Preventing 127.0.0.1/localhost spamming via exim

[optize]

This doesn't happen very often, but when it does happen it creates quite a mess...

Someone will use jailshell/ssh to log in and tunnel in spam via localhost. Since it doesn't come in via apache/php/litespeed/whatever, it's not being tracked to their account.

CSF does detect the outbound spam, but has no ways of stopping it, unless I'm missing something:

--
Time: Mon Apr 9 06:16:54 2012 -0700
Type: LOCALHOSTRELAY, localhost - 127.0.0.1
Count: 150 emails relayed
Blocked: No

Sample of the first 10 emails:

2012-04-09 06:16:51 [217979] 1SHESg-000uhn-4d <= [email protected] H=localhost.localdomain (User) [127.0.0.1]:51686 I=[127.0.0.1]:25 P=smtp S=1935 T="Read This And Get Back To Me Please" from <[email protected]> for [email protected],[email protected],etc..
--

There has to be a way to either track to this to the account, so the max exim emails per hour restriction will take effect, or a way to not allow this kind of relaying, without breaking web scripts, etc.

I can't be the only one that has ran into this issue...

 

[optize]

Oh look, similar threads saved the day..

http://forums.cpanel.net/f145/case-49977-localhost-127-0-0-1-smtp-auth-218591.html

It says it's supposed to be added into 11.31.1.2.... I'm on 11.32 and it's not added?

Can someone confirm it's been added?

 

[mephisto]

We have the same problem. 11.32 doesn't seem to have it fixed. Any ideas? Maybe someone from cPanel team can respond?

 

[cPanelTristan]

Can you try to set this option to no:

http://forums.cpanel.net/f43/help-tracking-spammer-221692-p2.html#post1112901

Basically, revise /etc/ssh/sshd_config with "AllowTcpForwarding" set to no rather than yes, then restart SSH.