TetraWiki - User contributions [en]

Over Quota List In Zimbra

2014-12-02T18:07:37Z

Ravi: Created page with "category:Heromotocorp Biz category:Tetra Clients == '''Command to find all Over Quota Users in zimbra - for HEROMOTOCORP.BIZ''' == postqueue -p | grep -A1 "Over qu..."

[[category:Heromotocorp Biz]]
[[category:Tetra Clients]]

== '''Command to find all Over Quota Users in zimbra - for HEROMOTOCORP.BIZ''' ==

postqueue -p | grep -A1 "Over quota" | grep @ | sort | uniq

Spam Issue on Triburg and its troubleshoot of which account got compromised in ZImbra

2014-12-02T18:07:04Z

Ravi: /* Another Method For Finding the Authenticated User For Spamming */

[[category:Triburg]]

==ISSUE==

One of the account got compromised and Spam mails were sent using that account credentials .

== Finding Methodology ==

# check the mailq ( as zimbra user ) if traces of those mails are available
# Check /var/log/zimbra.log and identify the IP
# Check /opt/zimbra/log/audit.log for the authentication information against that IP and at that time

== Finding ==

Check the mailq , but only the bounce traces of mails were available , which did not reveal the sender information , but showed that Spamming has been done via this server

Next , Checked the zimbra.log found traces of the spam mail ID.

Feb 6 04:15:49 mail postfix/qmgr[17520]: AB0B2B4B8096: from=<041700@unmsm.edu.pe>, size=1293, nrcpt=50 (queue active)
Feb 6 04:15:49 mail postfix/qmgr[17520]: 2CF51190049: from=<041700@unmsm.edu.pe>, size=1292, nrcpt=50 (queue active)
Feb 6 04:15:50 mail postfix/qmgr[17520]: 29F4F190048: from=<041700@unmsm.edu.pe>, size=1292, nrcpt=50 (queue active)
Feb 6 04:15:50 mail postfix/qmgr[17520]: 5932E190042: from=<041700@unmsm.edu.pe>, size=1292, nrcpt=50 (queue active)
Feb 6 04:15:50 mail postfix/qmgr[17520]: 62B5D1901C1: from=<041700@unmsm.edu.pe>, size=1292, nrcpt=50 (queue active)

The From ID 041700@unmsm.edu.pe is the spammer. We had to check for its traces the previous logs /var/log/zimbra.log.1 , and discovered the IP address

Feb 6 00:59:43 mail postfix/qmgr[17520]: 16DBEB4B801C: from=<041700@unmsm.edu.pe>, size=893, nrcpt=5 (queue active)
Feb 6 00:59:43 mail amavis[3538]: (03538-09) ESMTP::10024 /opt/zimbra/data/amavisd/tmp/amavis-20130206T004632-03538: <041700@unmsm.edu.pe> -> <chizobamjames@gmail.com>,<chizoba.j@rediff.com>,<chizoba.j@rediffmail.com>,<don_chizzy2000@yahoo.com>,<don_chizzy@ymail.com> SIZE=893 Received: from mail.triburg.co.in ([127.0.0.1]) by localhost (mail.triburg.co.in [127.0.0.1]) (amavisd-new, port 10024) with ESMTP; Wed, 6 Feb 2013 00:59:43 +0530 (IST)
Feb 6 00:59:43 mail amavis[3538]: (03538-09) Checking: uv8HJES+YMct '''[101.63.8.198]''' <041700@unmsm.edu.pe> -> <chizobamjames@gmail.com>,<chizoba.j@rediff.com>, <chizoba.j@rediffmail.com>,<don_chizzy2000@yahoo.com>,<don_chizzy@ymail.com>
Feb 6 00:59:43 mail amavis[3538]: (03538-09) Open relay? Nonlocal recips but not originating: chizobamjames@gmail.com, chizoba.j@rediff.com, chizoba.j@rediffmail.com , don_chizzy2000@yahoo.com , don_chizzy@ymail.com

And then the authentication information was discovered from /opt/zimbra/log/audit.log

2013-02-06 00:50:33,034 INFO [btpool0-474://localhost/service/soap/AuthRequest] '''[name=imran.khan@triburg.co.in;ip=101.63.8.198''';ua=zclient/6.0.14_GA_2928;] security - cmd=Auth; account=imran.khan@triburg.co.in; protocol=soap;

The Password was of the compromised account was immediately changed .
--------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------

==Another Method For Finding the Authenticated User For Spamming==

grep sasl_user /var/log/zimbra.log | sed 's/.*sasl_username=//g' | sort | uniq -c | sort -nr | tail -n 1000 | less

