Circa Thu. Oct. 31, 2002 at 00:32:42 +0200, a lone cry was heard from Togan Muftuoglu in the wasteland called the Internet:

You need it also for mail sending.

That is why it is best to install a fake identd that gives out false info. Here is a list to choose from: http://freshmeat.net/search?q=fake+identd Charles -- "However, complexity is not always the enemy." -- Larry Wall (Open Sources, 1999 O'Reilly and Associates)

On Friday 01 November 2002 11:55 pm, Evert Smit wrote:

Hi List,

i am having a security issue sort of, and was wondering if you know any solutions to this. Someone is bombarding my server with mail, forcing sendmail to run the max allowed child processes and start to reject requests to send mail. what techniques could i use to filter the traffic to sendmail before it acctually hits the daemon, and therefor prevent the high load on it?

regards Evert Smit

If you have a firewall installed, simply block that IP. Iptables can do this for you. I use www.shorewall.net to set it up but I suspece susefirewall will do it too. You could also do this with the access.db but its better to block them with iptables. -- _________________________________________________ No I Don't Yahoo! And I'm getting pretty sick of being asked if I do. _________________________________________________ John Andersen / Juneau Alaska

Evert Smit wrote:

John,

since the attache is comming from multiple servers, i cannot blcok a single IP. and the acess.db file would still require sendmail to at least look at the incomming mail.i.e starting aprocess for it. i need something that happends before the mail reaches the sendmail process... sort of like a gate keeper, that checks the mail recipient and checks if it's aviable or not, before it hads it to sendmail for delivery.

But you can block an IP range ie. 192 REJECT will block all network 192.x.x.x. -- .-. e-SecureNet /v\ We Run SuSE Project Manager // \\ *The LINUX Experts* c/o Miguel Albuquerque /( )\ Av. Miremont 46 ^^-^^ 1202 - GE, SWITZERLAND Tel: +41 (22) 782 5344 Fax: +41 (22) 782 5348 mailto:mfoacs@e-securenet.ch http://www.e-securenet.ch

here an example heder of how such a post looks like. because the mails are comming from various server, like ibm.com, compaq, yahoo, companies all over the world, blocking IP's will not make sence. i think we should call this a bounce attack, because that is eventually what happends... send out mails with wrong adresses to millions of computers and give a wrong adress and mail heder with... what happends.. it bounces and the attack heads it's way to the requiret target. here now the example. he send the mail to the stanford mailserver and it bounces.. to me.

From MAILER-DAEMON@lagu.sidhe.net Sat Nov 2 09:33:47 2002 Return-Path: Received: from bouncemail.stanford.edu (bouncemail.Stanford.EDU [171.64.14.35]) by lagu.sidhe.net (8.11.6/8.11.6/SuSE Linux 0.5) with SMTP id gA28XcA00319 for ; Sat, 2 Nov 2002 09:33:46 +0100 Received: (qmail 13328 invoked by uid 80); 2 Nov 2002 03:46:34 -0000 Date: 2 Nov 2002 03:46:34 -0000 Message-ID: <20021102034634.13324.qmail@bouncemail.stanford.edu> To: lobo@0-8-15.ch From: Stanford Bounce Mail Daemon Subject: Undelivered mail for boe@stanford.edu Precedence: junk MIME-Version: 1.0 Content-Type: multipart/report; report-type=delivery-status; boundary="13292.1036208794/bouncemail.stanford.edu" X-Bounce-Agent: Stanford Email Bounce

