mgb
What can be done for testing what the problem
It is very difficult to understand your problem due to the poor translation to English.
I think this is what you are saying about your problem:
You have a virus infection on a workstation.
You wanted to stop the virus sending out emails via the server.
You closed outgoing port 25 on the server
You then said that the server now cannot send emails
You then said you can only send emails on the local network and not externally
You want to know how to fix the problem and what to do to run tests to discover what the problem is.
Assuming the above is correct then here are my comments.
Clean the virus infection off the workstation. This is absolutely essential and there is no other way to fix the problem.
You can prevent viruses from using their own smtp engine, by forcing authenticated access to sme server's smtp server. As the virus does not know your user password, then it cannot gain access to your smtp server and therefore cannot send outgong emails.
See these FAQ entries:
http://wiki.contribs.org/SME_Server:Documentation:FAQ#How_do_I_enable_smtp_authentication_for_users_on_the_internal_networkhttp://wiki.contribs.org/SME_Server:Documentation:FAQ#How_do_I_disable_SMTP_relay_for_unauthenticated_LAN_clientsStill you need to identify the workstation that has the infection, and to implement the above you will need to change all users email client settings on all workstations.
Look at the email log files for qpsmtpd, sqpsmtpd and qmail, you should be able to see the IP number of the workstation that hundreds of emails are coming from.
Another simple answer is to disconnect the network cable from each workstation one by one and see if the virus email flow stops. Note their may still be undelivered email messages in the queue, so be careful not to trick yourself when using this technique.
Use iptraf to monitor network traffic. See man iptraf
Re-enable port 25 if you want your server to send email, and temporarily disconnect the infected workstation. Do not reconnect it until the virus has been cleaned off it.
Use software tools or a good virus scanner to remove the infection eg AVG Free. Transfer these files via USB rather than reconnecting the workstation to the network.
In a bad scenario where more than one workstation is infected, you may have to disconnect ALL workstation ethernet cables, and reconnect them one by one (or only one at a time) in order to discover which workstation is infected. You will see virus generated email flow as soon as you reconnect an infected computer.
As has been said it is highly unlikely that your sme server is infected, the infection is most likely on a Windows workstation somewhere on your local network.
You do need to provide us with better English translations if you want us to better understand your problem and your questions. This is an English language forum so please do not expect us to be experts at Italian (or whatever your language is)
12 Replies
4081 Views