0

A client of mine has a linux/cpanel based web server (VPS), which at some point in the past was also the primary mail server for the domain. It is no longer receiving mail (MX records were changed to point to hosted google mail), however I still need to be able to send email from local processes without relying on smart host, therefore exim is still running.

I removed POP3/imap and changed exim config to only listen on localhost interface (127.0.0.1). I checked connections to port 25, 465 and 587 from external hosts - I get 'connection refused' - which is what I want.

Yet, occasionally, in the exim log I see emails that have been received from external hosts for relaying. It's a small number, double-digits per day, but I shouldn't be seeing any at all!

So, the question is what else should I look for on the host? Any other ports I should check or any other apps or config params? I am only on a basic level familiar with cpanel - I've always dealt with things in a terminal window - but either solution is fine.

I have full root access to the box.

EDIT: Here's an example entry from exim_mainlog:

2016-05-15 03:52:25 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1b1qqf-0001Oe-ES
2016-05-15 03:52:27 1b1qqf-0001Oe-ES => *******@worldcorkgc.pt R=dkim_lookuphost T=dkim_remote_smtp H=worldcorkgc.pt [109.71.43.50] X=TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no C="250 OK id=1b1qqh-0019IV-29"
2016-05-15 03:52:27 1b1qqf-0001Oe-ES Completed

I also see the same relaying records in cpanel email delivery report.

1
  • Could you quote the log entries?
    – AnFi
    May 16, 2016 at 13:41

1 Answer 1

0

Those emails are likely coming from MTAs with an ill configured/managed DNS that have TTL problem regrading your client's MX. We may want to work with your client to filter out the legit ones and contact with corresponding parties.

5
  • I think you misunderstood the question. I am trying to close the server off so that it doesn't accept any incoming connections on any of the mail ports - at all - yet I still see some messages getting through.
    – Aleks G
    May 16, 2016 at 13:49
  • Oh yes you are right. Just a wild guess, are these emails from the domains under the same VPS provider?
    – hkdtam
    May 16, 2016 at 14:11
  • actually perhaps an external port scan may reveal more ..
    – hkdtam
    May 16, 2016 at 14:23
  • The connections are not from the same VPS provider. My VPS is in the USA, the connections are from Turkey. I would prefer not to run an external port scan on the server if I could help it.
    – Aleks G
    May 16, 2016 at 14:53
  • This isn't an hostile action especially if you report to your VPS provider in advance due to your troubleshooting purpose. After all probably there were scumbags did it before anyway. On the other hand, you may check the setting at Web Host Manager::Service Configuration::Service Manager::Exim on another port. But then how did those messages come in is still a mystery ..
    – hkdtam
    May 18, 2016 at 9:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .