Mail7 11.15.2007

[AlexRust]

Is there are any way we can see who is the target. Or it is just mail7 IP under attack?

[frieddan]

Originally Posted by esites

To change to another email server, Josh in support told me (replied to my TT) that the best solution is to turn off the mail service in the control panel, turn it back on and the mail service would be moved to (hopefully) another server... although it would take 24 hours to propogate!

Does this sound like the best option, or is there another way that I can repoint and have it somewhere quicker?

My understanding is that this is the only way to handle it inside of Vortech. However, because you can mainpulate your MX records directly through hsphere, there are some other options.

As I mentioned earlier, I have a server with mail service already set up, and I have been transferring people there. However, I assume most people don't have this option available, and it is only good timing that I have it available at this moment.

Another possibility is signing up for Google Apps for Domains. This essentially allows you to point your MX records to gmail, but to have gmail branded from your domain so that your email would still appear to come from you@yourdomain.com instead of yourgoogleid@gmail.com. Unfortunately, this also takes time to complete, but it is a long term solution while moving to another server at Vortech could become a problem in the near future as well unless they get to the bottom of this.

One thing that will not work is forwarding email to another domain from within the email controls in hsphere. You have to direct the MX record to another server which has your (or your client's) domain set up. Until they have a real solution, I would not recommend just moving to another server at Vortech.

[microm]

Jason, to answer your question about MX record propogation, it started changing almost immediately for me, probably within an hour, and almost all done in 12 hours. I did not turn off the vortec mail service, though I did remove the mx record. The alternate email service has a "box poll" option which lets me configure it to automatically check the old email server and pull the email into the new accounts. I did need to change their settings because 1. the new service did not use 2525 as an alternate smtp port and 2. they had separate pop and smtp servers, there was no way to make mail.domainname.com work for incoming and outgoing. If you're alternate service does use mail.domainname.com for both servers, and 2525, then you can probably get away with not changing the customer's settings, password might need to change though.

The other thing I learned from this is that 1. backup email servers (mx record pointing to a totally different server) is a good idea, one that will hold email for the primary and 2. I'm going to host dns externally as well. There are some settings hshpere can't do, like TTL for mx records.

[esites]

I just moved 2 of my accounts over to new mail servers (within Vortech) by turning off the mail service and turning it back on. The first account which doesn't have much activity propagated withing minutes, the second more active account propagated within about one hour.

Both accounts are back in service and working well so far. I am considering moving others. Even though I may have lost a few emails, at least I am back in business for the time being. Thanks Josh!

[dpyers]

When you toggled mail service, did you have to rebuild the mail accounts?

If you didn't, did anything in IMAP folders get lost?

[joshnolan22]

why couldn't this have happened on a server where my crappy clients are hosted... i need to rid myself of those, not the good clients!!!

5 gone, more to come soon...

[admin]

Ok we now have a proxy system setup in front of mail7 running a firewall and and spamd, this has caused the load on the server to drop to a load that is ok. SpamD is checking the connection and only passing legit connection or emails on to qmail on the next server. Our loads are now 1.5 proxy server and 2.7 mail server this is down from the 10.00 to 15.00 load it had.

In about the 1/2 hour it has been running so you can understand how bad of an attack this is to give you an idea.. there have been 471,000 connections and only 24500 attempts to send mail or real emails not just connections.

spamd does use a whitelist and greylist to get on the white list is simple anyone just has to send you an email and it adds them right to the white list. More less what we are doing is filtering out the bad or fake connections now only passing the good ones or emails along to the mail server.

This is ONLY on mail7 at the time if we don't see any issue though out the night we may do this for mail8 as well to get it more stable. But you are also welcome to turn off you mail and turn it back on it may or may not put you on a new mail server and yes you will lose mail and mail settings by doing this.

Just wanted to give everyone an update before they thought we were going under or forgot about you again. We are working hard to stop this attack and we think we have found the answer now.

[dvanburen]

Just an FYI, port 2525 should still be used by your clients or they may experience a small delay getting on the whitelist. Not much of a problem for static IPs, but anyone with a dynamic IP would have to do this every time their IP changes.

[Dreamzz]

Hi Vortech,

Now Mail0 is having problems, my clients cant send out nor recieve any email.

[MEELAN]

Originally Posted by Dreamzz

Hi Vortech,

Now Mail0 is having problems, my clients cant send out nor recieve any email.

OMG! Shouldn't you open the ticket first rather panicking everyone here. I really hope that may be a small hiccup somewhere!

[Dreamzz]

Hi ,

i sent a ticket but there is no response for the past 4 hrs and i am hounded with calls.

Checked the server status, its really having problems.

Now all my clients in mail0 cant sent nor recieve emails.

[themidnightwill]

I am having the same problem. No ticket updates from Vortech.


I noticed on the Nagios server status web page, the mail0 status keeps oscillating. Not that really helps us, but...

[themidnightwill]

Just got ONE email on one of my accounts. (I normally get about 40 per day, so i have a hard time believing I only got one email in the last seven or eight hours).

Any one have any success yet?

---------------------


Update: Tried sending - seemed to work. Got the email ok on a non-mail0 email account

[themidnightwill]

Update: Got a reply on my trouble ticket saying it was fixed. I'm not getting any of heemail sent to me earlier, though... but sending a message now seems to go through ok.

Will all our mail from the outage be lost??

[Dreamzz]

i got a reply from the helpdesk, the earlier emails were lost. But noone gave me a reason why it happens and how it happens.

If it was a not enough disk space issue, i thought vortech should have known it before hand.

Thanks