2

I think our mail server has been compromised. Today morning when I checked, there were 1298 refused mails from yahoo. with this message Messages from x.x.x.x.x(our ip) temporarily deferred due to user complaints - 4.16.55.1; see http://postmaster.yahoo.com/421-ts01.html)

Mails are getting delivered to gmail though. I am new to this, can anyone please suggest me where should I start looking ? We are using Postfix and dovecot on Ubuntu Server 10.04. And I followed this guide here https://help.ubuntu.com/community/MailServer

hsinxh
  • 143
  • 2
  • 10

4 Answers4

3

FIRST - Check your system for signs of a rootkit as documented here, here or here. I personally like chkrootkit as a quick check.

1298 failed messages can be a lot, depending on what your normal volume is. You should check the bounce messages to see if they look like normal messages from your environment. If they aren't familiar, you've been compromised.

Clean up! If that means a rebuild, tracking down the bad processes, restoring from backup, etc. You'll need to remedy the situation that prompted the block.

I would also recommend doing exactly what the error message states. From there, browse to:

http://help.yahoo.com/l/us/yahoo/mail/postmaster/errors/421-ts01.html

Yahoo states:

When you see this error message in your SMTP logs (where x.x.x.x is your IP address), it’s because of either of the following: We are seeing unusual traffic from your IP address. Email from your mail server is generating complaints from Yahoo! Mail users. Please note that this is typically a temporary situation, and we encourage you to retry sending email to our servers approximately four hours after you encounter this error message. If you see this error consistently over a 48-hour period, please fill out this form to give us enough information that we can actively pursue the issue.

Visit the form mentioned in the warning and work on getting unblocked.

Set the expectation for your users, though. This may take some time.

Community
  • 1
ewwhite
  • 194,921
  • 91
  • 434
  • 799
  • here is the output of chkrootkit scan http://paste.ubuntu.com/744939/ 1298 is too much because we have few users. I checked the messages and they are not at all normal. I have taken the following steps, I have deleted the complete queue and changed all the older passwords. Yahoo is now accepting our mails. I have also checked that our mail server is not open relay. What else can I do to ensure that something like this dont happen in future. – hsinxh Nov 21 '11 at 06:02
3

I would start looking at your postfix logs. Look for an increased mail flow higher than what you see in your logs for the past. I would specifically look for mail going to yahoo in case it might be something specific to them.

If you do see an increase in mail flow, look in the logs to see what the increase is. Is it tons of mail to a single user (like a run-away script sending automated messages), or to a large number of people (spam)? Once you identify some of the abnormal mail, just track it back and find where it came from.
You can also run qshape deferred to see if you have mail still queued up for yahoo (which you should since youre getting a 4xx response code). If you do, you can view the messages in /var/spool/postfix/deferred (use postcat to view the messages).

Its also possible that this could just be nothing. If your mail server doesnt send much to begin with, then even a small, but legitimate, increase could have tripped yahoo's spam thresholds.
The block message you provided usually disappears in a few hours if the issue that caused you to get blocked in the first place is resolved.

phemmer
  • 5,789
  • 2
  • 26
  • 35
  • Mails are now getting delivered to yahoo. I deleted the older mail queue and changed all the older passwords. – hsinxh Nov 21 '11 at 05:47
2

It CAN be that you've been compromised. Before that assumption, though, a few questions:

1) Are you sending mass mails out of that server? If you are, Yahoo recipients may have flagged you as spam, and so they're refusing you.

2) Are you configured as an open relay? That is to say, can you relay SMTP mail to domains other than your own from machines outside your network? (To test, use these instructions to send mail to a gmail account or somesuch). If you are an open relay, it's possible spammers are bouncing mail through your server, and you're getting spam complaints from Yahoo.

Driftpeasant
  • 3,207
  • 2
  • 20
  • 28
  • no, the mailserver is not open relay, I checked it using the instructions given on this page http://www.cyberciti.biz/tips/test-mail-server-for-an-open-relay.html , yahoo is now accepting our mails. I deleted the older mail queue and changed all the older passwords. What else I can do to ensure that such thing does not happen again ? – hsinxh Nov 21 '11 at 05:50
  • If you found the root cause, say an account with weak password and fixed it then you are fine. If you still dont know what happen its best to keep an eye on your logs and next time your mail queue fills up check it for spam. Personal i have seen yahoo do stupid things when it comes to spam so they might be blocking you for forwarding email. – Zuhaib Nov 21 '11 at 08:22
  • To be honest, there's NOTHING you can do to make sure it NEVER happens again. You can take the precautions listed here - check for rootkits, make sure your passwords are strong, make sure you regularly apply security updates - but you're depending on Yahoo's internal processes to not flag you as a spammer. Ultimately you have no DIRECT control over that. – Driftpeasant Nov 21 '11 at 17:29
0

I had a similar problem with Trend Micro. Maybe your public address on black list ? If your user use internet over this IP, perhaps some of them use torrent or other p2p software.

tasmanian_devil
  • 204
  • 3
  • 9