UBB.threads PHP Forum Software Community Forums Resources and Customizing Admin Zone Question about "Email Post" security

I have had a problem these last few weeks with someone sending spam through my server and have been unable to identify a source. I was browsing WHM and noticed a section for email statistics where one of the sections was for "top 50 sending hosts" - where it lists a lot of sending hosts that sent 1 or 2 emails in addition to "local". Now in my mind no one should be sending throughmy server except the forum software - "local".
Some of those sending hosts were from *.ru - where the spam is from and that led me to wonder if those "sending hosts" show on that list because they used the "Email Post" function - does anyone know?

I can't see any other way email can be sent from the server and the amount of spam being reported to spamcop is just one email a week - although the spam does not look like it came from the forum at all. Could that "Email Post" form be modified by a spammer? Anyone know?

if they used sendmail it should show as "local", the only "outside" hosts would utilize your SMTP server.

Ask SPAMCOP to see a full message, including headers, and you'll have a better idea of what's going on

The full message headers do not reveal a lot - just my IP and server host's name that tie the email to me.

So, from what you are saying I am thinking that my forum is using sendmail and sending out email as "local" (and in that case so would the "Email Post" function) - and that the other "sending hosts" are using smtp.

Nome of these "sending hosts" show as having any email sent in the Email Relayer stats- the only use who sends email is "nobody" which is the user for the scripts. Those are all legit forum emails - notifications of new posts.

So it appears that these "Sending Hosts" are using smtp to send out email from my server that does not show up in any stats - other than the "sending hosts" stats.

I have no idea how this could be done - I can't find any scripts that shouldn't be there. If I can somehow disable smtp then I should stop my spam problem and it should not impact my forums - does that sound reasonable?

Likely someones installed a script that is mailing out; I highly doubt that a current version of UBB.T has been exploited to allow users to send mail (especially if said mail doesn't include the headers included FROM ubb.t).

The reason I want the headers is that it'll show if someone's using SMTP, or (a lot of the time) will include a script name.

Exim has just been set for Extended Logging to show script names in the header - so the next occurance will show more info - should be on Tuesday going by the last few weeks.

The last header does say - Received: from unknown."myhost".com (unknown."myhost".com [myip]) by rly-dc09.mx.aol.com (v119.12) with ESMTP id MAILRELAYINDC091-b3d4713721b394; Mon, 15 Oct 2007 09:58:51 -0400

The "myhost" and "myip" is the part that incriminates me as the spam source. I assume that ESMTP means it was sent using smtp, correct?

According to tech support on my host, "Top 50 Sending Hosts means the ISP of the user on your server that is sending." Since the only place on my site where users can send email (that I am aware of) is the "Email Post" feature - that prompted my original question.

I have repeatedly scoured my files looking for one that does not belong that may be sending email but can't find one.

Maybe next week's spamcop report will reveal more...

ESMTP is "extended SMTP"; you can look it up on wiki if you actually care to read through it (basically it's your SMTP daemon);

If you don't allow sending of emails through SMTP on your server, you should give thought to blocking port25 on your server.

BTW, just because it's the only thing you can think of, doesn't mean another script on your server wasn't exploited and a user uploaded script was put in place... It's quite common... and it can even be a system level service that was exploited; so go through and check to make sure your'e running up to date scripts and system services.

Thanks Gizmo,

You have been a big help. I have disabled smtp since there is are no legitamate users anyway

Had to enable smtp again - it seems that with it disabled, my forum email address does not recive email. I suspect sender verification issues.

Oh well, I guess I will have to wait for the next spamcop report and track down the script.

I didn't say turn it off, i said block access to it; you should configure say IPTables (if you're on linux) to not allow incoming access on port25, then that completely rules out a misconfigured SMTP server