Exchange server

[wxmsimon]

Our ip got email blacklisted for sending spam overnight. I think i have isolated the computers on our network that were causing the problem and got some of the blacklisting removed including Barracuda which was causing most of the problems.

However how can i check outgoing email logs to see if we are still advertising Viagra for other people other wise we will be back on shortly.

We run SBS 2003 and send emails thru exchange using SMTP with a Rdns.

[steveadam23]

Hey,

First of all I'm going to assume you are running Exchange 2003 Standard Edition (1 mailstore).

There are 2 ways to interpret your question - do you want to simply analyse the logs, or do you want to actually view the content of each message? To do that, you need to get a 3rd party piece of software - however, to analyse the logs, you need to -

- Enable Message Tracking & Logging.
Start the Exchange System Manager and navigate to the Server object on which you want to activate Message Tracking. Right click the server object and select Properties. On the General tab, select "Enable message tracking"
In Enterprise version of Exchange you can also select Subject tracking here, but not sure if you can in Standard version. This is handy as will allow you to view the subject of every message in the Exchange Message Tracking Centre. Beware though, this does cause some processing overhead.
Specify the number of days after old logfiles will be deleted and give a path to the logfile - default directory is cprogram files\ExchSrvr\Servername.LOG
- To open the Messaging Tracking Centre
Start Exchange System Manager, in the console tree, expand Tools, and then click Message Tracking Centre
Once open, in the Server box, type the name of the server that is running exchange and hit find now. This will show you all messages that have passed through the server. Of course you can add recipients etc to filter a bit.
The log file is also readable in something like wordpad.



Hope this helps a bit


Steve.

[wxmsimon]

Steve

Cheers, that did help, from the log i can see that we are still sending out a ton of emails from various email accounts in the global contacts list many of them which are dormant some not.

It does not help me isolate which computer or whether it is the server sending them, do i need to put a port 25 sniffer on to find the ip of the computer sending?

What a bloody nightmare

[steveadam23]

Yea, I would use a combination of sniffers and port scanners to detect spam bots.

I've used a few tools before, Nmap is probably the best port scanning tool. You can get it from http://nmap.org/download.html

To scan for port 25 run the following command -
#nmap -sS x.x.x.x/24 -p 25 (where x.x.x.x/24 is your network)

A quick google search will show a number of port sniffers. Not sure on which to use though.

You should also be able to allow only authorised servers (or anti spam solution like Baracuda) to send SMTP traffic outside your network.

Finally, the following Technet article might help with a few more things you can try....

http://support.microsoft.com/kb/821746

Good luck!!

Steve.

[AJ]

Are you allowing relaying from your local subnet or was your publically facing IP relaying mail ?

Why would you allow local ips to relay, I'm assuming that you have outlook clients talking to the exchange server via mapi ?

What's the mail flow here ? Exchange -> Internet or do you have an ISA server or some appliance in the way

There are plenty of utils you can run to test this.

If you want you can pm me your domain name and I'll check the MX records then test if I can relay from your server

[AJ]

Seems solid now though, at least from the external IP. Can't relay via it at all.

[wxmsimon]

Cheers AJ

Made some tweaks to the edge firewall for outgoing traffic