Forum Moderators: phranque
"We see an enormous amount of emails coming from this user. This is not a server security issue- obviously we can do nothing if someone gets a hold of your password, or exploits one of your outdated scripts."
Received this email today despite the fact that I changed my password 15 days ago to a long string of numbers/letters and I don't use any scripts on my sites. Anyone have any advice on what's going on here or what I can do?
Their security dept is looking into to it but I don't think they really give a rats behind and I would rather not have to move my 100+ sites to a new host.
The most obvious thing would be that you have an open SMTP relay. If you have no scripts on your site whatsoever, then you really have no reason to even be running an SMTP server.
Shut it off, and send your outgoing mail through your ISP, rather than through your SMTP server, until you can figure out the problem.
If you want to use your own server for your outbound mail, you should be connecting to it with SSL and configure it to not accept non-encrypted connections.
thanks for the info.
>provided you with examples of the emails?
no just eaxmples of the load on the server.
Have you examined them? Have you looked at your SMTP log?
no, have no access to my hosting acct now, can I get them from outlook express?
>open SMTP relay / connecting to it with SSL
will look into shutting off SMTP server and sending outgoing mail through ISP but at the moment they have totally shut me off.
no, have no access to my hosting acct now, can I get them from outlook express?
No, you can't get them through Outlook Express. This is a log kept by your outbound SMTP server (assuming you have one).
Your host really seems to be being unreasonable, but they may also see you as being unreasonable.
It isn't their job to debug your site or solve your security problems.
However, it's quite unreasonable of them not to give you any means of determining where the problem is.
Not knowing what kind of hosting plan you have (shared? VPS? dedicated? co-located?) nor what your normal use of their email services are (am I correct that you are only using their SMTP/POP servers to send and receive mail for your domains using an email client?) it's hard to suggest where to go from here.
It sounds like they just aren't going to turn your account back on, and you'd best be shopping for a new host.
I can't imagine any reason why they wouldn't agree to turn the account back on with SMTP disabled. But again, I'm lacking details - whether you run your own SMTP server, use theirs, etc.
Hope you have your sites backed-up.
Very little feedback from them, they seem to feel that since it happened twice it's my problem but I have done everything they said to do and they still don't respond.
Hosting plan is a reseller account but just used for my names by me. Highly recommeded host for resellers.
Normal use of their email services: only using their SMTP/POP servers to send and receive mail for my domains using an email client and only using 3 of the 100+ domains for email.
SMTP server: using theirs. I'd be happy to have it turned off but they have not even suggested that.
anyway, thanks again for the input :)
Our dedi hosting service sent an email that we exceeded the daily relay limit of 1000. I thought it odd we'd be sending 1000 from our small group of projects. We requested and received an increase to 5000. Five days later it hit that limit. Come to find out, one of our customers had his mail configured to reply with a message for non-existent accounts. And he was getting loads of spam.
If you configure a script to send "from" a spam target, and it hits a non-existent account, it bounces back where? To the "from" target, which is exactly how the spammers get their way, unless it is rejected. Autoresponders work the same way. There is a difference between a "bounce with message" and "reject."
Once we set his account to reject mail from non-existent accounts, the problem went away.
Before anyone chimes in we shouldn't be using their mail relay - it's the only way the plan is configured, it sucks but there it is . . .
I have to say, it sure sounds like the mail must be originating from one of your websites.
Are you sure that you have NO scripts installed on your sites? Whether you are using them or not? Does your host pre-install any scripts?
I would insist on seeing examples of the email that being sent. You can't possibly determine what is wrong without at least that.
I'm afraid your mistake was not following-up the first time and figuring out what was happening. Just changing your password was insufficient - it was a guess at what might be wrong, and a fairly unlikely one at that. At that point you had the ability to do some investigation, and you didn't.
< sure that you have NO scripts installed on your sites?
I did find this on one of my sites, guess i left in a template that I copied even though I'm not using xml or css:
<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title></title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<link href="css/tripp.css" rel="stylesheet" type="text/css" />
</head>
Does your host pre-install any scripts?
not that I am aware of, you would think that they would be!
yeah i'll try to get some examples of the email that's being sent.
the first time it happened I was told by a network security admin that according to their logs it looked as though someone had rooted my password and that he would just change the password for me and get me back online.
And changing your password automagically removed any exploits that the intruder installed?
he would just change the password for me and get me back online. I'm so occupied with domains, sem and content creation that I don't have anytime to study IT stuff.
OK, you didn't know any better. Their network security guy should have, though. If somebody did break in, simply changing the password is an unlikely remedy for whatever damage was done.
An intruder would typically install some exploit or exploits, and never log-in again.
You don't need to study IT stuff - but it sounds like you do need to have a part-time sysadmin to help you look after technical stuff.
The network admins were not helpful at all except for the one that called me today saying that he had figured it out in 30 seconds once he looked at it after getting to work. Unfreaking real. They have actually been great except for this incident where they either didnt bother to address my emails and calls about it or just wrote me off as a spammer to die with my 100+ sites that have lost revenue for 2 and half days now.
