Re: [SPAM] Re: [vchkpw] [SPAM] Re: [vchkpw] [SPAM] Re: [vchkpw] Qmail maillog vchkpw-submission vs vchkpw-smtp
LHTek <[email protected]> Wed, 5 Mar 2014 07:34:07 -0800 (PST)
| Newsgroups | gmane.mail.vpopmail |
|---|---|
| Message-ID | <[email protected]> |
---723168630-1592813090-1394033647=:76997 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit I am using PLAIN text passwords I'm afraid. I will be changing that now though. I very tired of these password hacks. Since this will be a new process for me I have questions: In changing the server to require encrypted passwords, will I need to contact all my clients and have them change the way they connect? Or will their email clients just automate the change? >________________________________ > From: "[email protected]" <[email protected]> >To: [email protected] >Sent: Wednesday, March 5, 2014 6:45 AM >Subject: [vchkpw] [SPAM] Re: [vchkpw] [SPAM] Re: [vchkpw] [SPAM] Re: [vchkpw] Qmail maillog vchkpw-submission vs vchkpw-smtp > > > >It doesn't matter how good your password is if you're using plaintext connections :) >Since every MUA I've used i nthe last few years supports SSL or TLS I should really get around to deprecating pop3 and imap and only using pop3s and imaps. >This is especially imporant since some govts are trying to push through laws forcing ISP's to store all of the data each of their users downloads meaning that your unencrypted data will remain stored for however long is legislated with access by who knows how many people. > >\\Clay > >On 2014-03-05 07:57, Tom Collins wrote: >The submission entries outside the US could very well be from hacked accounts. >> >>I'm finding a surprising number of compromised accounts (once a week?), including users with good passwords, so I have to assume they're snooped on public wireless, or their computers are compromised by malware of some sort. >> >>The vckpw-smtp entries from outside the US are probably also hacked accounts, since mail received from remote servers doesn't include authentication. Sorry I wasn't thinking clearly in my previous response -- I forgot these were vchkpw entries and are only related to authentication. I was thinking about qmail logs. >> >> >>-Tom >> >>On Mar 4, 2014, at 10:43 PM, LHTek wrote: >> >>Thanks for the reply. >>> >>>NOTE: None of my users will have sent anything from outside the US. >>> >>>I've got some log entries for vchkpw-submission (marked as successful in the log) with non-US IP's (Russia, Egypt, Honk Kong, etc).In my analysis I'm marking those entries as hacked accounts. >>> >>> >>>From what I read from your response, vchkpw-smtp (marked as successful in the log) entries could be mail sent TO my server FROM another server on port 25. That tells me those are probably safe submissions - even if they are from overseas IPs. Am I thinking correctly? >>> >>> >>> >>> >>> >>> >>>>________________________________ >>>>From: Tom Collins <[email protected]> >>>>To: [email protected] >>>>Sent: Wednesday, March 5, 2014 12:02 AM >>>>Subject: Re: [vchkpw] Qmail maillog vchkpw-submission vs vchkpw-smtp >>>> >>>> >>>> >>>>vchkpw-submission is on port 587, and is typically used for emai clients relaying mail. It's often set up to require authentication. >>>> >>>>vchkpw-smtp is on port 25, and can be used for email clients to relay mail, or by other servers delivering mail to your server. >>>> >>>> >>>> >>>>-Tom >>>> >>>>On Mar 4, 2014, at 9:41 PM, LHTek wrote: >>>> >>>>In the /var/log/maillog file what is the difference between these 2 entries (vchkpw-submission, vchkpw-smtp)? >>>>> >>>>>example: >>>>>Mar 4 17:27:03 michael vpopmail[14701]: vchkpw-submission: (PLAIN) login success [email protected]:64.185.3.238 >>>>>Mar 4 10:54:42 michael vpopmail[29027]: vchkpw-smtp: (PLAIN) login success [email protected]:64.57.239.114 >>>>> >>>>> >>>> >>>> > > > > !DSPAM:531743f234265098613353! ---723168630-1592813090-1394033647=:76997 Content-Type: text/html; charset=iso-8859-1 Content-Transfer-Encoding: 8bit <html><body><div style="color:#000; background-color:#fff; font-family:Courier New, courier, monaco, monospace, sans-serif;font-size:10pt">I am using PLAIN text passwords I'm afraid. I will be changing that now though. I very tired of these password hacks.