Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm not very experienced with running a mailserver, I do not have it setup as an open relay (I've tested with various outside scanning scripts) However I had noticed my server still generating a lot of nonsense emails.

I believe i have an example here:

Oct 26 08:53:59 localhost postfix/smtpd[29067]: connect from unknown[116.118.82.128]
Oct 26 08:54:00 localhost postfix/smtpd[29067]: 4CF879C459: client=unknown[116.118.82.128]
Oct 26 08:54:01 localhost postfix/cleanup[29071]: 4CF879C459: message-id=<201010261452.FF89D878b40056@[116.118.82.128]>
Oct 26 08:54:01 localhost postfix/qmgr[1754]: 4CF879C459: from=<niloxen9618@32million.com>, size=4046, nrcpt=1 (queue active)
Oct 26 08:54:01 localhost postfix/pipe[29074]: 4CF879C459: to=<hasan@ALOCALDOMAIN>, relay=maildrop, delay=1.3, delays=1.2/0.01/0/0.02, dsn=5.1.1, status=bounced (user unknown. Command output: Invalid user specified. )
Oct 26 08:54:01 localhost postfix/cleanup[29071]: 1DF0B9C45F: message-id=<20101026075401.1DF0B9C45F@LOCALHOST>
Oct 26 08:54:01 localhost postfix/bounce[29076]: 4CF879C459: sender non-delivery notification: 1DF0B9C45F
Oct 26 08:54:01 localhost postfix/qmgr[1754]: 4CF879C459: removed
Oct 26 08:54:01 localhost postfix/qmgr[1754]: 1DF0B9C45F: from=<>, size=6102, nrcpt=1 (queue active)
Oct 26 08:54:01 localhost postfix/smtpd[29067]: disconnect from unknown[116.118.82.128]
Oct 26 08:54:05 localhost postfix/smtp[29077]: 1DF0B9C45F: to=<niloxen9618@32million.com>, relay=mail.32million.com[64.13.232.144]:25, delay=4.2, delays=0.1/0.01/1.3/2.7, dsn=2.0.0, status=sent (250 OK id=1PAeM7-0001Od-64)
Oct 26 08:54:05 localhost postfix/qmgr[1754]: 1DF0B9C45F: removed

Would I be correct in assuming that the spammer is getting my server to send out a bounce message with his spam to some address?

I would appreciate any advice to point me in the direction of stopping this.

Thanks,

share|improve this question

1 Answer 1

up vote 1 down vote accepted

You are right, you're sending DSN messages to innocent people (no offense, as this might sound too dramatic).

I bet you have either virtual users and/or someone acting as a backup MX for you. The key to prevent this behaviour is to check if these accounts exist on your server (if you have a backup MX, it needs to do the same).

Here are some config snippets that should help:

If I understand this correctly, you need to specify local/virtual domain and every user.

I'm not sure if I could explain this, I'm not a native english speaker. Just ask if somethings not clear.

share|improve this answer
    
Thanks I was able to find a solution. In addition to the two URLs above I also used: postfix.org/LOCAL_RECIPIENT_README.html It also helped when I discovered a name for this effect "Backscatter" which helps when googling. Thanks –  SpareCatcher Oct 26 '10 at 10:47
    
Good to hear that. Yes backscatter is the definition, I should have mentioned this too. –  weeheavy Oct 26 '10 at 10:56
    
It was mentioned on your link. –  SpareCatcher Oct 26 '10 at 11:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.