1

I have a small server at home, which has postfix installed. It's only use is to return the results of cronjobs and email out externally for a few other scripts. I use my ISP's mail server as a relay host. It recently came to my attention that the mail server was acting as an open relay. I fixed that problem by closing incoming port 25 on the router and reconfiguring postfix to only accept outcoming mail from the server. I have checked with nmap externally from the LAN and tried various open relay tools and everything seems fine.

The problem is that I am still getting mail trying to be sent. I have temporarily set the relay host to 127.0.0.3 (non-existent) to stop things being sent out and have set up iptable firewall rules on my server to prevent outbound port 25, so nothing is actually going out.

I thought the queues might still be full so I did:

sudo postsuper -d ALL deferred
sudo postsuper -d ALL

But the mail keeps on coming in with the following log messages:

Dec 1 12:04:56 server postfix/pickup[3267]: E18411FA4: uid=33 from=
Dec 1 12:04:56 server postfix/cleanup[3274]: E18411FA4: message-id=<20111201120456.E18411FA4@server>
Dec 1 12:04:56 server postfix/qmgr[3268]: E18411FA4: from=, size=15619, nrcpt=1 (queue active)
Dec 1 12:04:57 server postfix/error[3304]: E18411FA4: to=, relay=none, delay=0.17, delays=0.1/0/0/0.08, dsn=4.4.1, status=deferred (delivery temporarily suspended: connect to 127.0.0.3[127.0.0.3]:25: Connection timed out)

So the question I have are:

  1. How to determine where the incoming mail is coming from? i.e. which program on the server or from which other ip-address.
  2. What other ways can I debug this problem?
  3. Do you think I've been hacked and my server is compromised?
0

2 Answers 2

4

uid 33 is by default www-data in Debian, and is used by Apache. Do you happen to run a web server and some PHP applications with it? Perhaps there's a mail form or something else that can be used for spamming? See the client IP from Apache access log if this is the case, though probably you are being attacked by a random botnet so blocking individual IPs won't help.

You are not necessarily hacked and compromised at all, most likely there's just a vulnerable PHP script which can be used for spamming. Of course it's better to be cautious and check all the corners for other suspicious activity, but this is my guess.

Updating that web application, removing it, or restricting access to it should solve your problem. You might also want to take a look at mod_security, although it might be way too heavy for simple use.

2
  • uid 33 = www-data user! I checked it on my ubuntu machine. That's right!
    – Khaled
    Dec 1, 2011 at 13:29
  • You're right it was the web server. I had a copy of zenphoto running and apparently it has recently been exploited widely through an exploit in a third party plugin. I turned off the web server and the mails have stopped. Now to clean up the mess.
    – yoda230
    Dec 1, 2011 at 14:47
1
Dec  1 12:04:56 server postfix/pickup[3267]: E18411FA4: uid=33 from=<[email protected]>

This is a local submission, i.e. by an account on the postfix machine.
Its UID is 33; consult /etc/passwd to find out which account this is.

You can control local submission by configuring authorized_submit_users in main.cf.

Apart from the obvious (disconnect machine from the internet, make a snapshot of your log and tmp dirs, and investigate offline), you are messing around with too many variables at once - for instance, closing both port 25 on the router AND disabling port 25 submission in postfix is unnecessary, and can only confuse you later.

Try to limit yourself to making one change at a time, testing it thoroughly, and then undoing it and trying another change.

Not the answer you're looking for? Browse other questions tagged .