Detecting Hackers or Spammers sending email through your system.

Finding the source/cause of a spam outbreak (identifying the hacked account or setting issue)
Reading msg*.rec log entries...
Settings to help auto detect spammers
Settings to stop forgery/spoofing of your domain
General spam settings page...

Finding the source/cause of a spam outbreak

Use the command
tellmail send_top
to find any account sending a lot of email note down the top 1-2 accounts, next open the web admin to the msg.rec log file page and search for the problem accounts to confirm if what they are sending is spam or not, if it's spam change the passwords.

Next use:
tellmail showq or in web admin use Status & Reporting/Queue stats or Mail queue to examine some messages
to find if there is a bunch of email stuck in the outgoing queue, spam messages tend to get stuck so this may help you identify some spam, then search the msg.rec logs again to find the Received log entry to find why the spam message was recieved.

In some instances, the outgoing message is a bounce or other internally generated message, in this case you need to find the log entries just 'before' the message in question to find what caused it, so search on the time hh:mm: to find the log entries that are related.

Search RBL databases for your servers ip address

Use one of the many rbl services to find if your system has been listed, you will need the ip address of your server. If you are listed, then go to the specific RBL website to see if it will give you more information, some of them require you register first, read the relevant RBL listing reasons carefully to understand why you may have been listed. Then continue your search to identify and fix the CAUSE before you request delisting!

http://www.anti-abuse.org/multi-rbl-check/

Reading msg*.rec log entries.

Log entries for an incoming message look like this:


 9 21:35:30[130766127] Rcpt 208.117.50.44 <return@address.com> <myaccount@fake.co.nz> 0  ""
 9 21:35:31[130766127] Received 208.117.50.44 return@address.com <myaccount@fake.co.nz> 120395 <XJkzvvWDQXeUsz7INbIxGQ@ismtpd0003p1lon1.sendgrid.net> "Relay=islocal, nrcpt=1, f="Booking.com" <email.campaign@sg.booking.com>, s=[Chris - Whakapapa Village and Adelaide! There's a deal with your name on it!]"
 9 21:35:32[130766127] Aspam 208.117.50.44 return@address.com <myaccount@fake.co.nz> 120395 <XJkzvvWDQXeUsz7INbIxGQ@ismtpd0003p1lon1.sendgrid.net> "notrust *****: 5.8 sd=5.8 l=0.00 nok=2/0 m=2 nf=0 Close 0.05(X-SpamContent:clean) 0.95(X-myrbl:Color=brown) 0.91(isclickimage2) 0.82(isclickimage1) 0.20(X-Phrase:clean) 0.37(dkimok) 0.37(genuine) 0.60(spfpass) 0.46(X-NotAscii:utf) 0.53(X-LangGuess:English) 0.49(X-Verify-Helo:+OK) SanScore 0.0 5.8 Sval 5.8"
 9 21:35:32.00 [130766127] Spam 208.117.50.44 <return@address.com> <myaccount@fake.co.nz> 120395 <XJkzvvWDQXeUsz7INbIxGQ@ismtpd0003p1lon1.sendgrid.net> "[o4.sg.booking.com] SpamDetect"
 9 21:35:32.00 [130766127] Stored 208.117.50.44 <return@address.com> <myaccount@fake.co.nz> 120395 <XJkzvvWDQXeUsz7INbIxGQ@ismtpd0003p1lon1.sendgrid.net> "[o4.sg.booking.com] Stored locally /home/surgemail/netwin.co.nz/hc/gf/chrisp/mdir/new/1470796532.2114_15646.netwin.netwinsite.co"
Cpu time used      0 cpu seconds

For an outgoing message it looks like this:


 9 21:39:48[130766226] Rcpt 115.188.8.177 <myaccount@fake.co.nz> <user@destination.com> 0  ""
 9 21:39:49[130766226] Received 115.188.8.177 myaccount@fake.co.nz <user@destination.com> 566 <6a197213-738a-76f8-44d7-3e98ddb34224@netwin.co.nz> "Relay=smtpauth=myaccount@fake.co.nz, nrcpt=1, s=[test]"
 9 21:39:49[130766226] NOSPAM 115.188.8.177 myaccount@fake.co.nz <user@destination.com> 566 <6a197213-738a-76f8-44d7-3e98ddb34224@netwin.co.nz> "trusted origin so skipping spam filtering g_smite_skip_relay"
 9 21:39:53.00 [130766226] Sent 115.188.8.177 <myaccount@fake.co.nz> <user@destination.com> 566 <6a197213-738a-76f8-44d7-3e98ddb34224@netwin.co.nz> "[115-18-8-177.jetstream.xtra.co.nz] Delivered to remote host 12.9.234.50 used SSL - 250 message sent ok "

In both cases the line you want when hunting a hacked account is the 'Received' entry, this shows you why the message was accepted by your server.

smtpauth=user@xyz.com (The user gave valid smtp auth credentials, which are listed.)
g_relay_allow_ip (The sender is from a trusted ip address you have listed)
islocal (The message is to a local account/domain, or was being forwarded by one)

