Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

Email Spoofing Exim How Can This Be Stopped

Discussion in 'E-mail Discussion' started by esse, Dec 8, 2008.

Page 1 of 2
  1. esse

    esse Member

    Joined:
    Oct 3, 2006
    Messages:
    22
    Likes Received:
    0
    Trophy Points:
    151
    I just tested my server and found that I could send spoofed e-mail. Good news is the headers show the originating IP address. I'd like to know how to defeat this process;

    I did this from Windows XP without using any credentials whatsoever:

    run > cmd > enter
    telnet > enter
    o mail.myserver.com 25 > enter
    Mail from: myadminacct@mydomain.com > enter
    RCPT to: anyaddress@anydomain.com > enter
    DATA > enter
    From: myadminacct@mydomain.com > enter
    TO: anyaddress@anydomain.com > enter
    Hello. > enter
    This is a spoofed email from my server > enter
    . > enter
    > enter


    anyaddress@anydomain.com gets the email from the forged myadminacct@mydomain.com
     
    #1 esse, Dec 8, 2008
  2. sparek-3

    sparek-3 Well-Known Member

    Joined:
    Aug 10, 2002
    Messages:
    1,799
    Likes Received:
    131
    Trophy Points:
    343
    cPanel Access Level:
    Root Administrator
    You can't stop this. This is how SMTP works.

    Best to look into something like SPF or DomainKeys which are used in conjunction with a recipient's mail server to check the validity of the sending server, and whether or not that sending server is suppose to be allowed to send out mail from mydomain.com.
     
    #2 sparek-3, Dec 8, 2008
  3. esse

    esse Member

    Joined:
    Oct 3, 2006
    Messages:
    22
    Likes Received:
    0
    Trophy Points:
    151
    I have SPF and domain keys configured properly. The server also passes the open relay tests. So you're saying anyone from anywhere can send e-mail as anyone from anywhere in this fashion?
     
    #3 esse, Dec 8, 2008
    Last edited: Dec 8, 2008
  4. sparek-3

    sparek-3 Well-Known Member

    Joined:
    Aug 10, 2002
    Messages:
    1,799
    Likes Received:
    131
    Trophy Points:
    343
    cPanel Access Level:
    Root Administrator
    That is correct.
     
    #4 sparek-3, Dec 8, 2008
  5. esse

    esse Member

    Joined:
    Oct 3, 2006
    Messages:
    22
    Likes Received:
    0
    Trophy Points:
    151
    I can't say it's been a problem for me, but I have had a couple of these turn up over the years and I had no idea where they came from.

    Do spammers have a script they can use to exploit this or is this limited to sending one e-mail at a time?
     
    #5 esse, Dec 8, 2008
  6. rhenderson

    rhenderson Well-Known Member

    Joined:
    Apr 21, 2005
    Messages:
    785
    Likes Received:
    1
    Trophy Points:
    166
    Location:
    Oklahoma
    cPanel Access Level:
    Root Administrator
    Won't authentication before SMTP stop this? I thought it was the whole point.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #6 rhenderson, Dec 8, 2008
  7. esse

    esse Member

    Joined:
    Oct 3, 2006
    Messages:
    22
    Likes Received:
    0
    Trophy Points:
    151
    I have it turned on and I also have the SMTP tweak setup. Give it a shot on your server and see if you get the same results.

    Don't use the > (greater than signs) I just put those in to say do this next.
     
    #7 esse, Dec 8, 2008
  8. rhenderson

    rhenderson Well-Known Member

    Joined:
    Apr 21, 2005
    Messages:
    785
    Likes Received:
    1
    Trophy Points:
    166
    Location:
    Oklahoma
    cPanel Access Level:
    Root Administrator
    Nope mine stops it:

    530 Relaying not allowed ( Please enable smtp authentication on your email client; )

    Pm me and I will let you try it.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #8 rhenderson, Dec 8, 2008
  9. esse

    esse Member

    Joined:
    Oct 3, 2006
    Messages:
    22
    Likes Received:
    0
    Trophy Points:
    151
    I don't use bind on my server. I use and external DNS server. I changed the theme on the main site from x to x3 and enabled SPF authentication in Cpanel and so far it looks like I am no longer able to send like this.

    I did a hard bounce -all

    Does this mean that SPF authentication has to be turned on in CPanel?

    I setup all my domain keys manually way back when they were still experimental in cpanel. It won't take too much effort to go in and setup all the SPF records for the domains I host if this will do the trick.
     
    #9 esse, Dec 8, 2008
  10. esse

    esse Member

    Joined:
    Oct 3, 2006
    Messages:
    22
    Likes Received:
    0
    Trophy Points:
    151
    I believe you. Where did you setup pop before smtp. I did it in the tweak section. Should I be doing it somewhere else?
     
    #10 esse, Dec 8, 2008
  11. rhenderson

    rhenderson Well-Known Member

    Joined:
    Apr 21, 2005
    Messages:
    785
    Likes Received:
    1
    Trophy Points:
    166
    Location:
    Oklahoma
    cPanel Access Level:
    Root Administrator
    cPanel has domain keys setup now. But without them you should not be able to send if you have authentication set.

