[SPAM] Re: [vchkpw] [SPAM] Re: [vchkpw] Qmail maillog vchkpw-submission vs vchkpw-smtp
Tom Collins <[email protected]> Tue, 4 Mar 2014 22:57:32 -0800
| Newsgroups | gmane.mail.vpopmail |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail=_4DB555A9-9282-44E3-A7E4-C54AD63BE886 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=iso-8859-1 The submission entries outside the US could very well be from hacked accounts. I'm finding a surprising number of compromised accounts (once a week?), including users with good passwords, so I have to assume they're snooped on public wireless, or their computers are compromised by malware of some sort. The vckpw-smtp entries from outside the US are probably also hacked accounts, since mail received from remote servers doesn't include authentication. Sorry I wasn't thinking clearly in my previous response -- I forgot these were vchkpw entries and are only related to authentication. I was thinking about qmail logs. -Tom On Mar 4, 2014, at 10:43 PM, LHTek wrote: > Thanks for the reply. > > NOTE: None of my users will have sent anything from outside the US. > > I've got some log entries for vchkpw-submission (marked as successful in the log) with non-US IP's (Russia, Egypt, Honk Kong, etc). In my analysis I'm marking those entries as hacked accounts. > > From what I read from your response, vchkpw-smtp (marked as successful in the log) entries could be mail sent TO my server FROM another server on port 25. That tells me those are probably safe submissions - even if they are from overseas IPs. Am I thinking correctly? > > > > > From: Tom Collins <[email protected]> > To: [email protected] > Sent: Wednesday, March 5, 2014 12:02 AM > Subject: Re: [vchkpw] Qmail maillog vchkpw-submission vs vchkpw-smtp > > vchkpw-submission is on port 587, and is typically used for emai clients relaying mail. It's often set up to require authentication. > > vchkpw-smtp is on port 25, and can be used for email clients to relay mail, or by other servers delivering mail to your server. > > -Tom > > > On Mar 4, 2014, at 9:41 PM, LHTek wrote: > >> In the /var/log/maillog file what is the difference between these 2 entries (vchkpw-submission, vchkpw-smtp)? >> >> example: >> Mar 4 17:27:03 michael vpopmail[14701]: vchkpw-submission: (PLAIN) login success [email protected]:64.185.3.238 >> Mar 4 10:54:42 michael vpopmail[29027]: vchkpw-smtp: (PLAIN) login success [email protected]:64.57.239.114 >> >> > > > > !DSPAM:5316cae034263249811152! --Apple-Mail=_4DB555A9-9282-44E3-A7E4-C54AD63BE886 Content-Transfer-Encoding: 8bit Content-Type: text/html; charset=iso-8859-1 <html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">The submission entries outside the US could very well be from hacked accounts.<div><br></div><div>I'm finding a surprising number of compromised accounts (once a week?), including users with good passwords, so I have to assume they're snooped on public wireless, or their computers are compromised by malware of some sort.</div><div><br></div><div>The vckpw-smtp entries from outside the US are probably also hacked accounts, since mail received from remote servers doesn't include authentication. Sorry I wasn't thinking clearly in my previous response -- I forgot these were vchkpw entries and are only related to authentication. I was thinking about qmail logs.</ div><div><br><div> <span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: auto; -khtml-text-decorations-in-effect: none; text-indent: 0px; -apple-text-size-adjust: auto; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px; "><div>-Tom</div><br class="Apple-interchange-newline"></span> </div> <br><div><div>On Mar 4, 2014, at 10:43 PM, LHTek wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div><div style="color:#000; background-color:#fff; font-family:Courier New, courier, monaco, monospace, sans-serif;font-size:10pt">Thanks for the reply.<br><br>NOTE: None of my users will have sent anything from outside the US.<span><br><br></span>I've got some log entries for vchkpw-submission (marked as successful in the log) with non-US IP's (Russia, Egypt, Honk Kong, etc).<span> In my analysis I'm marking those entries as hacked accounts.