To find this look for the Relay=... text in the line, e.g. in this example the message is relayed because the sender authenticated correctly as myaccount@fake.co.nz

 9 21:39:49[130766226] Received 115.188.8.177 myaccount@fake.co.nz <user@destination.com> 566 
   <6a197213-738a-76f8-44d7-3e98ddb34224@netwin.co.nz> "Relay=smtpauth=myaccount@fake.co.nz, nrcpt=1, s=[test]"

The number in square brackets lets you find all related log entries, e.g. search on 130766226 in the above example

In some cases you will need to find events just before a log entry, to find what caused the message to be sent, to do this search on the date and time, e.g. "9 21:39:4" in the above example...

Settings to help auto detect spammers.

One or more of your users will have their account hacked and abused to send spam sooner or later, you can make it much harder, and you can detect it and stop it early using these settings and policies.

# Login guesses per IP before it is automatically and permenently locked out. Use tellmail unlock ip.address to fix...
G_HACKER_MAX "10"

# If hacker attempts to login to one of these then the ip is instantly locked out. (Don't use accounts that exist)
G_HACKER_POISON "root@*,administrator@*"

# Only allow smtp logins if the user has previously logged in via imap/pop from the same address
G_SAFE_SMTP "true"

# Alert users when logins occur from unknown addresses that are not from australia or usa...
G_SAFE_WARNING "true"
g_safe_country "us,au"

# Max messages an authenticated user can send per 30 minutes, e.g. 5000
G_SPAM_USER_MAX "2000"

# Max outgoing messages per ipaddress/return path pair, 30 minutes, e.g. 5000
G_SPAM_FROM_MAX "2000"

# Detect local users sending 'spam like' email and send a report to the manager.
G_OUTGOING_N "5"

# White list for people you know send mail that looks a bit dodgy.
G_OUTGOING_WHITE "bob@here.com,1.2.3.4"

# send manager an email if a local user sends more than 300 message in a day...
G_USER_SEND_WARNING "300"
g_user_send_ip "300"

# Apply some more strict password checking, and alert users with simple passwords...
G_CREATE_PASS_DIGIT "true"
G_CREATE_PASS_RECHECK "true"
G_HACK_TOUSER "true"

Lastly you should run this command to find any accounts with trivially crackable passwords.

tellmail test_weak

We've built a faster more extensive password checker into nwauth, if you have the latest version of it you can do this:
    nwauth -version
    +OK nwauth 4.3e capa=cluster2
    nwauth -testweak
    +DATA Info: testing for 999 common passwords, pass 1
    +DATA Cracked: crack2@xyz.com
    +DATA Info: testing for variations on common passwords, pass 2
    ...

Settings to stop spoofing of your domains.

The problem with spoofing is that traditional email allowed it and real legitimate systems still make use of that. Also your own users may send email from their own accounts via other systems (gmail etc)... so it's impossible to stop all forgeries unless your users are prepared to 'play the game' and only send email from your servers (or at least a list of known systems), so that's why there is such a lot of settings to do this, each one addresses a subset of forgery behaviour.

g_spf_nofriend "true"

# Maybe this next one, but some real emailers will get blocked as they still don't obey spf properly.
g_friends_obey_spf "true"

g_spf_enforce_local "true"

Check your have spf entries for your domains. https://netwinsite.com/spf.htm#define

# Optional settings depending on your tolerance for bouncing real messages.

g_from_exact "true" # Bounce if the from doesn't match the authenticated sender, stops your users pretending to be each other.

g_from_noforge "true"

g_from_noforgeme "true" # checks for the special case of 'from=to' and blocks it if it originates from outside your system.

g_from_check "true" # enables some checking of the from address.

g_from_nofriend "true" # prevent friend matches for apparently forged return addresses. So they don't bypass spam handling.

# And one of these

g_from_bounce "true" # Bounce messages that are probably forgeries.

g_from_stamp "true" # stamp forgeries in the spam headers but don't actually stop them.

# Improve friends handling so spf matching is usually required.
g_friends_obey_spf "true"
g_friends_local_match "true"
g_friends_spf "true" # requires 7.3p-36

An extreme setting you may use:

SECURITY_SUFFIX - Make logins fail unless the user knows the suffix
One other method to protect your server is to make the login username different from the email address. You can do this on a per domain level, lets say you have a domain MYDOMAIN.COM and you want the users to login with username=JOHN@SECRET.MYDOMAIN.COM

    g_from_rewrite was="*@secret.mydomain.com" to="%1@mydomain.com"
    g_from_rewrite_header "true"
    g_from_rewrite_sender "true"

vdomain name="mydomain.com"
    security_suffix "secret.mydomain.com"
    ...

note: I don't recommend using the security suffix on most systems, it is the most complex of the settings and the most likely to cause disruption, it does have benefits but I would only use it for small sites where extreme security measures are justified.