Someone is sending spam emails out with my VPS

Discussion in 'Site & Server Administration' started by WoW Blood, Jan 6, 2010.

  1. #1
    Okay so I keep getting spam complaints from my host and I am not sending out these emails. And I have blocked port 25 on my VPS but somehow they keep sending out these spam emails. How can I stop this? Also I run a couple web proxys. Could they be sending out the spam emails with my proxys?:confused:
     
    WoW Blood, Jan 6, 2010 IP
  2. theapparatus

    theapparatus Peon

    Messages:
    2,925
    Likes Received:
    119
    Best Answers:
    0
    Trophy Points:
    0
    #2
    Would be helpful if we knew what OS you;re running so we can offer suggestions.

    If you;re on a *nix based os, try doing a:

    cat /var/log/formmail.log

    from a root prompt to see what you've got.

    edit: Also would be helpful if we knew which proxy and version of such you;re running.
     
    theapparatus, Jan 6, 2010 IP
  3. WoW Blood

    WoW Blood Well-Known Member

    Messages:
    164
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    135
    #3
    I am running on CentOS release 5.3 (Final) and the proxy I am using is Glype version 1.1 (Latest)

    Ran cat /var/log/formmail.log and got:
    
    cat: /var/log/formmail.log: No such file or directory
    
    Code (markup):
     
    WoW Blood, Jan 6, 2010 IP
  4. theapparatus

    theapparatus Peon

    Messages:
    2,925
    Likes Received:
    119
    Best Answers:
    0
    Trophy Points:
    0
    #4
    I'm blocked from the site from the library and for some strange reason the Glype site doesn't allow proxies to connect but a quick google pulls up this:

    http://glype.com/forums/index.php?/topic/4743-spam-message-about

    Looking at the date and what I can see in google, there may be an issue.

    edit: one of the librarians tried to pull it up for me and got blocked as well. They're supposed to have unfiltered access. Going through a VPN tunnel on one of my servers gets time out errors. Sorry that I couldn;t help more.
     
    Last edited: Jan 6, 2010
    theapparatus, Jan 6, 2010 IP
  5. WoW Blood

    WoW Blood Well-Known Member

    Messages:
    164
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    135
    #5
    got this when trying to view that link
    
    [#10343] We could not determine which topic you were attempting to view. 
    
    Code (markup):
     
    WoW Blood, Jan 6, 2010 IP
  6. cocodude

    cocodude Active Member

    Messages:
    37
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    55
    #6
    If it comes down to it, and if you think your blocking isn't working, maybe you could ask your provider to block port 25 from your IP address? We've had to do that on occasion for abusive customers.
     
    cocodude, Jan 7, 2010 IP
  7. theapparatus

    theapparatus Peon

    Messages:
    2,925
    Likes Received:
    119
    Best Answers:
    0
    Trophy Points:
    0
    #7
    As noted up above, that's already being done. Please remember that it's always a good idea to read the thread that you post in.

    I finally got though via google cache (that's now blocked at the library as well) and the link is worthless. Sorry about that.

    Try looking at your webserver's logs to see if there's a single IP address that sticks out.

    If you want to pm me with your login and root information, I could take a look. I'll be in and out all day though.
     
    theapparatus, Jan 7, 2010 IP
  8. tamer1009

    tamer1009 Peon

    Messages:
    74
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    0
    #8
    backup important files, change passwords, reinstall os. :D
     
    tamer1009, Jan 7, 2010 IP
  9. cocodude

    cocodude Active Member

    Messages:
    37
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    55
    #9
    I think there's a misinterpretation here.

    I'm assuming port 25 was blocked from within the VPS but for some reason is not working. I'm suggesting that the OP asks the person who manages the outer container of the VPS (think dom0 in Xen terms) to block port 25 from the outer container itself.
     
    cocodude, Jan 7, 2010 IP
  10. RonBrown

    RonBrown Well-Known Member

    Messages:
    934
    Likes Received:
    55
    Best Answers:
    4
    Trophy Points:
    105
    #10
    I just wanted to be sure that when you block Port 25 you are are blocking this as an outgoing connection.

    In most cases, when people say they are blocking Port 25, they block that port on their server which results in the server being unable to accept incoming connections on this port.

    However, when someone sends an email FROM your server it will not necessarily use Port 25 to SEND the email so blocking Port 25 does not stop emails being sent out.

    You need to be sure that you are blocking connections from ANY port on your server from connecting to port 25 on an external server.

    Maybe that's what you meant, but I just wanted to be sure.
     
    RonBrown, Jan 7, 2010 IP
  11. WoW Blood

    WoW Blood Well-Known Member

    Messages:
    164
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    135
    #11
    Okay well I asked my host about blocking port 25 from my IP and they said


    "This hypervisor (VMware) works different than Xen.
    I can't block port 25 from without the hypervisor.
    But you can disable port 25 in your iptables firewall."

    So how do I disable port 25 in my iptables firewall. (not to familiar with CentOS.)
     
    WoW Blood, Jan 8, 2010 IP
  12. ATTRACTI

    ATTRACTI Peon

    Messages:
    21
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #12
    if you dont know how to block 25/OUT (not IN, its simpler!) better block it with support request not with firewall
     
    ATTRACTI, Jan 8, 2010 IP
  13. WoW Blood

    WoW Blood Well-Known Member

    Messages:
    164
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    135
    #13
    So is blocking port 25/out hard?
     
    WoW Blood, Jan 9, 2010 IP
  14. ATTRACTI

    ATTRACTI Peon

    Messages:
    21
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #14
    you need this: iptables -A FORWARD -o eth0 -p tcp --dport 25 -j REJECT
     
    ATTRACTI, Jan 10, 2010 IP
  15. Fouldini

    Fouldini Greenhorn

    Messages:
    24
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    11
    #15
    If its bothering them so much, back everything up and ask for an OS reset, then just throw your configs and files back on?
     
    Fouldini, Jan 10, 2010 IP
  16. WoW Blood

    WoW Blood Well-Known Member

    Messages:
    164
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    135
    #16
    Thanks for your help:)
     
    WoW Blood, Jan 11, 2010 IP
  17. ATTRACTI

    ATTRACTI Peon

    Messages:
    21
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #17
    Any time!) I know kung-fu and kung-linux!)
     
    ATTRACTI, Jan 25, 2010 IP