I have a situation on one server, where it seems to be spaming over traffic being sent over SSH tunnel.Output below shows connections being made to remote SMTP server that seem to be initiated over SSH[~]# lsof -i | grep smtp | grep ssh | tail -5sshd      1015801            root    6u  IPv4 2949384874      0t0  TCP hostname:47778->col0-mc4-f.col0.hotmail.com:smtp (ESTABLISHED)sshd      1015801            root   10u  IPv4 2949384887      0t0  TCP hostname:44950->bay0-mc5-f.bay0.hotmail.com:smtp (ESTABLISHED)sshd      1015801            root   12u  IPv4 2949384892      0t0  TCP hostname:44001->bay0-mc5-f.bay0.hotmail.com:smtp (ESTABLISHED)sshd      1018332            root    9u  IPv4 2949372697      0t0  TCP hostname:53717->38.102.228.18:smtp (SYN_SENT)sshd      1018394            root    6u  IPv4 2949396212      0t0  TCP hostname:39489->mailcluster.midco.net:smtp (ESTABLISHED)TCPForwarding is disabled on the server, and I have also tried reinstalling openssh completely. [~]# egrep -i tcp|forward /etc/ssh/sshd_configAllowAgentForwarding noAllowTcpForwarding noX11Forwarding no#X11Forwarding yes#TCPKeepAlive yes#       X11Forwarding no#       AllowTcpForwarding noHow is it possible for the traffic to be tunneled over SSH if it is suppose to be disabled?Am I reading something wrong here, does this show SMTP traffic being forwarded over SSH?Is there possibly some include file for ssh config?I know the server needs to be rebuilt, as it has obviously been rooted, but I am interested here in finding out how is this happening exactly.I made a tcpdump with tcpdump -vv -x -X -n -s 1500 -i em1 'port number' >> /root/tcpdump.ssh and I can see ip addresses making connections, and active ssh processes, but I still don't know how exactly are they forwarding the traffic.any ideas anyone, on how is the traffic being forwarded even do it is suppose to be disabled?
SMTP traffic being forwarded through SSH even do AllowTcpForwarding is disabled
ssh tunneling;sshd;openssh