Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Today, I found my server couldn't work because it was filled. I checked the logs and they had grown enormously, I deleted them so as things could work. now with current logs I'm seeing a lot of suspicious activity.

mail log

http://pastebin.com/TEMPSD6M

I also keep getting emails like this

http://pastebin.com/0XnELyrU

I've contacted admins at rackspace but they cannot offer me any help for unmanaged servers. I'm gutted and want to stop this wierd activity. any advice?

share|improve this question
    
btw, those emails in log are unrecognisable –  Sir Lojik Aug 18 '11 at 20:54

3 Answers 3

up vote 20 down vote accepted

You have an open relay. Change the mynetworks variable to mynetworks = 127.0.0.1. Reset all passwords (just to make sure).

After that do a SMTP check for your server at http://mxtoolbox.com and look if it is still an open relay.

By the way reduce logging to the standard value. Another tip: paste the logs directly to this question next time, rewrite your question to plain readable(!) English. And accept answers to your former questions.

Edit

The logging can be reset to the default by (re)setting

debug_peer_level = 2
debug_peer_list =

(yes, the last line ends with the equal sign)

Edit 2

I forgot to mention the settings in master.cf where there maybe lines ending with smtpd -v or even more than one -v. Remove the -vs.

share|improve this answer
    
ive done all you've said but it appears its still acting as an open relay. check last comment –  Sir Lojik Aug 18 '11 at 22:08
    
serverfault.com/questions/302818/… the mailqueue keeps growing regardless check pastebin.com/Rm6vdaUL –  Sir Lojik Aug 18 '11 at 23:35
    
Thanks for posting the resolution on your contact form, adding RECAPTCHA is always a good idea! Also, I wanted to thank everyone for using our tools, we are always looking for additional tools to add, if you have any ideas please let us know! –  user23090 Aug 19 '11 at 16:24

Looking at the log and postmaster email it seems like you're running an open relay - this is problem #1 that needs to be fixed. Not being a postfix guru I can only point you at the Postix relating and access control documentation.

Problem #2 is that you're out of disk space on whatever drive is queueing your mail -- You can probably fix this by dumping your postfix queue. (That I know how to do -- run the command postsuper -d ALL as root).


You must fix the open relay problem -- Open relays are bad for you and for the environment internet. If your server remains an open relay for any length of time you will be listed on a multitude of spam blocklists. Check your blacklist status on mxtoolbox or a similar site once you fix the problems above and take the necessary steps to clean up any mess that may have been made.

share|improve this answer
    
hi guys how do i reduce postfix logging to a minimum –  Sir Lojik Aug 18 '11 at 21:29
    
@SirLojik - Refer to Chapter 1, Verse 9 of the Postfix Documentation ( postfix.org/BASIC_CONFIGURATION_README.html#syslog_howto ) for information on Postfix logging :) –  voretaq7 Aug 18 '11 at 21:36
    
Guys ive done what mailq said and voretaq7, but every time i run postsuper -d ALL i keep geeting more mail deleted from queue. it seems its still acting as an open relay. when i run postqueue -p i get this pastebin.com/P8pvKpP5 –  Sir Lojik Aug 18 '11 at 22:05
    
So what is in the logs, after reducing the log level (as posted above)? Create a new question with "How to close an open relay in Postfix?" And please follow the advices given above before. Even the very helpful (first) link of @voretaq7! –  mailq Aug 18 '11 at 22:11

I used wireshack to find out script being used for mailing. It turned out to be my contact form. I've used reCAPTCHA to secure it. I would also like to share more knowledge on how I fixed it.

  • I did what mailq and voretag7 suggested.
  • modified this script I got on the Internet, to block those spamming IPs. create spamblock.sh, give proper admin permissions and ran it on a cron every 10mins

.

#!/bin/bash
IPT=/sbin/iptables
LIMIT=10
#cd /root/Filters
# first get one minute of log
grep "`date +"%b %d %H:%M:" --date="1 minutes ago"`" /var/log/maillog > minutelog
# now extract the rejected attempts, sort and count uniq ip
cat minutelog | grep "reject:" | cut -d" " -f10 | cut -d"[" -f2 | cut -d"]" -f 1 | sort | uniq -c | sort -n | sed 's/^[ \t]*//' > tmp1
# for each line in result
while read line
do
MYCOUNT=`echo $line | cut -d" " -f1`
MYIP=`echo $line | cut -d" " -f2`
if [ $MYCOUNT -lt $LIMIT ] ;
then
echo $MYIP is ok: $MYCOUNT attempts
else
echo blocking the spammer at $MYIP with $MYCOUNT attempts
$IPT -I INPUT -i eth0 --proto tcp -s $MYIP --destination-port 25 -j DROP
echo $MYIP >> blocked.smtp
fi
done < tmp1
rm -f minutelog
rm -f tmp1
  • Created a script to periodically execute this command. to clear queues

.

postfix flush
postsuper -d ALL deferred

Before I found out what script it was, I recommend doing the above. Thanx for your help guys.

share|improve this answer
3  
I have to explicitly warn everybody to do what Sir Lojik recommends as workaround! Cleaning the queues in production leads to mail loss! Dropping connections based on mail server rejects leads to a self-made DoS! –  mailq Aug 19 '11 at 14:46
    
I can encourage everybody to get rid of the real problem by removing malicious scripts. –  mailq Aug 19 '11 at 14:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.