Someone forged an email address from my domain (e.g. admin@mydomain.com) and send a mail to one of my users (e.g. user@mydomain.com). The email attachment contains virus!!!

I reviewed the email logs and found the following:

Nov 19 15:28:44 mail sendmail[28805]: xxxxx: from=<admin@mydomain.com>, size=xxxx, class=0, nrcpts=1, msgid=<xxxx.xxxx@mydomain.com>, protocol=SMTP, daemon=MTA, relay=<a host name> [an IP address]

Not sure if I should disclose the relay info here...

A few questions which I hope you can help me out:

- how to prevent this in the future?
- how can this be done? apparently, it's simply?!!?
- Should i do sth to follow up on this incident?

Thank you for all your help!!! Much Much Much appreciated!!!

Vittibaby

Can someone please give me some advice?

thanks thanks!

I don't know anything about mail server admin, so I can't really help with your questions but have a suggestion.

Our administrators here in work have the same problem and have recently informed us that all mails from them (ie the genuine ones) will be electronically signed. This kind of implies, they don't know how to stop it either, but at least we can tell the forgeries apart from real mails.

John

Thanks John for your suggestion. I'll certainly look into this option...

anyone else who has an idea on how to stop this from happening?

yeah dude

firstly, on your smtp server, only allow reversable dns names..

secondly, you've given everyone access to send mail on your server, as in.. it's probably an 'open-relay'

open-relays are also used for spam

you should prehaps be thankful that this dude alerted you to the problem!

- also... when a user sends an email, they have can specify any email address they like as the 'from" email address, this is because the user may wish to recieve the reply on another email, and also when email was created.. there was no decent way to check the from email address...

thus electronic signitures were born!

Hi Scorpatron,

Thanks for your tips...

1) how do i only allow reversable DNS names on Sendmail? In my case, the hostname actually matches the IP. Therefore, only allowing reversable DNS names will not stop the problem.

2) I do not believe I have an open-relay. How can i double check?

3) yes, i have read a lot of the net and there is really no way to stop him from forging the "From" field. I have written to the owner of the host, (presumably the ISP) but have not had a reply for a week! Anywhere else I can report this issue?

Thanks a lot again!

1) FEATURE(`accept_unresolvable_domains')dn1

That line is in your sendmail.mc

you need to m4 that file.. basically the .mc is a simple version of the .cf file... the actual config of sendmail if over 700 lines!

2) Well... search for "stopping spam on your sendmail"... i actually have no idea, all I know is that to receive mail you need to open up your server to the entire world.. that same server sends mail too.. prehaps you could run 2 sendmail servers, one for getting, and one for sending? or prehaps theres a setting somewhere... im a newb

3) did you check the email header? im guessing you did... if you have the persons ISP & IP & Time of send... then legally they have an obligation to follow it up. Talk to the police they should be able to tell you more.. because the laws are different in certain countries..

Hi scorpatron,

2) I don't think I have 'Open relay' on my sendmail. The Relay feature means someone can use your SMTP server to send mail to others (i.e. relay = a mail comes in but not destinated for my domain and my mail server relay it onto the destinated server). On my sendmail, I only allow people from my internal network to do so, therefore, it shouldn't be "OPEN" to everyone.

I use squirrelmail... that works even when I'm at a public network and my sendmail does not allow relay from public network. Does anyone know why?

thanks.

what does your /etc/mail/access file look like?

Hi scorpatron

I RELAY for the following networks:

mail.mydomain.com
mydomain.com
127.0.0.1
192.168.1

Is this ok? thanks.

yeah thats fine,