I have a small server at home, which has postfix installed. It's only use is to return the results of cronjobs and email out externally for a few other scripts. I use my ISP's mail server as a relay host. It recently came to my attention that the mail server was acting as an open relay. I fixed that problem by closing incoming port 25 on the router and reconfiguring postfix to only accept outcoming mail from the server. I have checked with nmap externally from the LAN and tried various open relay tools and everything seems fine.
The problem is that I am still getting mail trying to be sent. I have temporarily set the relay host to 127.0.0.3 (non-existent) to stop things being sent out and have set up iptable firewall rules on my server to prevent outbound port 25, so nothing is actually going out.
I thought the queues might still be full so I did:
sudo postsuper -d ALL deferred sudo postsuper -d ALL
But the mail keeps on coming in with the following log messages:
Dec 1 12:04:56 server postfix/pickup: E18411FA4: uid=33 from=
Dec 1 12:04:56 server postfix/cleanup: E18411FA4: message-id=<20111201120456.E18411FA4@server>
Dec 1 12:04:56 server postfix/qmgr: E18411FA4: from=, size=15619, nrcpt=1 (queue active)
Dec 1 12:04:57 server postfix/error: E18411FA4: to=, relay=none, delay=0.17, delays=0.1/0/0/0.08, dsn=4.4.1, status=deferred (delivery temporarily suspended: connect to 127.0.0.3[127.0.0.3]:25: Connection timed out)
So the question I have are:
- How to determine where the incoming mail is coming from? i.e. which program on the server or from which other ip-address.
- What other ways can I debug this problem?
- Do you think I've been hacked and my server is compromised?