Postfix is sending non delivery notification emails caused by spammers

Question

I'm not very experienced with running a mailserver, I do not have it setup as an open relay (I've tested with various outside scanning scripts) However I had noticed my server still generating a lot of nonsense emails.

I believe i have an example here:

Oct 26 08:53:59 localhost postfix/smtpd[29067]: connect from unknown[116.118.82.128]
Oct 26 08:54:00 localhost postfix/smtpd[29067]: 4CF879C459: client=unknown[116.118.82.128]
Oct 26 08:54:01 localhost postfix/cleanup[29071]: 4CF879C459: message-id=<201010261452.FF89D878b40056@[116.118.82.128]>
Oct 26 08:54:01 localhost postfix/qmgr[1754]: 4CF879C459: from=<niloxen9618@32million.com>, size=4046, nrcpt=1 (queue active)
Oct 26 08:54:01 localhost postfix/pipe[29074]: 4CF879C459: to=<hasan@ALOCALDOMAIN>, relay=maildrop, delay=1.3, delays=1.2/0.01/0/0.02, dsn=5.1.1, status=bounced (user unknown. Command output: Invalid user specified. )
Oct 26 08:54:01 localhost postfix/cleanup[29071]: 1DF0B9C45F: message-id=<20101026075401.1DF0B9C45F@LOCALHOST>
Oct 26 08:54:01 localhost postfix/bounce[29076]: 4CF879C459: sender non-delivery notification: 1DF0B9C45F
Oct 26 08:54:01 localhost postfix/qmgr[1754]: 4CF879C459: removed
Oct 26 08:54:01 localhost postfix/qmgr[1754]: 1DF0B9C45F: from=<>, size=6102, nrcpt=1 (queue active)
Oct 26 08:54:01 localhost postfix/smtpd[29067]: disconnect from unknown[116.118.82.128]
Oct 26 08:54:05 localhost postfix/smtp[29077]: 1DF0B9C45F: to=<niloxen9618@32million.com>, relay=mail.32million.com[64.13.232.144]:25, delay=4.2, delays=0.1/0.01/1.3/2.7, dsn=2.0.0, status=sent (250 OK id=1PAeM7-0001Od-64)
Oct 26 08:54:05 localhost postfix/qmgr[1754]: 1DF0B9C45F: removed

Would I be correct in assuming that the spammer is getting my server to send out a bounce message with his spam to some address?

I would appreciate any advice to point me in the direction of stopping this.

Thanks,

Answer 1

You are right, you're sending DSN messages to innocent people (no offense, as this might sound too dramatic).

I bet you have either virtual users and/or someone acting as a backup MX for you. The key to prevent this behaviour is to check if these accounts exist on your server (if you have a backup MX, it needs to do the same).

Here are some config snippets that should help:

• If you use a backup MX: http://www.postfix.org/postconf.5.html#relay_recipient_maps
• For other types of local delivery see this http://www.postfix.org/postconf.5.html#smtpd_reject_unlisted_recipient

If I understand this correctly, you need to specify local/virtual domain and every user.

I'm not sure if I could explain this, I'm not a native english speaker. Just ask if somethings not clear.