Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm getting a little concerned as I run a small server hosting a number of websites and manage the email for a few dozen people.

Just recently though I've had a couple of notifications from spamcop alerting me that spam has been sent from my server, and when I have a look over the logs from time to time I can indeed see that there are many repeated attempts of mail being sent from my server. Most of the time it gets knocked back from the destination servers but sometimes its getting through.

Unfortunately I'm not linux or postfix expert, I can get by but had though I had my machine locked down quite securely, I don't allow relaying, when I check the online DNS/MX tools they tend to report my server as being OK so I'm not sure where to take it now and hoping someone might be able to throw me a few pointers.

I get lots of entries like this in my MAIL.INFO log

Jan  2 08:39:34 Debian-50-lenny-64-LAMP postfix/qmgr[15993]: 66B88257C12F: from=<>, size=3116, nrcpt=1 (queue active)
Jan  2 08:39:34 Debian-50-lenny-64-LAMP postfix/qmgr[15993]: 614C2257C1BC: from=<notice@tademe.co.nz>, size=2490, nrcpt=3 (queue active)

and

Jan  7 16:09:37 Debian-50-lenny-64-LAMP postfix/error[6471]: 0A316257C204: to=<notice@tademe.com>, relay=none, delay=384387, delays=384384/3/0/0.01, dsn=4.0.0, status=deferred (delivery temporarily suspended: host mx.fakemx.net[46.4.35.23] refused to talk to me: 421 mx.fakemx.net Service Unavailable)
Jan  7 16:09:37 Debian-50-lenny-64-LAMP postfix/error[6470]: 5848C257C20D: to=<notice@tademe.com>, relay=none, delay=384373, delays=384370/3/0/0.01, dsn=4.0.0, status=deferred (delivery temporarily suspended: host mx.fakemx.net[46.4.35.23] refused to talk to me: 421 mx.fakemx.net Service Unavailable)

then there tends to be connection timeouts, so from what I see even though I had relaying disabled.. something is getting by and trying to send..

So if you can help that will be greatly appreciated, and any further logging/config info I can supply.

A few lines from the Main.CF which I thought were sufficient are as follows, maybe I'm missing something important here :

# Requirements for the HELO statement
smtpd_helo_restrictions = permit_mynetworks, warn_if_reject reject_non_fqdn_hostname, reject_invalid_hostname, permit
# Requirements for the sender details
smtpd_sender_restrictions = permit_mynetworks, warn_if_reject reject_non_fqdn_sender, reject_unknown_sender_domain, reject_unauth_pipelining, permit
# Requirements for the connecting server
smtpd_client_restrictions = reject_rbl_client sbl.spamhaus.org, reject_rbl_client blackholes.easynet.nl, reject_rbl_client dnsbl.njabl.org 
# Requirement for the recipient address
#smtpd_recipient_restrictions = reject_unauth_pipelining, permit_mynetworks, reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_unauth_destination, permit
smtpd_recipient_restrictions = reject_unauth_pipelining,reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination,check_policy_service inet:127.0.0.1:60000,permit

# require proper helo at connections 
smtpd_helo_required = yes 
# waste spammers time before rejecting them 
smtpd_delay_reject = yes 
disable_vrfy_command = yes

Thanks

share|improve this question
2  
Is your server an open relay? See here serverschool.com/dedicated-servers/how-to-fix-an-open-relay –  USACASD Jan 7 '11 at 15:55

3 Answers 3

up vote 1 down vote accepted

Having permit at the end of your restrictions is the cause of trouble. If it isn't permitted up-front with permit_mynetworks then you don't want to futz around with whatever is being submitted to your mail queue. Remove those permit entries from the end of your *_restrictions lines and you'll see a sudden improvement. What is happening is that some of the spam relay attempts are "just conforming enough" to make it through the list of restrictions (those entries in front of the permit), so when it walks through the list of tests to pass in the restrictions list, it hits the permit which instructs postfix to give it the "thumbs up" and it continues processing - and relaying - the spam being sent.

I assume(?) that you have the permit statements in there to prevent email from being blocked by legitimate clients. Don't worry about shutting out your network. That's what mynetworks is for: it is the list of "trusted" network addresses that you will automatically accept and relay mail for. The entry permit_mynetworks at the beginning tells postfix to immediately allow anything that is defined in mynetworks and at that point it stops processing the steps listed in your *_restrictions list. This is because the list of tests are processed left-to-right, until a match is found. Using permit at the end of each line instructs the system to allow the mail without restriction if it has passed all of the other tests in front of the permit setting.

share|improve this answer
    
Thanks for that info. I'll give what you say a go and see how things develop. –  Dave Jan 8 '11 at 16:28
    
Hi, Problems have come to light with some users now not being able to send mail. The new is appears to be when a user is connected from their home machine and the helo is being sent simply with their computers name, when its not a FQDN it's being rejected –  Dave Jan 9 '11 at 11:18
    
Remove reject_non_fqdn_hostname from smtpd_helo_restrictions and reject_non_fqdn_sender from smtpd_sender_restrictions. –  Avery Payne Jan 13 '11 at 0:29

You should almost never use permit. Only use qualified permit directives (i.e., permit_mynetworks, permit_sasl_authenticated, etc).

share|improve this answer

You thought you had relay disabled, but do you? You'd have to post information from your config file or google for something like "disable relay" and your MTA application's name to find sample lockdown information to harden your system.

Otherwise, either someone you allow to send mail through your system is infected with something and is using your server to send spam or someone got into your server and infected it with scripts to relay spam.

Have you checked for unusual services running? Check for rootkits or anything unusual in the logs? What other services do you have running on the server? Have you checked for unusual incoming TCP connections? How are you locking the system down to authorized users only, like from your own subnet, particular passwords (that could have been compromised), authorized IP's only...?

share|improve this answer
    
Well sometimes I see relaying not permitted, or something similar in my logs so I'm pretty certain I'm not an open relay. Pretty sure by default Postfix isn't and to become one you have to configure it so. I'll add a few lines from my Main.CF to my initial question so it formats nicely... –  Dave Jan 7 '11 at 16:10
    
"By default, Postfix has a moderately restrictive approach to mail relaying. Postfix forwards mail only from clients in trusted networks, or to domains that are configured as authorized relay destinations." postfix.org/SMTPD_ACCESS_README.html –  USACASD Jan 7 '11 at 16:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.