</span><div style="color: rgb(0, 0, 0); font-size: 13.3333px; font-family: Courier New,courier,monaco,monospace,sans-serif; background-color: transparent; font-style: normal;"><br><span></span></div><div style="color: rgb(0, 0, 0) ; font-size: 13.3333px; font-family: Courier New,courier,monaco,monospace,sans-serif; background-color: transparent; font-style: normal;"><span>From what I read from your response, </span>vchkpw-smtp (marked as successful in the log) entries could be mail sent TO my server FROM another server on port 25. That tells me those are probably safe submissions - even if they are from overseas IPs. Am I thinking correctly?</div><div style="color: rgb(0, 0, 0); font-size: 13.3333px; font-family: Courier New,courier,monaco,monospace,sans-serif; background-color: transparent; font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 13.3333px; font-family: Courier New,courier,monaco,monospace,sans-serif; background-color: transparent; font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 13.3333px; font-family: Courier New,courier,monaco,monospace,sans-serif; background-color: transparent; font-style: normal;"><br></div><div><br><blockquote style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; margin-top: 5px; padding-left: 5px;"> <div style="font-family: Courier New, courier, monaco, monospace, sans-serif; font-size: 10pt;"> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div dir="ltr"> <hr size="1"> <font face="Arial" size="2"> <b><span style="font-weight:bold;">From:</span></b> Tom Collins <<a href="mailto:[email protected]">[email protected]</a>><br> <b><span style="font-weight: bold;">To:</span></b> <a href="mailto:[email protected]">[email protected]</a> <br> <b><span style="font-weight: bold;">Sent:</span></b> Wednesday, March 5, 2014 12:02 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [vchkpw] Qmail maillog vchkpw-submission vs vchkpw-smtp<br> </font> </div> <div class="y_msg_container"><br><div id="yiv8551571901"><div>vchkpw-submission is on port 587, and is typically used for emai clients relaying mail. It's often set up to require authentication.<div><br clear="none"></div><div>vchkpw-smt p is on port 25, and can be used for email clients to relay mail, or by other servers delivering mail to your server.</div><div><br clear="none"><div> <span class="yiv8551571901Apple-style-span" style="border-collapse:separate;border-spacing:0px 0px;color:rgb(0, 0, 0);font-family:Helvetica;font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:auto;text-indent:0px;text-transform:none;orphans:2;white-space:normal;widows:2;word-spacing:0px;"></span><div>-Tom</div><br class="yiv8551571901Apple-interchange-newline" clear="none"> </div> <br clear="none"><div class="yiv8551571901yqt6697663901" id="yiv8551571901yqt19840"><div><div>On Mar 4, 2014, at 9:41 PM, LHTek wrote:</div><br class="yiv8551571901Apple-interchange-newline" clear="none"><blockquote type="cite"><div><div style="color:#000;background-color:#fff;font-family:Courier New, courier, monaco, monospace, sans-serif;font-size:10pt;"><div class="yiv8551571901msg-body yiv8551571901inner yiv8551571901undoreset" style=""><div id="yiv8551571901"><div><div style="color:#000;background-color:#fff;font-family:Courier New, courier, monaco, monospace, sans-serif;font-size:10pt;"><div>In the /var/log/maillog file what is the difference between these 2 entries (vchkpw-submission, vchkpw-smtp)?</div><div><br clear="none"></div><div style="color:rgb(0, 0, 0);font-size:13.3333px;f ont-family:Courier New, courier, monaco, monospace, sans-serif;background-color:transparent;font-style:normal;">example:</div><div style="color:rgb(0, 0, 0);font-size:13.3333px;font-family:Courier New, courier, monaco, monospace, sans-serif;background-color:transparent;font-style:normal;">Mar 4 17:27:03 michael vpopmail[14701]: vchkpw-submission: (PLAIN) login success [email protected]:64.185.3.238<br clear="none"></div><div>Mar 4 10:54:42 michael vpopmail[29027]: vchkpw-smtp: (PLAIN) login success [email protected]:64.57.239.114</div><div><br clear="none"></div><div style="color:rgb(0, 0, 0);font-size:13.3333px;font-family:Courier New, courier, monaco, monospace, sans-serif;background-color:transparent;font-style:normal;"><br clear="none"></div></div></div></div></div></div> </div> </blockquote></div></div><br clear="none"></div> </div></div><br><br></div> </div> </div> </blockquote></div> </div> </div> </blockquote></div><br></div> !DSPAM:5316cae034263249811152! </body></html> --Apple-Mail=_4DB555A9-9282-44E3-A7E4-C54AD63BE886--