Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Email Spoofing Exim How Can This Be Stopped

Discussion in 'E-mail Discussions' started by esse, Dec 8, 2008.

Page 1 of 2
  1. esse

    esse Member

    Joined:
    Oct 3, 2006
    Messages:
    22
    Likes Received:
    0
    Trophy Points:
    151
    I just tested my server and found that I could send spoofed e-mail. Good news is the headers show the originating IP address. I'd like to know how to defeat this process;

    I did this from Windows XP without using any credentials whatsoever:

    run > cmd > enter
    telnet > enter
    o mail.myserver.com 25 > enter
    Mail from: myadminacct@mydomain.com > enter
    RCPT to: anyaddress@anydomain.com > enter
    DATA > enter
    From: myadminacct@mydomain.com > enter
    TO: anyaddress@anydomain.com > enter
    Hello. > enter
    This is a spoofed email from my server > enter
    . > enter
    > enter


    anyaddress@anydomain.com gets the email from the forged myadminacct@mydomain.com
     
    #1 esse, Dec 8, 2008
  2. sparek-3

    sparek-3 Well-Known Member

    Joined:
    Aug 10, 2002
    Messages:
    1,599
    Likes Received:
    60
    Trophy Points:
    328
    cPanel Access Level:
    Root Administrator
    You can't stop this. This is how SMTP works.

    Best to look into something like SPF or DomainKeys which are used in conjunction with a recipient's mail server to check the validity of the sending server, and whether or not that sending server is suppose to be allowed to send out mail from mydomain.com.
     
    #2 sparek-3, Dec 8, 2008
  3. esse

    esse Member

    Joined:
    Oct 3, 2006
    Messages:
    22
    Likes Received:
    0
    Trophy Points:
    151
    I have SPF and domain keys configured properly. The server also passes the open relay tests. So you're saying anyone from anywhere can send e-mail as anyone from anywhere in this fashion?
     
    #3 esse, Dec 8, 2008
    Last edited: Dec 8, 2008
  4. sparek-3

    sparek-3 Well-Known Member

    Joined:
    Aug 10, 2002
    Messages:
    1,599
    Likes Received:
    60
    Trophy Points:
    328
    cPanel Access Level:
    Root Administrator
    That is correct.
     
    #4 sparek-3, Dec 8, 2008
  5. esse

    esse Member

    Joined:
    Oct 3, 2006
    Messages:
    22
    Likes Received:
    0
    Trophy Points:
    151
    I can't say it's been a problem for me, but I have had a couple of these turn up over the years and I had no idea where they came from.

    Do spammers have a script they can use to exploit this or is this limited to sending one e-mail at a time?
     
    #5 esse, Dec 8, 2008
  6. rhenderson

    rhenderson Well-Known Member

    Joined:
    Apr 21, 2005
    Messages:
    785
    Likes Received:
    0
    Trophy Points:
    166
    Location:
    Oklahoma
    cPanel Access Level:
    Root Administrator
    Won't authentication before SMTP stop this? I thought it was the whole point.
     
    #6 rhenderson, Dec 8, 2008
  7. esse

    esse Member

    Joined:
    Oct 3, 2006
    Messages:
    22
    Likes Received:
    0
    Trophy Points:
    151
    I have it turned on and I also have the SMTP tweak setup. Give it a shot on your server and see if you get the same results.

    Don't use the > (greater than signs) I just put those in to say do this next.
     
    #7 esse, Dec 8, 2008
  8. rhenderson

    rhenderson Well-Known Member

    Joined:
    Apr 21, 2005
    Messages:
    785
    Likes Received:
    0
    Trophy Points:
    166
    Location:
    Oklahoma
    cPanel Access Level:
    Root Administrator
    Nope mine stops it:

    530 Relaying not allowed ( Please enable smtp authentication on your email client; )

    Pm me and I will let you try it.
     
    #8 rhenderson, Dec 8, 2008
  9. esse

    esse Member

    Joined:
    Oct 3, 2006
    Messages:
    22
    Likes Received:
    0
    Trophy Points:
    151
    I don't use bind on my server. I use and external DNS server. I changed the theme on the main site from x to x3 and enabled SPF authentication in Cpanel and so far it looks like I am no longer able to send like this.

    I did a hard bounce -all

    Does this mean that SPF authentication has to be turned on in CPanel?

    I setup all my domain keys manually way back when they were still experimental in cpanel. It won't take too much effort to go in and setup all the SPF records for the domains I host if this will do the trick.
     
    #9 esse, Dec 8, 2008
  10. esse

    esse Member

    Joined:
    Oct 3, 2006
    Messages:
    22
    Likes Received:
    0
    Trophy Points:
    151
    I believe you. Where did you setup pop before smtp. I did it in the tweak section. Should I be doing it somewhere else?
     
    #10 esse, Dec 8, 2008
  11. rhenderson

    rhenderson Well-Known Member

    Joined:
    Apr 21, 2005
    Messages:
    785
    Likes Received:
    0
    Trophy Points:
    166
    Location:
    Oklahoma
    cPanel Access Level:
    Root Administrator
    cPanel has domain keys setup now. But without them you should not be able to send if you have authentication set.

