🚀 go-pugleaf

Adam Jackson <ajackson@webmagic.com> wrote:
> I run a mail server that handles mail for multiple domains. Somehow, a spammer
> is obtaining a list of valid mail accounts on my sendmail server and
> addressing his spam messages to only those accounts. Many of these accounts
> mail accounts have never been used by a person and are not posted around the
> internet anywhere, which leads me to believe there is a way for an outsider to
> query my mail server for a list of valid mail accounts.
> Has anyone heard of this?

The brute-force attack maybe ? It looks like:

Jul  9 06:28:15 idefix sendmail[43391]: g694SFl43391: <angela@EBSKAMP.COM>... User unknown
Jul  9 06:28:15 idefix sendmail[43391]: g694SFl43391: <amanda@EBSKAMP.COM>... User unknown
Jul  9 06:28:15 idefix sendmail[43391]: g694SFl43391: <alex@EBSKAMP.COM>... User unknown
Jul  9 06:28:15 idefix sendmail[43391]: g694SFl43391: <annette@EBSKAMP.COM>... User unknown
Jul  9 06:28:15 idefix sendmail[43391]: g694SFl43391: <amber@EBSKAMP.COM>... User unknown
Jul  9 06:28:15 idefix sendmail[43391]: g694SFl43391: <albert@EBSKAMP.COM>... User unknown
Jul  9 06:28:15 idefix sendmail[43391]: g694SFl43391: <adeline@EBSKAMP.COM>... User unknown
Jul  9 06:28:15 idefix sendmail[43391]: g694SFl43391: <aimee@EBSKAMP.COM>... User unknown
Jul  9 06:28:15 idefix sendmail[43391]: g694SFl43391: <adam@EBSKAMP.COM>... User unknown

                                           Koos

-- 
Koos van den Hout,                               PGP keyid 0x27513781
koos@cs.uu.nl                               herding Suns and networks
+31-30-2534104                 Visit my site about books with reviews
http://idefix.net/~koos/              http://www.virtualbookcase.com/

In article <uirn3hm5j1im3b@corp.supernews.com>,
 ajackson@webmagic.com (Adam Jackson) wrote:

> Hi everybody,
> I run a mail server that handles mail for multiple domains. Somehow, a spammer
> is obtaining a list of valid mail accounts on my sendmail server and
> addressing his spam messages to only those accounts. Many of these accounts
> mail accounts have never been used by a person and are not posted around the
> internet anywhere, which leads me to believe there is a way for an outsider to
> query my mail server for a list of valid mail accounts.
> Has anyone heard of this?
> 
> Thank you in advance!
> Adam
> 
> 

Turn off your 'vrfy' and 'expn' function in sendmail.
turn off 'finger' on the system

In sendmail vrfy doesn't tend to log anything. A spammer can use a bot 
to generate email addresses and send them to your server with a vrfy 
commmand. You server then politely replies with "ok" or "no user". 
Gather up all the OKs and you can then send a ton of mail without 
generating any errors or bounces.

Such a bot can use first names and common last names alone, in 
conjunction with each other, or ap/prepended with a single letter. I've 
run such a bot on several servers with open 'vrfy' commands and can 
garner from 1000 to 9000 email addresses in just a few hours. I then 
send the list to postmaster and explain they may want to disable that 
feature.
-- 
What color is clear?

Gerard wrote:

> In article <uirn3hm5j1im3b@corp.supernews.com>,
>  ajackson@webmagic.com (Adam Jackson) wrote:
> 
>> Hi everybody,
>> I run a mail server that handles mail for multiple domains. Somehow, a
>> spammer is obtaining a list of valid mail accounts on my sendmail server
>> and addressing his spam messages to only those accounts. Many of these
>> accounts mail accounts have never been used by a person and are not
>> posted around the internet anywhere, which leads me to believe there is a
>> way for an outsider to query my mail server for a list of valid mail
>> accounts. Has anyone heard of this?
>> 
>> Thank you in advance!
>> Adam
>> 
>> 
> 
> Turn off your 'vrfy' and 'expn' function in sendmail.
> turn off 'finger' on the system
> 

Can you please explain on how to turn off "vrfy" and "expn" functions in 
sendmail?

> In sendmail vrfy doesn't tend to log anything. A spammer can use a bot
> to generate email addresses and send them to your server with a vrfy
> commmand. You server then politely replies with "ok" or "no user".
> Gather up all the OKs and you can then send a ton of mail without
> generating any errors or bounces.
> 
> Such a bot can use first names and common last names alone, in
> conjunction with each other, or ap/prepended with a single letter. I've
> run such a bot on several servers with open 'vrfy' commands and can
> garner from 1000 to 9000 email addresses in just a few hours. I then
> send the list to postmaster and explain they may want to disable that
> feature.