--13292.1036208794/bouncemail.stanford.edu Your message to: boe@stanford.edu regarding: Be Bold And Courageous could not be delivered because it is not a valid Stanford email address. Perhaps you're trying to reach: Robert Boeninger, Prin Systems Software mailto:boe@SLAC.Stanford.EDU You might be able to find the email address you need by looking through Stanford's online Directory: WWW: http://stanfordwho.stanford.edu/ finger: finger user@whois.stanford.edu whois: whois -h whois.stanford.edu user If this doesn't work, note that at Stanford people are in charge of maintaining their own email information. Those you seek may have chosen not to make their Directory information public, or may have committed a typo when entering their email address(es) into the system. We recommend that you attempt to contact them via other means. This note was generated automatically by a computer program. Please do not reply to it. Responses will be discarded. If you wish to communicate with someone about your bounced message, please send mail to postmaster@stanford.edu. Your original message has been appended below. --13292.1036208794/bouncemail.stanford.edu Content-Type: message/delivery-status Reporting-MTA: dns; bouncemail.stanford.edu Received-From-MTA: dns; stanford.edu Final-Recipient: rfc822; boe@stanford.edu Action: failed Status: 5.1.1 --13292.1036208794/bouncemail.stanford.edu Content-Type: message/rfc822 Received: (qmail 13286 invoked from network); 2 Nov 2002 03:46:30 -0000 Received: from leland3.stanford.edu (171.64.14.90) by bouncemail.stanford.edu with SMTP; 2 Nov 2002 03:46:30 -0000 Received: from leland3.Stanford.EDU (localhost [127.0.0.1]) by leland3.Stanford.EDU (8.11.6/8.11.6) with ESMTP id gA23kSs24136; Fri, 1 Nov 2002 19:46:29 -0800 (PST) Received: from 1012privat.at (ip-170-149-113.xdsl-fixo.ctbcnetsuper.com.br [200.170.149.113]) by leland3.Stanford.EDU (8.11.6/8.11.6) with SMTP id gA23i3U23625; Fri, 1 Nov 2002 19:44:39 -0800 (PST) From: lobo@0-8-15.ch X-Priority: 3 Received: from 1012privat.at by 0AEO3V.1012privat.at with SMTP for nephron@leland.stanford.edu; Fri, 01 Nov 2002 22:39:54 -0500 Message-Id: <1VCK7GOQ28UQJ5I56.0PY9VQ1UBY7OI.lobo@0-8-15.ch> Reply-To: nephron@24hours.gr To: nephron@Stanford.EDU Date: Fri, 01 Nov 2002 22:39:54 -0500 Content-Type: text/plain; charset="iso-8859-1" Subject: Be Bold And Courageous Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 PARENTS OF 15 - YEAR OLD - FIND $71,000 CASH HIDDEN IN HIS CLOSET!= any ideas? -----Original Message----- From: Miguel Albuquerque [mailto:mfoacs@e-workshop.ch] Sent: Saturday, November 02, 2002 9:49 AM To: Evert Smit Cc: suse-security@suse.com Subject: Re: [suse-security] DOS on sendmail daemon Evert Smit wrote:

John,

since the attache is comming from multiple servers, i cannot blcok a single IP. and the acess.db file would still require sendmail to at least look at the incomming mail.i.e starting aprocess for it. i need something that happends before the mail reaches the sendmail process... sort of like a gate keeper, that checks the mail recipient and checks if it's aviable or not, before it hads it to sendmail for delivery.

But you can block an IP range ie. 192 REJECT will block all network 192.x.x.x. -- .-. e-SecureNet /v\ We Run SuSE Project Manager // \\ *The LINUX Experts* c/o Miguel Albuquerque /( )\ Av. Miremont 46 ^^-^^ 1202 - GE, SWITZERLAND Tel: +41 (22) 782 5344 Fax: +41 (22) 782 5348 mailto:mfoacs@e-securenet.ch http://www.e-securenet.ch -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help@suse.com Security-related bug reports go to security@suse.de, not here

On Saturday 02 November 2002 10:17 am, Miguel Albuquerque wrote: Hi,

Your server is an open relay, close it.

Of course this is the most important action.

Try adding an REJECT access rule for this domain:

ip-170-149-113.xdsl-fixo.ctbcnetsuper.com.br

or his IP/Network:

...

[200.170.149.113])

Please be very careful with adding reject rules. Basically this leads to blocking many innocent people and is potentially a partial DOS. (the above address looks to me like a dynamic dial up / DSL number) Regards, --martin -- -- Dipl.-Phys. Martin Konold e r f r a k o n Erlewein, Frank, Konold & Partner - Beratende Ingenieure und Physiker Germanenstrasse 15, 70563 Stuttgart, Germany email: martin.konold@erfrakon.de

GertJan Spoelman wrote:

On Saturday 02 November 2002 10:17, Miguel Albuquerque wrote:

...

Evert Smit wrote:

See this:

...

by lagu.sidhe.net (8.11.6/8.11.6/SuSE Linux 0.5) with SMTP id gA28XcA00319

^^^^^^^^^^^^^^^ Your server is an open relay, close it.

I don't understand how you conclude that his server is an open relay from that line, to me that line and the previous one (see below) only says that the bounce message is received from stanford by his domain and not that the original (spam) message was sent by his domain.

...

...

