We have an up-to-date Centos 5.8 with Apache, Postfix and Dovecot installed and running without problem.
Someone or something keeps logging in to postfix/dovecot as the apache user and spamming @comcast.net email addresses. The log entries look like this:
Mar 13 13:33:34 postfix/smtpd[26456]: D05AE1A900BC: client=unknown[84.51.170.132], sasl_method=LOGIN, sasl_username=apache
Mar 13 13:33:35 postfix/cleanup[26460]: D05AE1A900BC: message-id=<[email protected]>
Mar 13 13:33:35 postfix/qmgr[2361]: D05AE1A900BC: from=<[email protected]>, size=3576, nrcpt=1 (queue active)
Mar 13 13:33:36 postfix/smtp[27125]: D05AE1A900BC: to=<[email protected]>, relay=mta5.am0.yahoodns.net[209.191.88.254]:25, delay=1.9, delays=0.38/0/0.64/0.85, dsn=2.0.0, status=sent (250 ok dirdel)
Mar 13 13:33:36 postfix/qmgr[2361]: D05AE1A900BC: removed
--snip--
Mar 13 16:18:13 postfix/smtpd[13861]: E50DE1A90037: client=unknown[72.54.180.241], sasl_method=LOGIN, sasl_username=apache
Mar 13 16:18:19 postfix/cleanup[13867]: E50DE1A90037: message-id=<[email protected]>
Mar 13 16:18:19 postfix/qmgr[2361]: E50DE1A90037: from=<[email protected]>, size=3779, nrcpt=25 (queue active)
Mar 13 16:18:20 postfix/smtp[13868]: E50DE1A90037: to=<[email protected]>, relay=none, delay=6.4, delays=6.4/0/0.02/0, dsn=5.4.4, status=bounced (Host or domain name not found. Name service error for name=comcast.con type=A: Host not found)
Mar 13 16:18:22 postfix/smtp[13869]: E50DE1A90037: to=<[email protected]>, relay=mx2.comcast.net[76.96.30.116]:25, delay=9, delays=6.4/0.01/1.1/1.5, dsn=5.1.1, status=bounced (host mx2.comcast.net[76.96.30.116] said: 550 5.1.1 Not our Customer (in reply to RCPT TO command))
Mar 13 16:18:23 postfix/smtp[13869]: E50DE1A90037: to=<[email protected]>, relay=mx2.comcast.net[76.96.30.116]:25, delay=9.9, delays=6.4/0.01/1.1/2.3, dsn=5.1.1, status=bounced (host mx2.comcast.net[76.96.30.116] said: 550 5.1.1 <[email protected]> Account not available (in reply to RCPT TO command))
--snip--
Mar 13 16:18:55 postfix/smtp[13869]: E50DE1A90037: to=<[email protected]>, relay=mx2.comcast.net[76.96.30.116]:25, delay=42, delays=6.4/0.01/1.1/35, dsn=2.0.0, status=sent (250 2.0.0 l4JL1i00l248zeQ0N4JMLQ mail accepted for delivery)
Mar 13 16:18:55 postfix/bounce[13870]: E50DE1A90037: sender non-delivery notification: A96601A900C9
Mar 13 16:18:55 postfix/qmgr[2361]: E50DE1A90037: removed
This has happened twice in recent times and the telltale sign that this is the same person/thing is responsible is that they send their first email to [email protected]. They are careful to only send a small number of emails in a batch of a few minutes, presumably to avoid detection and to ensure our server isn't blocked as a spam relay.
How is it possible to authenticate as apache and how can I stop this?
Thanks in advance for your help