a choice between the Q6600 and a Q8200 for the same price during the ordering process. However, as I already said, a Q6600 or Q8200 - it does not matter to me: both are very similar in performance anyway.
So since I got my server I have been busy setting it up so VD can secure it after I am finished migrating my website (which by the way they just did - I just got an email ).
During that time I have emailed VD a fair amount of times, sometimes asking for clarification and sometimes asking for assistance with a problem, and they have responded back in a more than acceptable time frame and manner.
The only one major problem I have had so far is that initially, and by initially I mean first ~12 hours, it seems the connection to my server was not all the best. Randomly pages would take a while to load; I was curious as to why this was happening so I did some pinging and saw packets were being lost sometimes. This problem seems to have been auto-corrected itself now and I am did email VD about it; hopefully if it happens again we can get it perma-fixed.
Final verdict: people say "you get what you pay for". I say "I got more than I paid for". Hope it continues this way.
View 14 Replies
View Related
Nov 3, 2008
Today I'm back to encourage you to stay away from Crissic: I know the prices are tempting, but know that you will have no one on your side when a problem comes up. I finally closed my account with them after numerous major issues with my VPS.
I've had a simultaneous account with Slicehost for the past few months, just to see if paying the extra buck is worth while. Now I know it absolutely is. I'm paying double the price for half the resources with Slicehost, but their service is amazing and reliable, their support is stellar, and peace of mind that the server will stay up and running without load issues, memory or drive failures is worth every penny. The point of this post is not Slicehost though, back to Crissic.
When I signed up for Crissic, I knew that it was a relatively new web hosting startup, but I had no idea it was a one-man show. Yes it's probably possible for a single guy to run a small web hosting company--the problem, particularly in the case of Skylar, is that when something is beyond him, it isn't getting fixed.
A recent support incident occurred where I was suddenly unable to access my VPS via SSH or the console. I contacted support, here are some of his responses to my status inquiries: ....
View 8 Replies
View Related
Dec 24, 2007
Are there any web designers/developers who offer hosting to their clients as part of their website creation package. I am toying with the idea of only creating websites for people who host with me. I currently have a colo server, but only use it for personal things. So I have no experience with the needs and demands of clients in regards to hosting. What are some of your experiences with hosting for clients? Is it worth it?
View 15 Replies
View Related
Sep 27, 2007
Is it possible to extract part rars using unrar (or other programs) on centos4?
If so, how and what command to use?
View 0 Replies
View Related
Jul 4, 2009
Does anyone know anyway that "rm -rf /" can be disabled? OR any selinux rule or something to prevent this?
Or if I wanted to prevent a certain directory from being deleted like backups but something unlike chattr that someone can figure out quickly.
Im sure LOTS of people would like to know about this. Ive searched around and only somewhat useful thing I have found is an rm wrapper that sends everything to a trash file in the root of the mount point.
View 14 Replies
View Related
May 28, 2008
Can anyone share tips how to prevent DNS flood on a cPanel and Directadmin server platform on Centos?
View 7 Replies
View Related
Jun 1, 2008
I'm not that techy I'd like to ask why this person downloaded the file below before uploading some phishing webpages on my account ? I've changed my password numerious times from different computers and even from mobile phone just to check if the person can still get in. But again it is no use the person were able to upload phishing pages.
logs:
May 25 21:50:42 server100 pure-ftpd: (weblogin100@62.56.133.36) [NOTICE] /home/weblogin100//.htpasswds/update/Login.php downloaded (21251 bytes, 755.78KB/sec)
Right now I deleted all other scripts on the account and remain some htmls. Folder were also set to 644 no 777, while waiting if the person can still upload his phishing pages please help me why he downloaded the file above. I've check the file on my account and I cannot see Login.php. By the way I have a root login and only two accounts were a constant phishing victims.
View 1 Replies
View Related
Feb 21, 2007
I am giving few tips on securing your server against hack attempts. You must check these inspite of other securities like firewall, rootkits detectors etc.
1. Most Important, do not disable safe_mode under php.ini. If any customer asks to disable it, turn it off on his account only, not on whole server.
As most of the time attack is done using shellc99 (phpshell) script. In case safe_mode is off on server and there are public dirs with 777 permission, he can easily hack through.
2. Compile apache with safe mode as well.
3. In cpanel under tweek settings, turn on base_dir, if someone requests to turn off, turn it off on his/her account only. As using phpshell one can easily move to main server dirs like /etc, /home.
4. Do not allow Anonymous Ftp on your server. You can turn it off from ftp config under WHM Service Configuration. If its allowed, one can easily bind port using nc tool with your server and gain root access. Always keep it disabled.
5. Make sure /tmp is secured. You can easily do that by running this command /scripts/securetmp using ssh. But do make sure, /tmp is secured. Else one can upload some kind of perl script in /tmp dir and can deface or damage all data on the few/all accounts on your server.
keeping your server secure from hack attempts.
View 7 Replies
View Related
Oct 28, 2007
Does anyone know how to prevent some shell, php script change file name from file.php to file.jpg or file.gif and upload to server and run it to attack server?
View 14 Replies
View Related
Sep 11, 2007
from 2 days ago until now my server be ddos and i stay in my computer and block ip but it is not finish is a program to do block ip automatic?
View 2 Replies
View Related
Sep 13, 2007
We have been using our L2 switches functionality to only allow IPs that are assigned to a particular server to be accessed for sometime. However, the latest version of this particular switch no longer includes this feature. Moreoever, it is quite a labor intensive task which is not good for "budget" servers.
