Illegal use of my server??

[Antonio Torres]

*Any* http proxy misconfigured can be used for mail relay ...

Squid, Apache+mod_proxy, delegate ...

a simple "CONNECT xxx.yyy.zzz.ttt:25 HTTP/1.0" can put your proxy (or your IP) in trouble (or in RBL)....


For *any* kind o proxy :

   Read the manual !
   Search google for tips&tricks

   be paranoic: 
        use ipfw (or other 'firewall') to add an extra level of security/filtering

   be more paranoic : read the logs !!


[]s


On Mon, 19 May 2003 11:25:48 -0700
Bryan Vyhmeister <bsd at hub3.net> wrote:

> I don't quite understand what happened. How was Squid used to relay 
> mail? I'm glad this thread came up because I am just about to deploy a 
> Squid cache.
> 
> Bryan
> 
> On Monday, May 19, 2003, at 11:18 AM, Joseph T. Klein wrote:
> 
> > The Squid package and port should have a *big* warning sign on them 
> > about this.
> > I know of at least one network that was blacklisted due to the lack of 
> > tight
> > ACLs on Squid.
> >
> > On Monday, May 19, 2003, at 01:09  PM, Tony Saign wrote:
> >
> >> Any legal gurus out there??
> >>
> >> Long story, but I'll summarize;
> >>
> >> On Friday 05/16 my T1 went down.
> >> In troubleshooting attempts it was discovered that a machine, on my
> >> network was being used maliciously.
> >> Not hacked, but Squid was being used to relay mail (i.e. SPAM).
> >> The machine was immediately brought down, and Squid was disabled.
> >>
> >> I received a call from my ISP, and they are NOT happy.
> >> Looking @ the logs, it appears that several thousand SPAM emails may
> >> have been sent.
> >>
> >> What should I do? Can I pursue each ISP in attempts to track down the
> >> guilty parties?
> >> Can I take any legal action against them?
> >> This is the last straw! I'm so frickin' sick of SPAM, and now people
> >> potentially got some w/ my IP address!
> >> Grrr!!!
> >>
> >> Any suggestions, advice would be greatly appreciated.
> >>
> >>


-- 
Antonio Torres
antonio.torres at newspace.net.br