5 Replies Latest reply on May 15, 2006 2:07 PM by acoliver

About SPAM Mail

empty11 May 15, 2006 9:32 AM

Dear

After installing Jboss Mail Server, there is sending the very many spam mail through my JBoss Mail Server.
I can see the log in the log file as below.
The log file size is over 17Mbytes for 12 hours.

Please help me how to solve the spam problem...

----------------------------------------
2006-05-15 22:20:22,031 DEBUG [org.jboss.mail.AbstractProtocol] ReadCommand outputting RCPT TO: <worrying@pchome.com.tw>

2006-05-15 22:20:22,031 DEBUG [org.jboss.mail.smtp.SMTPProtocolInstance] HandleRequest called with request = false
2006-05-15 22:20:22,031 DEBUG [org.jboss.mail.smtp.SMTPProtocolInstance] HandleRequest called with command = RCPT
2006-05-15 22:20:22,031 DEBUG [org.jboss.mail.smtp.handlers.CmdRCPT] RCPT command handler called
2006-05-15 22:20:22,031 DEBUG [org.jboss.mail.smtp.SMTPProtocolInstance] HANDLE AUTH
2006-05-15 22:20:22,156 DEBUG [org.jboss.mail.AbstractProtocol] ReadCommand outputting RCPT TO: <wp@ms33.hinet.net>

2006-05-15 22:20:22,156 DEBUG [org.jboss.mail.smtp.SMTPProtocolInstance] HandleRequest called with request = false
2006-05-15 22:20:22,156 DEBUG [org.jboss.mail.smtp.SMTPProtocolInstance] HandleRequest called with command = RCPT
2006-05-15 22:20:22,156 DEBUG [org.jboss.mail.smtp.handlers.CmdRCPT] RCPT command handler called
2006-05-15 22:20:22,156 DEBUG [org.jboss.mail.smtp.SMTPProtocolInstance] HANDLE AUTH
2006-05-15 22:20:22,390 DEBUG [org.jboss.mail.AbstractProtocol] ReadCommand outputting RCPT TO: <ectus@yahoo.com.tw>

2006-05-15 22:20:22,390 DEBUG [org.jboss.mail.smtp.SMTPProtocolInstance] HandleRequest called with request = false
2006-05-15 22:20:22,390 DEBUG [org.jboss.mail.smtp.SMTPProtocolInstance] HandleRequest called with command = RCPT
2006-05-15 22:20:22,390 DEBUG [org.jboss.mail.smtp.handlers.CmdRCPT] RCPT command handler called
2006-05-15 22:20:22,390 DEBUG [org.jboss.mail.smtp.SMTPProtocolInstance] HANDLE AUTH
2006-05-15 22:20:22,500 DEBUG [org.jboss.mail.AbstractProtocol] ReadCommand outputting RCPT TO: <worshiper@pchome.com.tw>

2006-05-15 22:20:22,500 DEBUG [org.jboss.mail.smtp.SMTPProtocolInstance] HandleRequest called with request = false
2006-05-15 22:20:22,500 DEBUG [org.jboss.mail.smtp.SMTPProtocolInstance] HandleRequest called with command = RCPT
2006-05-15 22:20:22,500 DEBUG [org.jboss.mail.smtp.handlers.CmdRCPT] RCPT command handler called
2006-05-15 22:20:22,500 DEBUG [org.jboss.mail.smtp.SMTPProtocolInstance] HANDLE AUTH
2006-05-15 22:20:22,531 DEBUG [org.jboss.mail.AbstractProtocol] ReadCommand outputting RSET

2006-05-15 22:20:22,531 DEBUG [org.jboss.mail.smtp.SMTPProtocolInstance] HandleRequest called with request = false
2006-05-15 22:20:22,531 DEBUG [org.jboss.mail.smtp.SMTPProtocolInstance] HandleRequest called with command = RSET
2006-05-15 22:20:22,531 DEBUG [org.jboss.mail.smtp.handlers.CmdRSET] RSET command handler called
2006-05-15 22:20:22,656 DEBUG [org.jboss.mail.AbstractProtocol] ReadCommand outputting RCPT TO: <wp@ms81.hinet.net>

2006-05-15 22:20:22,656 DEBUG [org.jboss.mail.smtp.SMTPProtocolInstance] HandleRequest called with request = false
2006-05-15 22:20:22,656 DEBUG [org.jboss.mail.smtp.SMTPProtocolInstance] HandleRequest called with command = RCPT
2006-05-15 22:20:22,656 DEBUG [org.jboss.mail.smtp.handlers.CmdRCPT] RCPT command handler called
2006-05-15 22:20:22,656 DEBUG [org.jboss.mail.smtp.SMTPProtocolInstance] HANDLE AUTH
2006-05-15 22:20:22,937 DEBUG [org.jboss.mail.AbstractProtocol] ReadCommand outputting RCPT TO: <rials@ms55.hinet.net>

