[SPAM] Re: [vchkpw] [SPAM] Re: [vchkpw] Qmail maillog vchkpw-submission vs vchkpw-smtp

Tom Collins <[email protected]> Tue, 4 Mar 2014 22:57:32 -0800
Newsgroups gmane.mail.vpopmail
Message-ID <[email protected]>
--Apple-Mail=_4DB555A9-9282-44E3-A7E4-C54AD63BE886
Content-Transfer-Encoding: 8bit
Content-Type: text/plain;
	charset=iso-8859-1

The submission entries outside the US could very well be from hacked accounts.

I'm finding a surprising number of compromised accounts (once a week?), including users with good passwords, so I have to assume they're snooped on public wireless, or their computers are compromised by malware of some sort.

The vckpw-smtp entries from outside the US are probably also hacked accounts, since mail received from remote servers doesn't include authentication.  Sorry I wasn't thinking clearly in my previous response -- I forgot these were vchkpw entries and are only related to authentication.  I was thinking about qmail logs.

-Tom


On Mar 4, 2014, at 10:43 PM, LHTek wrote:

> Thanks for the reply.
> 
> NOTE: None of my users will have sent anything from outside the US.
> 
> I've got some log entries for vchkpw-submission (marked as successful in the log) with non-US IP's (Russia, Egypt, Honk Kong, etc). In my analysis I'm marking those entries as hacked accounts.
> 
> From what I read from your response, vchkpw-smtp (marked as successful in the log) entries could be mail sent TO my server FROM another server on port 25. That tells me those are probably safe submissions - even if they are from overseas IPs. Am I thinking correctly?
> 
> 
> 
> 
> From: Tom Collins <[email protected]>
> To: [email protected] 
> Sent: Wednesday, March 5, 2014 12:02 AM
> Subject: Re: [vchkpw] Qmail maillog vchkpw-submission vs vchkpw-smtp
> 
> vchkpw-submission is on port 587, and is typically used for emai clients relaying mail.  It's often set up to require authentication.
> 
> vchkpw-smtp is on port 25, and can be used for email clients to relay mail, or by other servers delivering mail to your server.
> 
> -Tom
> 
> 
> On Mar 4, 2014, at 9:41 PM, LHTek wrote:
> 
>> In the /var/log/maillog file what is the difference between these 2 entries (vchkpw-submission, vchkpw-smtp)?
>> 
>> example:
>> Mar  4 17:27:03 michael vpopmail[14701]: vchkpw-submission: (PLAIN) login success [email protected]:64.185.3.238
>> Mar  4 10:54:42 michael vpopmail[29027]: vchkpw-smtp: (PLAIN) login success [email protected]:64.57.239.114
>> 
>> 
> 
> 
> 
> 



!DSPAM:5316cae034263249811152!

--Apple-Mail=_4DB555A9-9282-44E3-A7E4-C54AD63BE886
Content-Transfer-Encoding: 8bit
Content-Type: text/html;
	charset=iso-8859-1

