Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running Postfix on my personal server in a data centre. I am not a professional mail hoster and not a Postfix expert, it is just used for a few domains served from that server.

IIRC, I mostly followed this howto when setting up Postfix. Mails addressed to one of the domains the server manages are delivered locally (/srv/mail) to be fetched with Dovecot. Mails to other domains require usage of SMTPS. The mailbox configuration is stored in MySQL.

The problem I have is that I suddenly found new mailboxes being created on the disk. Let's say I have the domain 'example.com'. Then I would have lots of new directories, e.g.
/srv/mail/example.com/abenaackart
/srv/mail/example.com/abenaacton
etc.
There are no entries for these addresses in my database, neither as a mailbox nor as an alias.

It's clearly spam from auto-generated names. Most of them start with 'a', a few with 'b' and a couple of random ones with other letters. At first I was afraid of an attack, but all security restrictions seem to work. If I try to send mail to these addresses, I get an "Recipient address rejected: User unknown in virtual mailbox table" during the 'RCPT TO' stage.

So I looked into the mails stored in these mailboxes. Turns out that all of them are bounces. It seems like all of them were sent from a randomly generated name to an alias that really exists on my system, but pointed to an invalid destination address on another host. So Postfix accepted it, then tried to redirect it to another mail server, which rejected it. This bounced back to my Postfix server, which now took the bounce and stored it locally -- because it seemed to be originating from one of the addresses it manages.

Example:

  1. My Postfix server handles the example.com domain.
  2. alice@example.com is configured to redirect to alice@hotmail.com.
  3. alice@hotmail.com has since been deleted from the Hotmail servers.
  4. Spammer sends mail with FROM:bob@example.com and TO:alice@example.com.
  5. My Postfix server accepts the mail and tries to hand it off to hotmail.com.
  6. hotmail.com sends a bounce back.
  7. My Postfix server accepts the bounce and delivers it to /srv/mail/example.com/bob.

The last step is what I don't want. I'm not quite sure what it should do instead, but creating hundreds of new mailboxes on my disk is not what I want...

Any ideas how to get rid of this behaviour? I'll happily post parts of my configuration, but I'm not really sure where to start debugging the problem at this point.


My main.cf:

smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = no

# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/pf.pem
smtpd_tls_key_file=/etc/ssl/private/pf.key
smtpd_tls_security_level=may
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

myhostname = <hostname removed>
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
relayhost =
mydestination = localhost
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128, <server ip and some subnets removed>, 192.168.2.0/24
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000
virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf
virtual_alias_maps = mysql:/etc/postfix/mysql-virtual-alias-maps.cf,mysql:/etc/postfix/mysql-email2email.cf
virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf
virtual_transport = dovecot
dovecot_destination_recipient_limit = 1
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
share|improve this question

1 Answer 1

Seems like you're not validating whether the recipient is a valid address. Check if you have a properly configured local_recipient_maps. If that's not it, please include your main.cf file for review.

share|improve this answer
    
Thanks for your answer. I will have to investigate how to do that with my MySQL-based configuration. I'll get back to you, with my main.cf file if necessary. –  hheimbuerger May 1 '10 at 19:09
    
I don't have a local_recipient_maps. I tried understanding LOCAL_RECIPIENT_README, but I don't think my Postfix knowledge is sufficient to understand how that is related to my problem. (I do only virtual delivery, never to local accounts.) I attached my main.cf to the question, but I doubt it helps. –  hheimbuerger May 3 '10 at 20:45
    
If you don't have local deliveries, please follow the instructions in postfix.org/STANDARD_CONFIGURATION_README.html#firewall to disable local delivery. If that doesn't work, please post the cf files that are used in virtual_mailbox_maps, virtual_mailbox_domains and virtual_alias_maps. At the moment the problem is either the local delivery creating the dirs or a mistake in the cf files that is not limiting the access to only existing mailboxes. –  jneves May 3 '10 at 21:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.