[SPAM] Re: [vchkpw] [SPAM] Re: [vchkpw] [SPAM] Re: [vchkpw] Qmail maillog vchkpw-submission vs vchkpw-smtp
[email protected] Wed, 05 Mar 2014 13:45:38 +0100
| Newsgroups | gmane.mail.vpopmail |
|---|---|
| Message-ID | <[email protected]> |
--=_3cfa6ab2652553ded1d85fef5dbdc142 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=UTF-8 It doesn't matter how good your password is if you're using plaintext connections :) Since every MUA I've used i nthe last few years supports SSL or TLS I should really get around to deprecating pop3 and imap and only using pop3s and imaps. This is especially imporant since some govts are trying to push through laws forcing ISP's to store all of the data each of their users downloads meaning that your unencrypted data will remain stored for however long is legislated with access by who knows how many people. \Clay On 2014-03-05 07:57, Tom Collins wrote: > The submission entries outside the US could very well be from hacked accounts. > > I'm finding a surprising number of compromised accounts (once a week?), including users with good passwords, so I have to assume they're snooped on public wireless, or their computers are compromised by malware of some sort. > > The vckpw-smtp entries from outside the US are probably also hacked accounts, since mail received from remote servers doesn't include authentication. Sorry I wasn't thinking clearly in my previous response -- I forgot these were vchkpw entries and are only related to authentication. I was thinking about qmail logs. > > -Tom > > On Mar 4, 2014, at 10:43 PM, LHTek wrote: > > Thanks for the reply. > > NOTE: None of my users will have sent anything from outside the US. > > I've got some log entries for vchkpw-submission (marked as successful in the log) with non-US IP's (Russia, Egypt, Honk Kong, etc). In my analysis I'm marking those entries as hacked accounts. > > From what I read from your response, vchkpw-smtp (marked as successful in the log) entries could be mail sent TO my server FROM another server on port 25. That tells me those are probably safe submissions - even if they are from overseas IPs. Am I thinking correctly? > > ------------------------- > FROM: Tom Collins <[email protected]> > TO: [email protected] > SENT: Wednesday, March 5, 2014 12:02 AM > SUBJECT: Re: [vchkpw] Qmail maillog vchkpw-submission vs vchkpw-smtp > > vchkpw-submission is on port 587, and is typically used for emai clients relaying mail. It's often set up to require authentication. > > vchkpw-smtp is on port 25, and can be used for email clients to relay mail, or by other servers delivering mail to your server. > > -Tom > > On Mar 4, 2014, at 9:41 PM, LHTek wrote: > > In the /var/log/maillog file what is the difference between these 2 entries (vchkpw-submission, vchkpw-smtp)? > > example: > Mar 4 17:27:03 michael vpopmail[14701]: vchkpw-submission: (PLAIN) login success [email protected]:64.185.3.238 > Mar 4 10:54:42 michael vpopmail[29027]: vchkpw-smtp: (PLAIN) login success [email protected]:64.57.239.114 !DSPAM:53171ca934269165765629! --=_3cfa6ab2652553ded1d85fef5dbdc142 Content-Transfer-Encoding: 8bit Content-Type: text/html; charset=UTF-8 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"> <html><body style='font-family: Verdana,Geneva,sans-serif'> <p>It doesn't matter how good your password is if you're using plaintext connections :)</p> <p>Since every MUA I've used i nthe last few years supports SSL or TLS I should really get around to deprecating pop3 and imap and only using pop3s and imaps.</p> <p>This is especially imporant since some govts are trying to push through laws forcing ISP's to store all of the data each of their users downloads meaning that your unencrypted data will remain stored for however long is legislated with access by who knows how many people.</p> <p> </p> <p>\\Clay</p> <p> </p> <p>On 2014-03-05 07:57, Tom Collins wrote:</p> <blockquote type="cite" style="padding-left:5px; border-left:#1010ff 2px solid; margin-left:5px"><!-- html ignored --><!-- head ignored --><!-- meta ignored -->The submission entries outside the US could very well be from hacked accounts. <div> </div> <div>I'm finding a surprising number of compromised accounts (once a week?), including users with good passwords, so I have to assume they're snooped on public wireless, or their computers are compromised by malware of some sort.</div> <div> </div> <div>The vckpw-smtp entries from outside the US are probably also hacked accounts, since mail received from remote servers doesn't include authentication. Sorry I wasn't thinking clearly in my previous response -- I forgot these were vchkpw entries and are only related to authentication. I was thinking about qmail logs.</div> <div><br /> <div> <div>-Tom</div> </div> <br /> <div> <div>On Mar 4, 2014, at 10:43 PM, LHTek wrote:</div> <br class="Apple-interchange-newline" /> <blockquote type="cite" style="padding-left:5px; border-left:#1010ff 2px solid; margin-left:5px"> <div> <div style="color: #000; background-color: #fff; font-family: Courier New, courier, monaco, monospace, sans-serif; font-size: 10pt;">Thanks for the reply.