Mailserver Being Used As A SPAM Relay - How Can We Track The User Causing This? (Doc ID 1925423.1)

Last updated on JUNE 29, 2017

Applies to:

Oracle Communications Messaging Server - Version 7.0.5 and later
Information in this document applies to any platform.

Symptoms

Oracle Communications Messaging Server 7.0.5.30.0 64bit (built Oct 22 2013)

We have a problem where our mail server is being used as a SPAM relay.  We had to block 2 different IPs because they were identified and produced lots of messages in our log files.

Snippets from mail.log_current:


We do not have an entity called "User" as a username to authenticate.

All traffic to and from the Messaging Server passes through our Firewall.  Nothing was changed on either the Messaging Server or the Firewall when the problem started happening.

Normally, we allow unauthenticated connections from our own subnet; all other connections must be authenticated.

Cause

Sign In with your My Oracle Support account

Don't have a My Oracle Support account? Click to get started

My Oracle Support provides customers with access to over a
Million Knowledge Articles and hundreds of Community platforms