How it works:-

Step 1.
grep sasl_user /var/log/zimbra.log
will print all the lines containing "sasl_user" in /var/log/zimbra.log

eg,
# Nov 25 11:18:40 mail postfix/smtpd[30849]:C16F52C8400A:client=unknown[106.67.154.16],sasl_method=PLAIN,sasl_username=taranangad.gwalior@heromotocorp.biz

Step 2.
grep sasl_user /var/log/zimbra.log | sed 's/.*sasl_username=//g'
Output is then passed through pipe symbol to the right where everything before and including "sasl_username=" in the previous output is replaced to null. So the Output is only email-ID.

eg,
# taranangad.gwalior@heromotocorp.biz

Step 3.
grep sasl_user /var/log/zimbra.log | sed 's/.*sasl_username=//g' | sort
It will sort all the email-IDs in the previous step.

eg,
# tanushka.Gwalior@herofincorp.biz
# tanushka.Gwalior@herofincorp.biz
# tanushka@heromotocorp.biz
# taranangad.gwalior@heromotocorp.biz
# taranangad.gwalior@heromotocorp.biz
# twincity.khanna@herofincorp.biz
# udaya.hospet@heromotocorp.biz
# union.JAMSHEDPUR@herofincorp.biz
# union.JAMSHEDPUR@herofincorp.biz
# unique.Batala@herofincorp.biz

Step 4.
grep sasl_user /var/log/zimbra.log | sed 's/.*sasl_username=//g' | sort | uniq -c
It will uniquely count each email-ID in the previous step and will print with a number it was occured.

eg,
# 3 navkar.Dhule@herofincorp.biz
# 7 navkar.dhule@heromotocorp.biz
# 3 nimar.khargone
# 5 northern.akbarpur@herofincorp.biz
# 2 northern.kanpur
# 9 northern.kanpur@herofincorp.biz
# 2 ommotors.chennai@herofincorp.biz

Step 5.
grep sasl_user /var/log/zimbra.log | sed 's/.*sasl_username=//g' | sort | uniq -c | sort -nr
It will sort the output in previous step with number.

eg,
# 2288 kalptarumotors@heromotocorp.biz
# 25 carlatazzioli@hmclcolombia.com
# 20 leydyjimenez@hmclcolombia.com
# 18 marcelamunoz@hmclcolombia.com
# 17 juan.marin@hmclcolombia.com
# 13 leonardo.meza@hmclcolombia.com

Step 6.
grep sasl_user /var/log/zimbra.log | sed 's/.*sasl_username=//g' | sort | uniq -c | sort -nr | tail -n 1000 | less
It will print last 1000 lines.

Spam Issue on Triburg and its troubleshoot of which account got compromised in ZImbra

2014-12-02T18:06:48Z

Ravi: /* Another Method For Finding the Authenticated User For Spamming */

Spam Issue on Triburg and its troubleshoot of which account got compromised in ZImbra

2014-11-27T02:32:25Z

Ravi:

[[category:Triburg]]

==ISSUE==

One of the account got compromised and Spam mails were sent using that account credentials .

== Finding Methodology ==

# check the mailq ( as zimbra user ) if traces of those mails are available
# Check /var/log/zimbra.log and identify the IP
# Check /opt/zimbra/log/audit.log for the authentication information against that IP and at that time

== Finding ==

Check the mailq , but only the bounce traces of mails were available , which did not reveal the sender information , but showed that Spamming has been done via this server

Next , Checked the zimbra.log found traces of the spam mail ID.

Feb 6 04:15:49 mail postfix/qmgr[17520]: AB0B2B4B8096: from=<041700@unmsm.edu.pe>, size=1293, nrcpt=50 (queue active)
Feb 6 04:15:49 mail postfix/qmgr[17520]: 2CF51190049: from=<041700@unmsm.edu.pe>, size=1292, nrcpt=50 (queue active)
Feb 6 04:15:50 mail postfix/qmgr[17520]: 29F4F190048: from=<041700@unmsm.edu.pe>, size=1292, nrcpt=50 (queue active)
Feb 6 04:15:50 mail postfix/qmgr[17520]: 5932E190042: from=<041700@unmsm.edu.pe>, size=1292, nrcpt=50 (queue active)
Feb 6 04:15:50 mail postfix/qmgr[17520]: 62B5D1901C1: from=<041700@unmsm.edu.pe>, size=1292, nrcpt=50 (queue active)

The From ID 041700@unmsm.edu.pe is the spammer. We had to check for its traces the previous logs /var/log/zimbra.log.1 , and discovered the IP address