<br /><br />NOTE: None of my users will have sent anything from outside the US.<span><br /><br /></span>I've got some log entries for vchkpw-submission (marked as successful in the log) with non-US IP's (Russia, Egypt, Honk Kong, etc).<span> In my analysis I'm marking those entries as hacked accounts.</span> <div style="color: #000000; font-size: 13.3333px; font-family: Courier New,courier,monaco,monospace,sans-serif; background-color: transparent; font-style: normal;"><br /><span></span></div> <div style="color: #000000; font-size: 13.3333px; font-family: Courier New,courier,monaco,monospace,sans-serif; background-color: transparent; font-style: normal;"><span>From what I read from your response, </span>vchkpw-smtp (marked as successful in the log) entries could be mail sent TO my server FROM another server on port 25. That tells me those are probably safe submissions - even if they are from overseas IPs. Am I thinking correctly?</div> <div style="color: #000000; font-size: 13.3333px; font-family: Courier New,courier,monaco,monospace,sans-serif; background-color: transparent; font-style: normal;"> </div> <div style="color: #000000; font-size: 13.3333px; font-family: Courier New,courier,monaco,monospace,sans-serif; background-color: transparent; font-style: normal;"> </div> <div style="color: #000000; font-size: 13.3333px; font-family: Courier New,courier,monaco,monospace,sans-serif; background-color: transparent; font-style: normal;"> </div> <div><br /> <blockquote style="border-left: 2px solid rgb; margin-left: 5px; margin-top: 5px; padding-left: 5px;"> <div style="font-family: Courier New, courier, monaco, monospace, sans-serif; font-size: 10pt;"> <div style="font-size: 12pt;"> <div dir="ltr"><hr size="1" /><span style="font-family: Arial; font-size: small;"> <strong><span style="font-weight: bold;">From:</span></strong> Tom Collins <<a href="mailto:[email protected]">[email protected]</a>><br /><strong><span style="font-weight: bold;">To:</span></strong> <a href="mailto:[email protected]">[email protected]</a> <br /><strong><span style="font-weight: bold;">Sent:</span></strong> Wednesday, March 5, 2014 12:02 AM<br /><strong><span style="font-weight: bold;">Subject:</span></strong> Re: [vchkpw] Qmail maillog vchkpw-submission vs vchkpw-smtp<br /></span></div> <div class="y_msg_container"><br /> <div id="yiv8551571901"> <div>vchkpw-submission is on port 587, and is typically used for emai clients relaying mail. It's often set up to require authentication. <div> </div> <div>vchkpw-smtp is on port 25, and can be used for email clients to relay mail, or by other servers delivering mail to your server.</div> <div><br clear="none" /> <div><span class="yiv8551571901Apple-style-span" style="border-collapse: separate; border-spacing: 0px 0px; color: #000000; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: auto; text-indent: 0px; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px;"></span> <div>-Tom</div> </div> <br clear="none" /> <div id="yiv8551571901yqt19840" class="yiv8551571901yqt6697663901"> <div> <div>On Mar 4, 2014, at 9:41 PM, LHTek wrote:</div> <br class="yiv8551571901Apple-interchange-newline" clear="none" /> <blockquote type="cite" style="padding-left:5px; border-left:#1010ff 2px solid; margin-left:5px"> <div> <div style="color: #000; background-color: #fff; font-family: Courier New, courier, monaco, monospace, sans-serif; font-size: 10pt;"> <div class="yiv8551571901msg-body yiv8551571901inner yiv8551571901undoreset"> <div id="yiv8551571901"> <div> <div style="color: #000; background-color: #fff; font-family: Courier New, courier, monaco, monospace, sans-serif; font-size: 10pt;"> <div>In the /var/log/maillog file what is the difference between these 2 entries (vchkpw-submission, vchkpw-smtp)?</div> <div> </div> <div style="color: #000000; font-size: 13.3333px; font-family: Courier New, courier, monaco, monospace, sans-serif; background-color: transparent; font-style: normal;">example:</div> <div style="font-size: 13.3333px; font-family: Courier New, courier, monaco, monospace, sans-serif; background-color: transparent; font-style: normal;">Mar 4 17:27:03 michael vpopmail[14701]: vchkpw-submission: (PLAIN) login success [email protected]:64.185.3.238</div> <div>Mar 4 10:54:42 michael vpopmail[29027]: vchkpw-smtp: (PLAIN) login success [email protected]:64.57.239.114</div> <div> </div> <div style="color: #000000; font-size: 13.3333px; font-family: Courier New, courier, monaco, monospace, sans-serif; background-color: transparent; font-style: normal;"> </div> </div> </div> </div> </div> </div> </div> </blockquote> </div> </div> </div> </div> </div> <br /><br /></div> </div> </div> </blockquote> </div> </div> </div> </blockquote> </div> </div> </blockquote> <p> </p> <div> </div> !DSPAM:53171ca934269165765629! </body></html> --=_3cfa6ab2652553ded1d85fef5dbdc142--