Received: from bouncemail.stanford.edu (bouncemail.Stanford.EDU [171.64.14.35]) by lagu.sidhe.net (8.11.6/8.11.6/SuSE Linux 0.5) with SMTP id gA28XcA00319 for ; Sat, 2 Nov 2002 09:33:46 +0100

Furthermore if he was an open relay his domain should have been in the lines below, but I only see that the original mail was received by stanford from that 200.170.149.113 ip-address.

...

...

Received: from 1012privat.at (ip-170-149-113.xdsl-fixo.ctbcnetsuper.com.br [200.170.149.113]) by leland3.Stanford.EDU (8.11.6/8.11.6) with SMTP id gA23i3U23625; Fri, 1 Nov 2002 19:44:39 -0800 (PST) From: lobo@0-8-15.ch

Yes, you're right, I remember now few mounths ago I had the same problem (it was an open relay), and it took about 5 days until all the bouces finished. I had more than 1600 per hour in 2 days. What I did was, closing the relay and flush the mailq to prevent more traffic. In my case was easy, the server had just been installed and pulling the plug off was harmless. I try body_checks with procmail, that might work for your, smth like : /^From: MAILER-DAEMON\.*/ REJECT You will need FEATURE loca_procmail enabled in your sendmail.cf, means rebuild M4...(I love Postfix). ... -- .-. e-SecureNet /v\ We Run SuSE Project Manager // \\ *The LINUX Experts* c/o Miguel Albuquerque /( )\ Av. Miremont 46 ^^-^^ 1202 - GE, SWITZERLAND Tel: +41 (22) 782 5344 Fax: +41 (22) 782 5348 mailto:mfoacs@e-securenet.ch http://www.e-securenet.ch "Was Sind und was Sollen die Zahlen?" Dedekind. ____________________________________________________________

On Saturday 02 November 2002 12:40 am, Evert Smit wrote:

here an example heder of how such a post looks like. because the mails are comming from various server, like ibm.com, compaq, yahoo, companies all over the world, blocking IP's will not make sence.

i think we should call this a bounce attack, because that is eventually what happends... send out mails with wrong adresses to millions of computers and give a wrong adress and mail heder with... what happends.. it bounces and the attack heads it's way to the requiret target.

But it will take as much resource to examine the headers as to allow sendmail to handle it. The job is the same, whether sendmail does it or the thing you want to put in front of sendmail. If you don't relay, sendmail gets rid of these very quickly. Still there are other MTAs that may be a bit more efficient than sendmail, but the process of changing may be not something you want to do on the fly. -- _________________________________________________ No I Don't Yahoo! And I'm getting pretty sick of being asked if I do. _________________________________________________ John Andersen / Juneau Alaska

Quoting Evert Smit :

Hi List,

i am having a security issue sort of, and was wondering if you know any solutions to this. Someone is bombarding my server with mail, forcing sendmail to run the max allowed child processes and start to reject requests to send mail. what techniques could i use to filter the traffic to sendmail before it acctually hits the daemon, and therefor prevent the high load on it?

Hi, I have read 19 messages in this thread from which I understand: lobo@0-8-15.ch was forged by the attacker. at Fri, 1 Nov 2002 19:46:29 -0800, the attacker's host was: 200.170.149.113 ip-170-149-113.xdsl-fixo.ctbcnetsuper.com.br. (assuming the clock at leland3.Stanford.EDU is accurate) There is no evidence of your host being an open relay, just a victim of a mail bomb attack. Blocking 200.170.149.113 will have no effect as the attacker is not coming in directly. Blocking any other IP is futile as the attacker could use any mail server as a source and all you will achieve is potentially blocking valid mails. You should complain loudly but politely to the attacker's isp, abuse@ctbctelecom.net.br and/or security@ctbctelecom.net.br presenting a sample of the evidence ie logs and a few bounced messages. If a particular mail server is being heavily used to bounce messages to you, it may be worth advising the postmaster at that site of the abuse of his server. You can protect your server by dropping the load sendmail can place on the system. Reducing the value of "O RefuseLA=nn" will lower the threshold at which connections are refused. Setting "O ConnectionRateThrottle=nn" will limit the number of connections per second. You could achieve a similar rate limiting in iptables with: iptables -N THROTTLE iptables -A THROTTLE -p tcp --dport 25 -m limit --limit nn/sec --limit-burst mm -j ACCEPT iptables -I INPUT xx -p tcp --dport 25 -m state NEW -j THROTTLE (see iptables -m limit --help) Both these measures will reduce your mail throughput but its better than have the server keel over. HTH John