    Have you tested your mail server with

    http://mxtoolbox.com/
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #11 rhenderson, Dec 8, 2008
  12. rhenderson

    rhenderson Well-Known Member

    Joined:
    Apr 21, 2005
    Messages:
    785
    Likes Received:
    1
    Trophy Points:
    166
    Location:
    Oklahoma
    cPanel Access Level:
    Root Administrator
    Go to WHM >> Main >> Service Configuration >> Service Manager and see if tailwatchd is checked for enabled and monitoring.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #12 rhenderson, Dec 8, 2008
  13. esse

    esse Member

    Joined:
    Oct 3, 2006
    Messages:
    22
    Likes Received:
    0
    Trophy Points:
    151
    I got WARNING! Your server could be an open relay. I've got something configured wrong.
     
    #13 esse, Dec 8, 2008
  14. esse

    esse Member

    Joined:
    Oct 3, 2006
    Messages:
    22
    Likes Received:
    0
    Trophy Points:
    151
    It was not set for monitoring
    Also all the sub items are checked.
    x cPbandwd
    x Eximstats
    x Antirelayd
     
    #14 esse, Dec 8, 2008
  15. rhenderson

    rhenderson Well-Known Member

    Joined:
    Apr 21, 2005
    Messages:
    785
    Likes Received:
    1
    Trophy Points:
    166
    Location:
    Oklahoma
    cPanel Access Level:
    Root Administrator
    Check and see if it is running

    root@[~]# ps faux | grep tail

    It probably failed at some point and was not restarted, then you have an open relay, if not running start it (should have monitoring checked IMO)

    /usr/local/cpanel/bin/tailwatchd --start

    Then try the mxtools again.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #15 rhenderson, Dec 8, 2008
  16. esse

    esse Member

    Joined:
    Oct 3, 2006
    Messages:
    22
    Likes Received:
    0
    Trophy Points:
    151
    root 18460 0.0 0.0 5016 660 pts/0 S+ 23:49 0:00 \_ grep tail
    root 5749 0.0 0.2 9108 6112 ? Ss 22:29 0:00 tailwatchd
     
    #16 esse, Dec 8, 2008
  17. rhenderson

    rhenderson Well-Known Member

    Joined:
    Apr 21, 2005
    Messages:
    785
    Likes Received:
    1
    Trophy Points:
    166
    Location:
    Oklahoma
    cPanel Access Level:
    Root Administrator
    Hmmm, I figured it would not be running. You have custom Exim entries?
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #17 rhenderson, Dec 8, 2008
  18. rhenderson

    rhenderson Well-Known Member

    Joined:
    Apr 21, 2005
    Messages:
    785
    Likes Received:
    1
    Trophy Points:
    166
    Location:
    Oklahoma
    cPanel Access Level:
    Root Administrator
    Do you not have chkservd in that list?
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #18 rhenderson, Dec 8, 2008
  19. esse

    esse Member

    Joined:
    Oct 3, 2006
    Messages:
    22
    Likes Received:
    0
    Trophy Points:
    151
    No I don't see it.

    BTW thanks for taking the time to help me. I am going to reset the exim.conf to default.
     
    #19 esse, Dec 8, 2008
  20. rhenderson

    rhenderson Well-Known Member

    Joined:
    Apr 21, 2005
    Messages:
    785
    Likes Received:
    1
    Trophy Points:
    166
    Location:
    Oklahoma
    cPanel Access Level:
    Root Administrator
    What version of cPanel are you using? Were on 11.24.2 - CentOs and I think it has been there a while.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #20 rhenderson, Dec 8, 2008
(You must log in or sign up to post here.)
Page 1 of 2
Loading...
Similar Threads - Email Spoofing Exim
  1. williama5

    Email Spoofing Exim How Can This Be Stopped

    williama5, Nov 1, 2017, in forum: E-mail Discussion
    Replies:
    2
    Views:
    1,243
    cPanelMichael
    Nov 1, 2017
  2. stronciy

    Email Spoofing

    stronciy, May 20, 2018, in forum: E-mail Discussion
    Replies:
    3
    Views:
    351
    cPanelMichael
    May 21, 2018
  3. Bermendy88

    New Thread Problems logging into email

    Bermendy88, Dec 14, 2018 at 4:35 AM, in forum: E-mail Discussion
    Replies:
    1
    Views:
    200
    HostSane
    Dec 14, 2018 at 7:09 AM
  4. Kareem Hussien

    New Thread Not receiving email issue

    Kareem Hussien, Dec 13, 2018 at 4:16 PM, in forum: E-mail Discussion
    Replies:
    5
    Views:
    141
    Jarvis421
    Dec 15, 2018 at 1:19 AM
  5. Bashed

    New Thread Email history question

    Bashed, Dec 13, 2018 at 3:12 PM, in forum: E-mail Discussion
    Replies:
    1
    Views:
    107
    Bashed
    Dec 14, 2018 at 10:27 PM

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...
    Dismiss Notice