spam attack - passwords discovered

[Luisgon]

Hi all,

I'm guetting a big problem on my server.

From 1 week until now I got 4 spam attacks. The attacker is the same, because the emails sent are iqual.

The tecnique is also the same, they use an email account (compromissed password) and send emails through smtp server.

When I detect the attack, i do:
1. identify the compromised account
2. Change password from the compromised account
3. Stop qmail
4. Clear queue with qmail-remove
5. Start qmail

The problem is that they already used 4 diferent domains since the first attack.
So, here is my problem, how do they discover the passwords?! How can I solve this problem? I have hundreds of emails accounts and can't change it all.

CentOS release 5.10 (Final)
Plesk 11.0.9

Thanks for the help

 

[PGareth]

Hi,

The issue could be just a simple as a weak passwords. I don't know if this will work on Qmail but it works on with Postfix. This command will display all passwords that have been set via plesk. If you run the following command as the root user.

/usr/local/psa/admin/sbin/mail_auth_view | egrep -v " DE " | egrep -v "   E " | awk '{print $2 "\t\t" $5}' | column -t | sort -k2

I recently had a compromised mailbox what I kinda done the steps that you had said above but in my cause the password wasn't weak. I would said in my cause the user has some sort of virus on their computer which the virus got if from Microsoft Outlook.

I am not sure how you would really solve this cause my linux / plesk skills is ok.

I hope this helps towards getting it solved for you.