2006-05-15 22:20:22,937 DEBUG [org.jboss.mail.smtp.SMTPProtocolInstance] HandleRequest called with request = false
2006-05-15 22:20:22,937 DEBUG [org.jboss.mail.smtp.SMTPProtocolInstance] HandleRequest called with command = RCPT
2006-05-15 22:20:22,937 DEBUG [org.jboss.mail.smtp.handlers.CmdRCPT] RCPT command handler called
2006-05-15 22:20:22,937 DEBUG [org.jboss.mail.smtp.SMTPProtocolInstance] HANDLE AUTH
2006-05-15 22:20:23,031 DEBUG [org.jboss.mail.AbstractProtocol] ReadCommand outputting RCPT TO: <worshipful@pcmail.com.tw>

2006-05-15 22:20:23,031 DEBUG [org.jboss.mail.smtp.SMTPProtocolInstance] HandleRequest called with request = false
2006-05-15 22:20:23,031 DEBUG [org.jboss.mail.smtp.SMTPProtocolInstance] HandleRequest called with command = RCPT
2006-05-15 22:20:23,031 DEBUG [org.jboss.mail.smtp.handlers.CmdRCPT] RCPT command handler called
2006-05-15 22:20:23,031 DEBUG [org.jboss.mail.smtp.SMTPProtocolInstance] HANDLE AUTH
2006-05-15 22:20:23,140 DEBUG [org.jboss.mail.AbstractProtocol] ReadCommand outputting RCPT TO: <wp@topcoil.com.cn>

2006-05-15 22:20:23,140 DEBUG [org.jboss.mail.smtp.SMTPProtocolInstance] HandleRequest called with request = false
2006-05-15 22:20:23,140 DEBUG [org.jboss.mail.smtp.SMTPProtocolInstance] HandleRequest called with command = RCPT
2006-05-15 22:20:23,140 DEBUG [org.jboss.mail.smtp.handlers.CmdRCPT] RCPT command handler called
2006-05-15 22:20:23,140 DEBUG [org.jboss.mail.smtp.SMTPProtocolInstance] HANDLE AUTH
2006-05-15 22:20:23,250 DEBUG [org.jboss.mail.AbstractProtocol] ReadCommand outputting RCPT TO: <ectva@yahoo.com.tw>

2006-05-15 22:20:23,250 DEBUG [org.jboss.mail.smtp.SMTPProtocolInstance] HandleRequest called with request = false
2006-05-15 22:20:23,250 DEBUG [org.jboss.mail.smtp.SMTPProtocolInstance] HandleRequest called with command = RCPT
2006-05-15 22:20:23,250 DEBUG [org.jboss.mail.smtp.handlers.CmdRCPT] RCPT command handler called
2006-05-15 22:20:23,250 DEBUG [org.jboss.mail.smtp.SMTPProtocolInstance] HANDLE AUTH
2006-05-15 22:20:23,500 DEBUG [org.jboss.mail.AbstractProtocol] ReadCommand outputting RCPT TO: <worships@pcmail.com.tw>

2006-05-15 22:20:23,500 DEBUG [org.jboss.mail.smtp.SMTPProtocolInstance] HandleRequest called with request = false
2006-05-15 22:20:23,500 DEBUG [org.jboss.mail.smtp.SMTPProtocolInstance] HandleRequest called with command = RCPT
-----------------------------------

1. Re: About SPAM Mail

acoliver May 15, 2006 9:48 AM (in response to empty11)

This is to say they are sending spam THROUGH your mail server or TO your mail server? it looks like you just need to change your password.
Actions
2. Re: About SPAM Mail

empty11 May 15, 2006 10:02 AM (in response to empty11)

After change the password, there is still spam log message.
How do I do?

# Ritchie Koh
Actions
3. Re: About SPAM Mail

acoliver May 15, 2006 10:34 AM (in response to empty11)

Is it delivering actual SPAM to OTHER mail servers or only to your local accounts? I'm unclear on this point.
Actions
4. Re: About SPAM Mail

empty11 May 15, 2006 10:38 AM (in response to empty11)

It deliver trought the mail server to other email address.
Actions
5. Re: About SPAM Mail

acoliver May 15, 2006 2:07 PM (in response to empty11)

This is what happens for me on both 1.0M4 and M5-pre1:

220 set.superlinksoftware.com SMTP Server (JBMAIL SMTP Server version 0.5) ready May 15, 2006 1:59:00 PM EDT
MAIL FROM: <noone@nowhere.com>
250 Sender <noone@nowhere.com> OK
RCPT TO: <acoliver@jboss.org>
550 Not Authorized

So somehow someone must be using your correct password and authenticating. Perhaps you've got a compromised mail client. If you're able to upgrade to 1.0M5-pre1 you'll be able to capture the IP address in the server/default/log/server.log and if it is the same as your client -- then you know the client has been compromised.

-Andy
Actions

Go to original post