0

I set-up a private mail server on my VPS. I get a lot of mail request on the SMTP server while I did not send them by myself. I disabled the bounce mail to prevent spamming other mail addresses. How can I prevent this from happening? These are the logs:

Nov 14 22:39:02 vps3 postfix/smtp[3287]: 2E1F842EA6: to=<XXX>, relay=none, delay=0.08, delays=0/0/0.08/0, dsn=5.4.4, status=bounced (Host or domain name not found. Name service error for name=XXX type=AAAA: Host not found)
Nov 14 22:39:02 vps3 postfix/qmgr[3232]: 2E1F842EA6: removed

Or:

Nov  9 08:39:02 vps3 postfix/pickup[29626]: 3CB8042EA1: uid=0 from=<root>
Nov  9 08:39:02 vps3 postfix/cleanup[29755]: 3CB8042EA1: message-id=<20141109083902.3CB8042EA1@XXX>
Nov  9 08:39:02 vps3 postfix/qmgr[2167]: 3CB8042EA1: from=<[email protected]>, size=827, nrcpt=1 (queue active)
Nov  9 08:39:02 vps3 postfix/smtp[29757]: 3CB8042EA1: to=<[email protected]>, orig_to=<root>, relay=none, delay=0.11, delays=0.02/0.01/0.08/0, dsn=5.4.4, status=bounced (Host or domain name not found. Name service error for name=d1st$
Nov  9 08:39:02 vps3 postfix/cleanup[29755]: 574D842EA3: message-id=<20141109083902.574D842EA3@XXX>

I checked if I have an open relay, but I have none. I tested myself if I could send a mail without authenticating:

telnet XXX 25
Trying XXX
Connected to XXX.
Escape character is '^]'.
220 XXX ESMTP Postfix
telnet XXX 25
ehlo XXX
mail from: root
rcpt to: [email protected]
250-XXX
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
250 2.1.0 Ok
554 5.7.1 <[email protected]>: Relay access denied

587 (tls)
250 DSN
ehlo XXX
250-XXX
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-AUTH PLAIN
250-AUTH=PLAIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
mail from: root
250 2.1.0 Ok
rcpt to: [email protected]
554 5.7.1 <XXX[XXX]>: Client host rejected: Access denied

This also did not work. The apache logs are also clean, there is no one that tries to access my webserver when there is as fake mail in the queue.

How is it possible that I get a mail request without sending one by myself?

7
  • The mail shown in that log entry either originated from or was relayed through your server. Go through your logs more carefully and find out as much as you can about it. Nov 14, 2014 at 23:00
  • @MichaelHampton I added another send mail log. I am reading more logs at the moment, but I really do not have any idea where these requests come from.
    – Laurence
    Nov 14, 2014 at 23:05
  • Why are you obfuscating the destination addresses? This isn't helpful. Nov 14, 2014 at 23:07
  • 1
    A stab in the dark: Did you put [email protected] in your aliases file? If so, you're probably bouncing your own cron email.
    – user143703
    Nov 14, 2014 at 23:13
  • 1
    @yoonix I did not see that you already suggested that the cronjob could be the problem. I am sorry for adding the answer while you were first.
    – Laurence
    Nov 14, 2014 at 23:48

1 Answer 1

2

These are mailed from a cronjob. They will be sent to root@yourhostname.

To correct your hostname you have to edit the /etc/mailname file with your correct hostname.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .