My Postfix has gone wild. Am I hacked?

Question

Today, I found my server couldn't work because it was filled. I checked the logs and they had grown enormously, I deleted them so as things could work. now with current logs I'm seeing a lot of suspicious activity.

mail log

http://pastebin.com/TEMPSD6M

I also keep getting emails like this

http://pastebin.com/0XnELyrU

I've contacted admins at rackspace but they cannot offer me any help for unmanaged servers. I'm gutted and want to stop this wierd activity. any advice?

Answer 1

You have an open relay. Change the mynetworks variable to mynetworks = 127.0.0.1. Reset all passwords (just to make sure).

After that do a SMTP check for your server at http://mxtoolbox.com and look if it is still an open relay.

By the way reduce logging to the standard value. Another tip: paste the logs directly to this question next time, rewrite your question to plain readable(!) English. And accept answers to your former questions.

Edit

The logging can be reset to the default by (re)setting

debug_peer_level = 2
debug_peer_list =

(yes, the last line ends with the equal sign)

Edit 2

I forgot to mention the settings in master.cf where there maybe lines ending with smtpd -v or even more than one -v. Remove the -vs.

Answer 2

Looking at the log and postmaster email it seems like you're running an open relay - this is problem #1 that needs to be fixed. Not being a postfix guru I can only point you at the Postix relating and access control documentation.

Problem #2 is that you're out of disk space on whatever drive is queueing your mail -- You can probably fix this by dumping your postfix queue. (That I know how to do -- run the command postsuper -d ALL as root).

---

You must fix the open relay problem -- Open relays are bad for you and for the environment internet. If your server remains an open relay for any length of time you will be listed on a multitude of spam blocklists. Check your blacklist status on mxtoolbox or a similar site once you fix the problems above and take the necessary steps to clean up any mess that may have been made.

Answer 3

I used wireshack to find out script being used for mailing. It turned out to be my contact form. I've used reCAPTCHA to secure it. I would also like to share more knowledge on how I fixed it.

• I did what mailq and voretag7 suggested.
• modified this script I got on the Internet, to block those spamming IPs. create spamblock.sh, give proper admin permissions and ran it on a cron every 10mins

.

#!/bin/bash
IPT=/sbin/iptables
LIMIT=10
#cd /root/Filters
# first get one minute of log
grep "`date +"%b %d %H:%M:" --date="1 minutes ago"`" /var/log/maillog > minutelog
# now extract the rejected attempts, sort and count uniq ip
cat minutelog | grep "reject:" | cut -d" " -f10 | cut -d"[" -f2 | cut -d"]" -f 1 | sort | uniq -c | sort -n | sed 's/^[ \t]*//' > tmp1
# for each line in result
while read line
do
MYCOUNT=`echo $line | cut -d" " -f1`
MYIP=`echo $line | cut -d" " -f2`
if [ $MYCOUNT -lt $LIMIT ] ;
then
echo $MYIP is ok: $MYCOUNT attempts
else
echo blocking the spammer at $MYIP with $MYCOUNT attempts
$IPT -I INPUT -i eth0 --proto tcp -s $MYIP --destination-port 25 -j DROP
echo $MYIP >> blocked.smtp
fi
done < tmp1
rm -f minutelog
rm -f tmp1

• Created a script to periodically execute this command. to clear queues

.

postfix flush
postsuper -d ALL deferred

Before I found out what script it was, I recommend doing the above. Thanx for your help guys.