<br><br>Since this will be a new process for me I have questions: In changing the server to require encrypted passwords, will I need to contact all my clients and have them change the way they connect? Or will their email clients just automate the change?<br><br><br><div><span><br></span></div><div><br><blockquote style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; margin-top: 5px; padding-left: 5px;"> <div style="font-family: Courier New, courier, monaco, monospace, sans-serif; font-size: 10pt;"> <div style="font-family: t imes new roman, new york, times, serif; font-size: 12pt;"> <div dir="ltr"> <hr size="1"> <font face="Arial" size="2"> <b><span style="font-weight:bold;">From:</span></b> "[email protected]" <[email protected]><br> <b><span style="font-weight: bold;">To:</span></b> [email protected] <br> <b><span style="font-weight: bold;">Sent:</span></b> Wednesday, March 5, 2014 6:45 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> [vchkpw] [SPAM] Re: [vchkpw] [SPAM] Re: [vchkpw] [SPAM] Re: [vchkpw] Qmail maillog vchkpw-submission vs vchkpw-smtp<br> </font> </div> <div class="y_msg_container"><br> <div id="yiv1164411370"> <div> <div>It doesn't matter how good your password is if you're using plaintext connections :)</div> <div>Since every MUA I've used i nthe last few years supports SSL or TLS I should really get around to deprecating pop3 and imap and only using pop3s and imaps.</div> <div>This is especially imporant since some govts are trying to push through laws forcing ISP's to store all of the data each of their users downloads meaning that your unencrypted data will remain stored for however long is legislated with access by who knows how many people.</div> <div> </div> <div>\\Clay</div> <div> </div> <div>On 2014-03-05 07:57, Tom Collins wrote:</div> <blockquote type="cite" style="padding-left:5px;border-left:#1010ff 2px solid;margin-left:5px;">The submission entries outside the US could very well be from hacked accounts. <div> </div> <div>I'm finding a surprising number of compromised accounts (once a week?), including users with good passwords, so I have to assume they're snooped on public wireless, or their computers are compromised by malware of some sort.</div> <div> </div> <div>The vckpw-smtp entries from outside the US are probably also hacked accounts, since mail received from remote servers doesn't include authentication. Sorry I wasn't thinking clearly in my previous response -- I forgot these were vchkpw entries and are only related to authentication. I was thinking about qmail logs.</div> <div><br> <div> <div>-Tom</div> </div> <br> <div> <div>On Mar 4, 2014, at 10:43 PM, LHTek wrote:</div> <br class="yiv1164411370Apple-interchange-newline"> <blockquote type="cite" style="padding-left:5px;border-left:#1010ff 2px solid;margin-left:5px;"> <div> <div style="color:#000;background-color:#fff;font-family:Courier New, courier, monaco, monospace, sans-serif;font-size:10pt;">Thanks for the reply.<br><br>NOTE: None of my users will have sent anything from outside the US.<span><br><br></span>I've got some log entries for vchkpw-submission (marked as successful in the log) with non-US IP's (Russia, Egypt, Honk Kong, etc).<span> In my analysis I'm marking those entries as hacked accounts.</span> <div style="color:#000000;font-size:13.3333px;font-family:Courier New, courier, monaco, monospace, sans-serif;background-color:transparent;font-style:normal;"><br><span></span></div> <div style="color:#000000;font-size:13.3333px;font-family:Courier New, courier, monaco, monospace, sans-serif;background-color:transparent;font-style:normal;"><span>From what I read from your response, </span>vchkpw-smtp (marked as successful in the log) entries could be mail sent TO my server FROM another server on port 25. That tells me those are probably safe submissions - even if they are from overseas IPs. Am I thinking correctly?