We manage a
server that is hosted on Amazon EC2, which has web applications that need to be able to send outgoing email. Recently we received a notice from Amazon about possible email abuse on that
server, so i've been looking into it.
It's Windows
Server Datacenter (2003, i guess), and uses SMTP Virtual
Server (you know, the one that requires IIS 6 for admin). The settings on the Access tab are as follows:
- Authentication: Anonymous
- Connection: Only from 3 ip addresses (127.0.0.1 and 2 others that refer to that server)
- Relay: Only from 3 ip addresses (127.0.0.1 and 2 others that refer to that server)
In the SMTP logs there are many entries like the following:
2012-02-08 23:43:56 64.76.125.151 OutboundConnectionCommand SMTPSVC1 FROM: 0 0 4 0 26364 SMTP - - - -
2012-02-08 23:43:56 64.76.125.151 OutboundConnectionResponse SMTPSVC1 250+ok 0 0 6 0 26536 SMTP - - - -
2012-02-08 23:43:56 64.76.125.151 OutboundConnectionCommand SMTPSVC1 TO: 0 0 4 0 26536 SMTP - - - -
2012-02-08 23:43:56 64.76.125.151 OutboundConnectionResponse SMTPSVC1 250+ok 0 0 6 0 26707 SMTP - - - -
(
[email protected] is sending quite a lot of emails :-/)
Can anyone confirm if the SMTP
server settings seem correct?
I'm also wondering if a web application on the machine could be exposing a contact form or something that would allow this sort of abuse, looking into that (and how to look into that) further.
