Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

today I received like 30 messages within 5 minutes telling me that some mail I send could not be delivered, mostly to *.ru email addresses which I did not send any mail to. I have my own webserver (postfix/dovecot) set up using this guide (http://workaround.org/ispmail/lenny) but adjusted a little bit for Ubuntu.

I tested whether I am an Open Relay which I am apparently not. Now there are two possible reasons for the above mentioned emails: Either I am sending out spam, or somebody wants me to think that, correct?

How can I check this?

I selected one particular address that I supposedly send spam to. Then I searched my mail.log for this entry. I found two blocks that record that somebody from the server connected to my server and delivered some message to two different users. I cannot find an entry reporting that anyone from my server send an email to that server. Does this mean its just some mail to scare me or could it still have been send by me in the first place?

Here is one such block from the log (I replaced some confidential stuff):

Jun 26 23:23:28 mycustomernumber postfix/smtpd[29970]: connect from mx.webstyle.ru[195.144.251.97]
Jun 26 23:23:29 mycustomernumber postfix/smtpd[29970]: 044991528995: client=mx.webstyle.ru[195.144.251.97]
Jun 26 23:23:29 mycustomernumber postfix/cleanup[29974]: 044991528995: message-id=<receipt-478991526@m.webstyle.ru>
Jun 26 23:23:29 mycustomernumber postfix/qmgr[3369]: 044991528995: from=<>, size=2198, nrcpt=1 (queue active)
Jun 26 23:23:29 mycustomernumber amavis[28598]: (28598-11) ESMTP::10024 /var/lib/amavis/tmp/amavis-20110626T223137-28598: <> -> <someuser@myserver.com> SIZE=2198 Received: from mycustomernumber.stratoserver.net ([127.0.0.1]) by localhost (rehmsen.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP for <someuser@myserver.com>; Sun, 26 Jun 2011 23:23:29 +0200 (CEST)
Jun 26 23:23:29 mycustomernumber amavis[28598]: (28598-11) Checking: YakjkrdFq6A8 [195.144.251.97] <> -> <someuser@myserver.com>
Jun 26 23:23:29 mycustomernumber postfix/smtpd[29970]: disconnect from mx.webstyle.ru[195.144.251.97]
Jun 26 23:23:29 mycustomernumber amavis[28598]: (28598-11) lookup_sql_field(id) (WARN: no such field in the SQL table), "someuser@myserver.com" result=undef
Jun 26 23:23:32 mycustomernumber postfix/smtpd[29979]: connect from localhost.localdomain[127.0.0.1]
Jun 26 23:23:32 mycustomernumber postfix/smtpd[29979]: 0A1FA1528A21: client=localhost.localdomain[127.0.0.1]
Jun 26 23:23:32 mycustomernumber postfix/cleanup[29974]: 0A1FA1528A21: message-id=<receipt-478991526@m.webstyle.ru>
Jun 26 23:23:32 mycustomernumber postfix/qmgr[3369]: 0A1FA1528A21: from=<>, size=2841, nrcpt=1 (queue active)
Jun 26 23:23:32 mycustomernumber postfix/smtpd[29979]: disconnect from localhost.localdomain[127.0.0.1]
Jun 26 23:23:32 mycustomernumber amavis[28598]: (28598-11) FWD via SMTP: <> -> <someuser@myserver.com>,BODY=7BIT 250 2.0.0 Ok, id=28598-11, from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as 0A1FA1528A21
Jun 26 23:23:32 mycustomernumber amavis[28598]: (28598-11) Passed CLEAN, [195.144.251.97] [195.144.251.97] <> -> <someuser@myserver.com>, Message-ID: <receipt-478991526@m.webstyle.ru>, mail_id: YakjkrdFq6A8, Hits: 2.249, size: 2197, queued_as: 0A1FA1528A21, 2882 ms
Jun 26 23:23:32 mycustomernumber postfix/smtp[29975]: 044991528995: to=<someuser@myserver.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=3.3, delays=0.39/0.01/0.01/2.9, dsn=2.0.0, status=sent (250 2.0.0 Ok, id=28598-11, from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as 0A1FA1528A21)
Jun 26 23:23:32 mycustomernumber postfix/qmgr[3369]: 044991528995: removed
Jun 26 23:23:33 mycustomernumber postfix/smtp[29980]: 0A1FA1528A21: to=<merle.rehmsen@hotmail.com>, orig_to=<someuser@myserver.com>, relay=mx3.hotmail.com[65.54.188.110]:25, delay=1.2, delays=0.15/0.02/0.51/0.55, dsn=2.0.0, status=sent (250  <receipt-478991526@m.webstyle.ru> Queued mail for delivery)
Jun 26 23:23:33 mycustomernumber postfix/qmgr[3369]: 0A1FA1528A21: removed
Jun 26 23:26:49 mycustomernumber postfix/anvil[29972]: statistics: max connection rate 1/60s for (smtp:195.144.251.97) at Jun 26 23:23:28
Jun 26 23:26:49 mycustomernumber postfix/anvil[29972]: statistics: max connection count 1 for (smtp:195.144.251.97) at Jun 26 23:23:28
Jun 26 23:26:49 mycustomernumber postfix/anvil[29972]: statistics: max cache size 1 at Jun 26 23:23:28

I can provide more info if you tell me what you need to know. Thank you for you help!

share|improve this question

2 Answers 2

Sounds like backscatter (and that log looks pretty innocent, certainly no relaying), meaning that messages would not be sent by your server, but an address in your domain would be used as a spoofed From: address.

Do any of the non-delivery report messages include the original message header? If so, you should be able to verify that the messages aren't being relayed through your system.

Unfortunately, controlling backscatter is pretty difficult if it's persistent. In my experience they usually back off of using a spoofed address after a matter of days or weeks, but it's very hard to block the messages without blocking legitimate NDR messages.

share|improve this answer
1  
Agreed, it doens't look like a relay attempt. In rare cases, you can get away with shutting down the TLD by doing a REJECT for it, although you end up blocking an entire country in the process. If there is no need to contact people in the .ru TLD, just put a temporary block for it that does a REJECT until the storm passes. After a week or two, just pull it out. –  Avery Payne Jun 27 '11 at 17:24

Do you searched for your ip in blacklists? For example you can do it here http://www.mxtoolbox.com/blacklists.aspx Also, virus from local network can send smap passing your server. Also, you can block destination tcp port 25 from local net on your firewall and then look in the log of who had sent to port 25

share|improve this answer
    
I also routinely check the output of pfloggsum for higher then normal defer counts to catch when one of my boxes has been blacklisted. –  Greeblesnort Jun 28 '11 at 13:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.