0

We are having an issue with one of our SMTP servers. Problem arises since 3 weeks and is transferring out terabytes of data in a day. Any Idea why is this happening, or suggestion to dig out & resolve this issue.

Thanks Khalil

Khalil
  • 9
  • 3
  • 1
    Does this answer your question? [How do I deal with a compromised server?](https://serverfault.com/questions/218005/how-do-i-deal-with-a-compromised-server) – djdomi Jul 27 '21 at 08:19
  • moreover, check logs or `iptraf` "terrabytes" of traffic means at least some megabytes per second, calucate 3 TB due 30days is round about 1,21mb/s – djdomi Jul 27 '21 at 08:23
  • @djdomi rx | tx bytes 467 KiB | 26.80 MiB max 287 kbit/s | 16.80 Mbit/s average 267.04 kbit/s | 15.68 Mbit/s min 211 kbit/s | 11.90 Mbit/s packets 7246 | 19088 max 556 p/s | 1451 p/s average 517 p/s | 1363 p/s min 407 p/s | 1036 p/s – Khalil Jul 27 '21 at 08:53
  • 1
    Update the Question and format it, show us LOGS, use iptraf, netstat -tup, ntop, tcpdump, dstat --net --top-io-adv --there are a LOT of tools to monitor – djdomi Jul 27 '21 at 09:07

1 Answers1

2

The most likely reason is that the server is compromised.

In the most simple case: the server is not configured correctly and it can be used as an open relay, allowing anyone to use your mailserver to send spam.

You can diagnose that (and other issues) by checking the log files on the server.

Potentially the mail server itself is fine, as such abuse can also occur when the server is configured correctly, but the credentials of valid user are getting abused, or the source the abuse is a trusted system/sender elsewhere in your network and you've only started to noticed the effects of that compromise on the mail server. Again: check you log files.

In more serious cases your server is fully compromised. Then you may not even have log files anymore or when you do, they may not show any obvious abuse and can't be trusted...
Then read: How do I deal with a compromised server?

Bob
  • 21
  • 1
  • Hey Bob, thanks for reply, I have all security checks in place, system is not open relay, log system is working perfectly. only issue I have is unusual outbound traffic. – Khalil Jul 27 '21 at 07:56
  • There cannot be security checks for everything. The most likely reason is compromised server, and most reliable way to clean it up is to restore from known good backups. – Tero Kilkanen Jul 28 '21 at 17:45