I am considering moving the rules to the main router, but am afraid of the scalability of this. Will it hold up with a few 1000 servers?
How are other hosties going about this? I have heard that some just don't bother at all, which leaves their clients open to having their IPs duplicated by others on the same subnet. This can't be good....
View 1 Replies
View Related
Sep 22, 2007
i'm running postfix on my mail server.
Is it possible to make each user/domain only send out 100mails per hour or less?
View 6 Replies
View Related
Oct 19, 2007
I'm currently having trouble with Postfix. I recently installed some new web hosting software (ispCP) and so some new configs were written for all my software. Postfix was one of them and I can't figure out what's wrong with it.
Whenever I send e-mails to my server, Postfix denies it saying "Unknown address error 554: Relay access denied". The logs say NOTHING about it and I've been trying the old configs on Postfix and still nothing works.
Here are my configs:
main.cf
Code:
#
# Postfix MTA Manager Main Configuration File;
#
# Please do NOT edit this file manually;
#
#
# Postfix directory settings; These are critical for normal Postfix MTA functionallity;
#
command_directory = /usr/sbin
daemon_directory = /usr/lib/postfix
program_directory = /usr/lib/postfix
#
# Some common configuration parameters;
#
inet_interfaces = all
mynetworks_style = host
myhostname = xetaspace.net
mydomain = xetaspace.net.local
myorigin = $mydomain
smtpd_banner = $myhostname ISPCP 1.0.0 Managed ESMTP
setgid_group = postdrop
#
# Receiving messages parameters;
#
mydestination = $myhostname, $mydomain
append_dot_mydomain = no
append_at_myorigin = yes
local_transport = local
virtual_transport = virtual
transport_maps = hash:/etc/postfix/ispcp/transport
#
# Delivering local messages parameters;
#
mail_spool_directory = /var/mail
mailbox_size_limit = 0
mailbox_command = procmail -a "$EXTENSION"
biff = no
alias_database = hash:/etc/aliases
local_destination_recipient_limit = 1
local_recipient_maps = unix:passwd.byname $alias_database
#
# Delivering virtual messages parameters;
#
virtual_mailbox_base = /var/mail/virtual
virtual_mailbox_limit = 0
virtual_mailbox_domains = hash:/etc/postfix/ispcp/domains
virtual_mailbox_maps = hash:/etc/postfix/ispcp/mailboxes
virtual_alias_maps = hash:/etc/postfix/ispcp/aliases
virtual_minimum_uid = 2887
virtual_uid_maps = static:2887
virtual_gid_maps = static:8
#
# SASL paramters;
#
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = vhcs.net
broken_sasl_auth_clients = yes
smtpd_recipient_restrictions =
permit_sasl_authenticated,
permit_mynetworks,
reject_unauth_destination
master.cf
Code:
#
# Postfix master process configuration file. For details on the format
# of the file, see the Postfix master(5) manual page.
#
# ==========================================================================
# service type private unpriv chroot wakeup maxproc command + args
# (yes) (yes) (yes) (never) (100)
# ==========================================================================
smtp inet n - - - - smtpd
#submission inet n - - - - smtpd
# -o smtpd_etrn_restrictions=reject
# -o smtpd_client_restrictions=permit_sasl_authenticated,reject
#smtps inet n - - - - smtpd
# -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes
#submission inet n - - - - smtpd
# -o smtpd_etrn_restrictions=reject
# -o smtpd_enforce_tls=yes -o smtpd_sasl_auth_enable=yes
#628 inet n - - - - qmqpd
pickup fifo n - - 60 1 pickup
cleanup unix n - - - 0 cleanup
qmgr fifo n - - 300 1 qmgr
#qmgr fifo n - - 300 1 oqmgr
tlsmgr unix - - - 1000? 1 tlsmgr
rewrite unix - - - - - trivial-rewrite
bounce unix - - - - 0 bounce
defer unix - - - - 0 bounce
trace unix - - - - 0 bounce
verify unix - - - - 1 verify
flush unix n - - 1000? 0 flush
proxymap unix - - n - - proxymap
smtp unix - - - - - smtp
# When relaying mail as backup MX, disable fallback_relay to avoid MX loops
relay unix - - - - - smtp
-o fallback_relay=
# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq unix n - - - - showq
error unix - - - - - error
discard unix - - - - - discard
local unix - n n - - local
virtual unix - n n - - virtual
lmtp unix - - - - - lmtp
anvil unix - - - - 1 anvil
scache unix - - - - 1 scache
#
# ====================================================================
# Interfaces to non-Postfix software. Be sure to examine the manual
# pages of the non-Postfix software to find out what options it wants.
#
# Many of the following services use the Postfix pipe(8) delivery
# agent. See the pipe(8) man page for information about ${recipient}
# and other message envelope options.
# ====================================================================
#
# maildrop. See the Postfix MAILDROP_README file for details.
# Also specify in main.cf: maildrop_destination_recipient_limit=1
#
maildrop unix - n n - - pipe
flags=DRhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient}
#
# See the Postfix UUCP_README file for configuration details.
#
uucp unix - n n - - pipe
flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
#
# Other external delivery methods.
#
ifmail unix - n n - - pipe
flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp unix - n n - - pipe
flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
scalemail-backend unix - n n - 2 pipe
flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
mailman unix - - n - - pipe
flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
${nexthop} ${user}
#
# vhcs delivery agent.
#
ispcp-arpl unix - n n - - pipe flags=O user=vmail argv=/var/www/ispcp/engine/messager/ispcp-arpl-msgr
View 6 Replies
View Related