</div> <div style="color:#000000;font-size:13.3333px;font-family:Courier New, courier, monaco, monospace, sans-serif;background-color:transparent;font-style:normal;"> </div> <div style="color:#000000;font-size:13.3333px;font-family:Courier New, courier, monaco, monospace, sans-serif;background-color:transparent;font-style:normal;"> </div> <div style="color:#000000;font-size:13.3333px;font-family:Courier New, courier, monaco, monospace, sans-serif;background-color:transparent;font-style:normal;"> </div> <div><br> <blockquote style="border-left:2px solid rgb;margin-left:5px;margin-top:5px;padding-left:5px;"> <div style="font-family:Courier New, courier, monaco, monospace, sans-serif;font-size:10pt;"> <div style="font-size:12pt;"> <div dir="ltr"><hr size="1"><span style="font-family:Arial;font-size:small;"> <b><span style="font-weight:bold;">From:</span></b> Tom Collins <<a rel="nofollow" ymailto="mailto:[email protected]" target="_blank" href="mailto:[email protected]">[email protected]</a>><br><b><span style="font-weight:bold;">To:</span></b> <a rel="nofollow" ymailto="mailto:[email protected]" target="_blank" href="mailto:[email protected]">[email protected]</a> <br><b><span style="font-weight:bold;">Sent:</span></b> Wednesday, March 5, 2014 12:02 AM<br><b><span style="font-weight:bold;">Subject:</span></b> Re: [vchkpw] Qmail maillog vchkpw-submission vs vchkpw-smtp<br></span></div> <div class="yiv1164411370y_msg_container"><br> <div id="yiv1164411370"> <div>vchkpw-submission is on port 587, and is typically used for emai clients relaying mail. It's often set up to require authentication. <div> </div> <div>vchkpw-smtp is on port 25, and can be used for email clients to relay mail, or by other servers delivering mail to your server.</div> <div><br clear="none"> <div><span class="yiv1164411370Apple-style-span" style="border-collapse:separate;border-spacing:0px 0px;color:#000000;font-family:Helvetica;font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:auto;text-indent:0px;text-transform:none;orphans:2;white-space:normal;widows:2;word-spacing:0px;"></span> <div>-Tom</div> </div> <br clear="none"> <div id="yiv1164411370yqt19840" class="yiv1164411370yqt6697663901"> <div> <div>On Mar 4, 2014, at 9:41 PM, LHTek wrote:</div> <br class="yiv1164411370Apple-interchange-newline" clear="none"> <blockquote type="cite" style="padding-left:5px;border-left:#1010ff 2px solid;margin-left:5px;"> <div> <div style="color:#000;background-color:#fff;font-family:Courier New, courier, monaco, monospace, sans-serif;font-size:10pt;"> <div class="yiv1164411370msg-body yiv1164411370inner yiv1164411370undoreset"> <div id="yiv1164411370"> <div> <div style="color:#000;background-color:#fff;font-family:Courier New, courier, monaco, monospace, sans-serif;font-size:10pt;"> <div>In the /var/log/maillog file what is the difference between these 2 entries (vchkpw-submission, vchkpw-smtp)?</div> <div> </div> <div style="color:#000000;font-size:13.3333px;font-family:Courier New, courier, monaco, monospace, sans-serif;background-color:transparent;font-style:normal;">example:</div> <div style="font-size:13.3333px;font-family:Courier New, courier, monaco, monospace, sans-serif;background-color:transparent;font-style:normal;">Mar 4 17:27:03 michael vpopmail[14701]: vchkpw-submission: (PLAIN) login success [email protected]:64.185.3.238</div> <div>Mar 4 10:54:42 michael vpopmail[29027]: vchkpw-smtp: (PLAIN) login success [email protected]:64.57.239.114</div> <div> </div> <div style="color:#000000;font-size:13.3333px;font-family:Courier New, courier, monaco, monospace, sans-serif;background-color:transparent;font-style:normal;"> </div> </div> </div> </div> </div> </div> </div> </blockquote> </div> </div> </div> </div> </div> <br><br></div> </div> </div> </blockquote> </div> </div> </div> </blockquote> </div> </div> </blockquote> <div> </div> <div> </div> </div> </div><br><br></div> </div> </div> </blockquote></div> </div> !DSPAM:531743f234265098613353! </body></html> ---723168630-1592813090-1394033647=:76997--