<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">The submission entries outside the US could very well be from hacked accounts.<div><br></div><div>I'm finding a surprising number of compromised accounts (once a week?), including users with good passwords, so I have to assume they're snooped on public wireless, or their computers are compromised by malware of some sort.</div><div><br></div><div>The vckpw-smtp entries from outside the US are probably also hacked accounts, since mail received from remote servers doesn't include authentication. &nbsp;Sorry I wasn't thinking clearly in my previous response -- I forgot these were vchkpw entries and are only related to authentication. &nbsp;I was thinking about qmail logs.</
 div><div><br><div>
<span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: auto; -khtml-text-decorations-in-effect: none; text-indent: 0px; -apple-text-size-adjust: auto; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px; "><div>-Tom</div><br class="Apple-interchange-newline"></span>
</div>
<br><div><div>On Mar 4, 2014, at 10:43 PM, LHTek wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div><div style="color:#000; background-color:#fff; font-family:Courier New, courier, monaco, monospace, sans-serif;font-size:10pt">Thanks for the reply.<br><br>NOTE: None of my users will have sent anything from outside the US.<span><br><br></span>I've got some log entries for vchkpw-submission (marked as successful in the log) with non-US IP's (Russia, Egypt, Honk Kong, etc).<span> In my analysis I'm marking those entries as hacked accounts.</span><div style="color: rgb(0, 0, 0); font-size: 13.3333px; font-family: Courier New,courier,monaco,monospace,sans-serif; background-color: transparent; font-style: normal;"><br><span></span></div><div style="color: rgb(0, 0, 0)
 ; font-size: 13.3333px; font-family: Courier New,courier,monaco,monospace,sans-serif; background-color: transparent; font-style: normal;"><span>From what I read from your response, </span>vchkpw-smtp (marked as successful in the log) entries could be mail sent TO my server FROM
 another server on port 25. That tells me those are probably safe submissions - even if they are from overseas IPs. Am I thinking correctly?</div><div style="color: rgb(0, 0, 0); font-size: 13.3333px; font-family: Courier New,courier,monaco,monospace,sans-serif; background-color: transparent; font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 13.3333px; font-family: Courier New,courier,monaco,monospace,sans-serif; background-color: transparent; font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 13.3333px; font-family: Courier New,courier,monaco,monospace,sans-serif; background-color: transparent; font-style: normal;"><br></div><div><br><blockquote style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; margin-top: 5px; padding-left:
  5px;">  <div style="font-family: Courier New, courier, monaco, monospace, sans-serif; font-size: 10pt;"> <div style="font-family: times new roman, new york, times,
 serif; font-size: 12pt;"> <div dir="ltr"> <hr size="1">  <font face="Arial" size="2"> <b><span style="font-weight:bold;">From:</span></b> Tom Collins &lt;<a href="mailto:[email protected]">[email protected]</a>&gt;<br> <b><span style="font-weight: bold;">To:</span></b> <a href="mailto:[email protected]">[email protected]</a> <br> <b><span style="font-weight: bold;">Sent:</span></b> Wednesday, March 5, 2014 12:02 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [vchkpw] Qmail maillog vchkpw-submission vs vchkpw-smtp<br> </font> </div> <div class="y_msg_container"><br><div id="yiv8551571901"><div>vchkpw-submission is on port 587, and is typically used for emai clients relaying mail. &nbsp;It's often set up to require authentication.<div><br clear="none"></div><div>vchkpw-smt
 p is on port 25, and can be used for email clients to relay mail, or by other servers delivering mail to your server.</div><div><br clear="none"><div>
<span class="yiv8551571901Apple-style-span" style="border-collapse:separate;border-spacing:0px 0px;color:rgb(0, 0, 0);font-family:Helvetica;font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:auto;text-indent:0px;text-transform:none;orphans:2;white-space:normal;widows:2;word-spacing:0px;"></span><div>-Tom</div><br class="yiv8551571901Apple-interchange-newline" clear="none">
</div>
<br clear="none"><div class="yiv8551571901yqt6697663901" id="yiv8551571901yqt19840"><div><div>On Mar 4, 2014, at 9:41 PM, LHTek wrote:</div><br class="yiv8551571901Apple-interchange-newline" clear="none"><blockquote type="cite"><div><div style="color:#000;background-color:#fff;font-family:Courier New, courier, monaco, monospace, sans-serif;font-size:10pt;"><div class="yiv8551571901msg-body yiv8551571901inner yiv8551571901undoreset" style=""><div id="yiv8551571901"><div><div style="color:#000;background-color:#fff;font-family:Courier New, courier, monaco, monospace, sans-serif;font-size:10pt;"><div>In the /var/log/maillog file what is the difference between these 2 entries (vchkpw-submission, vchkpw-smtp)?</div><div><br clear="none"></div><div style="color:rgb(0, 0, 0);font-size:13.3333px;f
 ont-family:Courier New, courier, monaco, monospace, sans-serif;background-color:transparent;font-style:normal;">example:</div><div style="color:rgb(0, 0,
 0);font-size:13.3333px;font-family:Courier New, courier, monaco, monospace, sans-serif;background-color:transparent;font-style:normal;">Mar&nbsp; 4 17:27:03 michael vpopmail[14701]: vchkpw-submission: (PLAIN) login success
 [email protected]:64.185.3.238<br clear="none"></div><div>Mar&nbsp; 4 10:54:42 michael vpopmail[29027]: vchkpw-smtp: (PLAIN) login success [email protected]:64.57.239.114</div><div><br clear="none"></div><div style="color:rgb(0, 0, 0);font-size:13.3333px;font-family:Courier New, courier, monaco, monospace, sans-serif;background-color:transparent;font-style:normal;"><br clear="none"></div></div></div></div></div></div>


</div>

</blockquote></div></div><br clear="none"></div>


</div></div><br><br></div> </div> </div> </blockquote></div>   </div>


</div>

</blockquote></div><br></div>
!DSPAM:5316cae034263249811152!

</body></html>


--Apple-Mail=_4DB555A9-9282-44E3-A7E4-C54AD63BE886--