hmailserver - I suspect that a spammer may be using my server

Question

First, I'd like to verify whether or not a spammer is using my server. I've turned logging on -- which logs should I be checking specifically? Just SMTP?

Second, I'd like to configure my domains/hmailserver to play nice with the email world. Is there anything I need to do to any of my domains or to my server settings to make this possible?

My SMTP requires authentication, so I figured that would be enough... but I'm starting to doubt it.

Solution 1

First thing I'd do is check your email logs to see what sort of activity you have.

It is also worth mentioning that just because you have SMTP authentication doesn't mean your server can't be used for spam.

Take a look at "Backscatter spam" as an example:

Wikipedia: Backscatter (email)

Solution 2

The easiest thing is to check SMTP, but also enable AWstats. I have not gone to the effort of actually installing AWstats to look at the data, but the text file that is produced by hmailserver is easily understandable.

Also, you may just want to keep the Administrator program open and load status > status and just check the number of processed messages.

However, out of the box, hmailserver is quite good at anti spam. Unless you allow, local domains and ones that you specifically set up a route for are the only ones it allows delivery for.

On top of that, it has pretty good internal anti spam for the mailboxes you host as well - (DNS, SURBL, grey listing and white listing).

So, basically, monitor over the next few days.

I have been using hmailserver for roughly the past 6 months and have not had a problem with spam regarding the out of the box settings - unless you specifically allow something

Solution 3

Assuming you are using Linux, you should look at the /var/log/maillog file. Plus, I think you shouldn't even be allowing remote SMTP from authenticated users. Only allow that from an internal network or certain ip addresses.

You can check if it is an open relay here: http://www.checkor.com/

Comments

[John Gardeniers]

That pretty much says what I would have said. The only extra step I'd take is to write a script to parse the logs and list all senders.

[prabu]

It would seem that some of my users are getting bounce-backs from other servers regarding a failure to send an email. However, it is clear that my users didn't send any of these messages (clearly spam). Sound like a candidate for backscatter? Thanks!

[prabu]

I currently have no spam protection enabled. Should I enable the two DNS blacklisting options? zen.spamhaus.org and bl.spamcop.net. There's also the option for SURBL protection, and I have that disabled too. Any thoughts?

[William Hilsum]

If your clients are reporting little or no spam, it is not worth doing as it does slow down the delivery slightly. However, if you are getting increased amount of spam, I would enable these options.

[KPWINC]

hamlin, if you're getting bounce backs to your users and its clear your user didn't send the message then yes, you're probably a VICTIM of backscatter. You'll have to take a closer look at your mail headers but it sounds like someone else's server is sending out backscatter and your server is accepting the bounced/forged messages because they are addressed to YOUR users. Once again, that's just a guess based on what you told me. You'll have to do some extra digging to determing exactly what is incoming/outgoing from your server.