GWIA Relay Issue, maybe the SPAMmers authenticated...

Question

So I was greeted with a lovely issue this morning that is really driving me nuts. My mail system was relaying messages from [email protected] using a valid user on my system (MFouch). The IP address that was sending the messages appears to be in Lagos, Nigeria (41.203.64.250). I have been combing my GWIA, MTA, and POA logs and I am not seeing any POP/IMAP/SMTP auth from that IP address. The valid local user that was being abused "C/S dos" login was getting logged but from GWIA's internal IP address. I attached a MIME copy of the message.
My GWIA agent is setup to prevent relaying. I do allow relaying from some specifically defined internal addresses. I do allow POP3 in, but only specific users can use IMAP4 (silly Android issue). I require authentication for both POP3, IMAP4, and SMTP. I ran all of the different open relay tests that I am aware of (abuse.net, mxtoolbox.com) as well as tried to relay something via telnetting to my GWIA. I have attached my current GWIA flags as well. I just added /disallowauthrelay for now as a test/precaution.
I found TID 7008712 that confused, upset, and scared me all at the same time (GroupWise Internet Agents are relaying emails when they're not suppose to be relaying.). If what this TID says is correct, how can I continue to use GroupWise?
It looks like I have stopped the trouble for now. I added /disallowauthrelay as per TID7008712 (which will probably upset a few people). I renamed my gwac.db in case there was some corruption in my SMTP access control list. I changed the abused local user's password. I renamed all of my various GWIA directories (000.PRC, DEFER, GWHOLD, GWPROB, RECEIVE, RESULT, SEND, WPCSIN, and WPCSOUT) just to give me some time to clean out all of the deferrals, send items, and to be sure there is not a message queued somewhere. Members of my team are scanning the two machines this user uses as a precaution. I have also explicitly denied 41.203.64.250 access to my network at my perimeter.
Has any of the great minds out there in the Novell Forum Land seen this before or can point out my buffoonery?
Thanks in advance,
Jeff

Answer 1

Hi.
I'm not quite sure where the uncertainty lies. The user yo uidentified
with the logins from GWIA has been hacked, e.g his password probably was
weak and brute forced, or gained by other means (has this user been in
nigeria recently? ;))
I also don't quite understand the outrage on the TID. It merely explains
what is logical. If someone can authenticate, he can relay. There's
nothing to be overly concerned about, except your password security. You
may want to activate intruder detection... Of course there are other
means to possibly gat to know a users password, but brute force is the
usual way...
On 29.09.2011 18:16, jcrawfor wrote:
>
> So I was greeted with a lovely issue this morning that is really driving
> me nuts. My mail system was relaying messages from [email protected]
> using a valid user on my system (MFouch). The IP address that was
> sending the messages appears to be in Lagos, Nigeria (41.203.64.250). I
> have been combing my GWIA, MTA, and POA logs and I am not seeing any
> POP/IMAP/SMTP auth from that IP address. The valid local user that was
> being abused "C/S dos" login was getting logged but from GWIA's internal
> IP address. I attached a MIME copy of the message.
>
> My GWIA agent is setup to prevent relaying. I do allow relaying from
> some specifically defined internal addresses. I do allow POP3 in, but
> only specific users can use IMAP4 (silly Android issue). I require
> authentication for both POP3, IMAP4, and SMTP. I ran all of the
> different open relay tests that I am aware of (abuse.net, mxtoolbox.com)
> as well as tried to relay something via telnetting to my GWIA. I have
> attached my current GWIA flags as well. I just added /disallowauthrelay
> for now as a test/precaution.
>
> I found TID 7008712 that confused, upset, and scared me all at the same
> time ('GroupWise Internet Agents are relaying emails when they're not
> suppose to be relaying.' (http://tinyurl.com/3ls65sc)). If what this
> TID says is correct, how can I continue to use GroupWise?
>
> It looks like I have stopped the trouble for now. I added
> /disallowauthrelay as per TID7008712 (which will probably upset a few
> people). I renamed my gwac.db in case there was some corruption in my
> SMTP access control list. I changed the abused local user's password.
> I renamed all of my various GWIA directories (000.PRC, DEFER, GWHOLD,
> GWPROB, RECEIVE, RESULT, SEND, WPCSIN, and WPCSOUT) just to give me some
> time to clean out all of the deferrals, send items, and to be sure there
> is not a message queued somewhere. Members of my team are scanning the
> two machines this user uses as a precaution. I have also explicitly
> denied 41.203.64.250 access to my network at my perimeter.
>
> Has any of the great minds out there in the Novell Forum Land seen this
> before or can point out my buffoonery?
>
> Thanks in advance,
> Jeff
>
>
Massimo Rosen
Novell Knowledge Partner
No emails please!
http://www.cfc-it.de