Feb 6 00:59:43 mail postfix/qmgr[17520]: 16DBEB4B801C: from=<041700@unmsm.edu.pe>, size=893, nrcpt=5 (queue active)
Feb 6 00:59:43 mail amavis[3538]: (03538-09) ESMTP::10024 /opt/zimbra/data/amavisd/tmp/amavis-20130206T004632-03538: <041700@unmsm.edu.pe> -> <chizobamjames@gmail.com>,<chizoba.j@rediff.com>,<chizoba.j@rediffmail.com>,<don_chizzy2000@yahoo.com>,<don_chizzy@ymail.com> SIZE=893 Received: from mail.triburg.co.in ([127.0.0.1]) by localhost (mail.triburg.co.in [127.0.0.1]) (amavisd-new, port 10024) with ESMTP; Wed, 6 Feb 2013 00:59:43 +0530 (IST)
Feb 6 00:59:43 mail amavis[3538]: (03538-09) Checking: uv8HJES+YMct '''[101.63.8.198]''' <041700@unmsm.edu.pe> -> <chizobamjames@gmail.com>,<chizoba.j@rediff.com>, <chizoba.j@rediffmail.com>,<don_chizzy2000@yahoo.com>,<don_chizzy@ymail.com>
Feb 6 00:59:43 mail amavis[3538]: (03538-09) Open relay? Nonlocal recips but not originating: chizobamjames@gmail.com, chizoba.j@rediff.com, chizoba.j@rediffmail.com , don_chizzy2000@yahoo.com , don_chizzy@ymail.com

And then the authentication information was discovered from /opt/zimbra/log/audit.log

2013-02-06 00:50:33,034 INFO [btpool0-474://localhost/service/soap/AuthRequest] '''[name=imran.khan@triburg.co.in;ip=101.63.8.198''';ua=zclient/6.0.14_GA_2928;] security - cmd=Auth; account=imran.khan@triburg.co.in; protocol=soap;

The Password was of the compromised account was immediately changed .
--------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------

==Another Method For Finding the Authenticated User For Spamming==

# grep sasl_user /var/log/zimbra.log | sed 's/.*sasl_username=//g' | sort | uniq -c | sort -nr | tail -n 1000 | less

How it works:-

Step 1.
grep sasl_user /var/log/zimbra.log
will print all the lines containing "sasl_user" in /var/log/zimbra.log

eg,
# Nov 25 11:18:40 mail postfix/smtpd[30849]:C16F52C8400A:client=unknown[106.67.154.16],sasl_method=PLAIN,sasl_username=taranangad.gwalior@heromotocorp.biz

Step 2.
grep sasl_user /var/log/zimbra.log | sed 's/.*sasl_username=//g'
Output is then passed through pipe symbol to the right where everything before and including "sasl_username=" in the previous output is replaced to null. So the Output is only email-ID.

eg,
# taranangad.gwalior@heromotocorp.biz

Step 3.
grep sasl_user /var/log/zimbra.log | sed 's/.*sasl_username=//g' | sort
It will sort all the email-IDs in the previous step.

eg,
# tanushka.Gwalior@herofincorp.biz
# tanushka.Gwalior@herofincorp.biz
# tanushka@heromotocorp.biz
# taranangad.gwalior@heromotocorp.biz
# taranangad.gwalior@heromotocorp.biz
# twincity.khanna@herofincorp.biz
# udaya.hospet@heromotocorp.biz
# union.JAMSHEDPUR@herofincorp.biz
# union.JAMSHEDPUR@herofincorp.biz
# unique.Batala@herofincorp.biz

Step 4.
grep sasl_user /var/log/zimbra.log | sed 's/.*sasl_username=//g' | sort | uniq -c
It will uniquely count each email-ID in the previous step and will print with a number it was occured.

eg,
# 3 navkar.Dhule@herofincorp.biz
# 7 navkar.dhule@heromotocorp.biz
# 3 nimar.khargone
# 5 northern.akbarpur@herofincorp.biz
# 2 northern.kanpur
# 9 northern.kanpur@herofincorp.biz
# 2 ommotors.chennai@herofincorp.biz

Step 5.
grep sasl_user /var/log/zimbra.log | sed 's/.*sasl_username=//g' | sort | uniq -c | sort -nr
It will sort the output in previous step with number.

eg,
# 2288 kalptarumotors@heromotocorp.biz
# 25 carlatazzioli@hmclcolombia.com
# 20 leydyjimenez@hmclcolombia.com
# 18 marcelamunoz@hmclcolombia.com
# 17 juan.marin@hmclcolombia.com
# 13 leonardo.meza@hmclcolombia.com

Step 6.
grep sasl_user /var/log/zimbra.log | sed 's/.*sasl_username=//g' | sort | uniq -c | sort -nr | tail -n 1000 | less
It will print last 1000 lines.