    Have you tested your mail server with

    http://mxtoolbox.com/
     
    #11 rhenderson, Dec 8, 2008
  12. rhenderson

    rhenderson Well-Known Member

    Joined:
    Apr 21, 2005
    Messages:
    785
    Likes Received:
    0
    Trophy Points:
    166
    Location:
    Oklahoma
    cPanel Access Level:
    Root Administrator
    Go to WHM >> Main >> Service Configuration >> Service Manager and see if tailwatchd is checked for enabled and monitoring.
     
    #12 rhenderson, Dec 8, 2008
  13. esse

    esse Member

    Joined:
    Oct 3, 2006
    Messages:
    22
    Likes Received:
    0
    Trophy Points:
    151
    I got WARNING! Your server could be an open relay. I've got something configured wrong.
     
    #13 esse, Dec 8, 2008
  14. esse

    esse Member

    Joined:
    Oct 3, 2006
    Messages:
    22
    Likes Received:
    0
    Trophy Points:
    151
    It was not set for monitoring
    Also all the sub items are checked.
    x cPbandwd
    x Eximstats
    x Antirelayd
     
    #14 esse, Dec 8, 2008
  15. rhenderson

    rhenderson Well-Known Member

    Joined:
    Apr 21, 2005
    Messages:
    785
    Likes Received:
    0
    Trophy Points:
    166
    Location:
    Oklahoma
    cPanel Access Level:
    Root Administrator
    Check and see if it is running

    root@[~]# ps faux | grep tail

    It probably failed at some point and was not restarted, then you have an open relay, if not running start it (should have monitoring checked IMO)

    /usr/local/cpanel/bin/tailwatchd --start

    Then try the mxtools again.
     
    #15 rhenderson, Dec 8, 2008
  16. esse

    esse Member

    Joined:
    Oct 3, 2006
    Messages:
    22
    Likes Received:
    0
    Trophy Points:
    151
    root 18460 0.0 0.0 5016 660 pts/0 S+ 23:49 0:00 \_ grep tail
    root 5749 0.0 0.2 9108 6112 ? Ss 22:29 0:00 tailwatchd
     
    #16 esse, Dec 8, 2008
  17. rhenderson

    rhenderson Well-Known Member

    Joined:
    Apr 21, 2005
    Messages:
    785
    Likes Received:
    0
    Trophy Points:
    166
    Location:
    Oklahoma
    cPanel Access Level:
    Root Administrator
    Hmmm, I figured it would not be running. You have custom Exim entries?
     
    #17 rhenderson, Dec 8, 2008
  18. rhenderson

    rhenderson Well-Known Member

    Joined:
    Apr 21, 2005
    Messages:
    785
    Likes Received:
    0
    Trophy Points:
    166
    Location:
    Oklahoma
    cPanel Access Level:
    Root Administrator
    Do you not have chkservd in that list?
     
    #18 rhenderson, Dec 8, 2008
  19. esse

    esse Member

    Joined:
    Oct 3, 2006
    Messages:
    22
    Likes Received:
    0
    Trophy Points:
    151
    No I don't see it.

    BTW thanks for taking the time to help me. I am going to reset the exim.conf to default.
     
    #19 esse, Dec 8, 2008
  20. rhenderson

    rhenderson Well-Known Member

    Joined:
    Apr 21, 2005
    Messages:
    785
    Likes Received:
    0
    Trophy Points:
    166
    Location:
    Oklahoma
    cPanel Access Level:
    Root Administrator
    What version of cPanel are you using? Were on 11.24.2 - CentOs and I think it has been there a while.
     
    #20 rhenderson, Dec 8, 2008
(You must log in or sign up to post here.)
Page 1 of 2
Loading...
Similar Threads - Email Spoofing Exim
  1. williama5

    Email Spoofing Exim How Can This Be Stopped

    williama5, Nov 1, 2017, in forum: E-mail Discussions
    Replies:
    2
    Views:
    286
    cPanelMichael
    Nov 1, 2017
  2. jk_dc

    Email Tracking & Reporting

    jk_dc, Apr 20, 2018 at 3:49 AM, in forum: E-mail Discussions
    Replies:
    1
    Views:
    39
    cPanelMichael
    Apr 20, 2018 at 12:56 PM
  3. Phylum

    Cron Damon emails regarding missing /etc/krb5.keytab

    Phylum, Apr 19, 2018 at 12:13 PM, in forum: General Discussion
    Replies:
    2
    Views:
    29
    Phylum
    Apr 19, 2018 at 2:31 PM
  4. ev88

    SOLVED Adding a 'default' email account

    ev88, Apr 18, 2018 at 5:28 PM, in forum: E-mail Discussions
    Replies:
    7
    Views:
    72
    cPanelLauren
    Apr 20, 2018 at 12:26 PM
  5. tivilardo

    HTML email redirect via exim

    tivilardo, Apr 18, 2018 at 3:33 PM, in forum: E-mail Discussions
    Replies:
    3
    Views:
    37
    cPanelLauren
    Apr 19, 2018 at 9:26 AM

Share This Page