I'm still learning using linux, so please bear with me.
I have a setup on a debian server, with Virtualmin using Postfix for mail.
It's just a standard Virtualmin setup and everything has basically worked as I needed it to.
Now, all of a sudden I experienced that my mailqueue size exploded, taking up all of my disk space. Sadly, someone is using my server as an open mail relay for spamming hotmail, yahoo and similar accounts.
My problem is that I have no idea as how to stop it - or how they are sending the mails.
I did a postconf -n and this is what my config says:
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
allow_percent_hack = no
append_dot_mydomain = no
biff = no
broken_sasl_auth_clients = yes
config_directory = /etc/postfix
home_mailbox = Maildir/
inet_interfaces = all
mailbox_command = /usr/bin/procmail-wrapper -o -a $DOMAIN -d $LOGNAME
mailbox_size_limit = 0
mydestination = Debian-60-squeeze-64-minimal, digitalstorm.dk, localhost.dk, localhost
myhostname = digitalstorm.dk
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
readme_directory = no
recipient_delimiter = +
sender_bcc_maps = hash:/etc/postfix/bcc
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
smtpd_client_restrictions = permit_mynetworks permit_inet_interfaces reject_unknown_reverse_client_hostname permit_tls_all_clientcerts
smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination reject_unknown_reverse_client_hostname
smtpd_sasl_auth_enable = yes
smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes
transport_maps = hash:/etc/postfix/transport
virtual_alias_maps = hash:/etc/postfix/virtual
I get mail.log entries like these:
Mar 11 14:50:06 www postfix/qmgr[5577]: 67B4E15E638: from=<catalystcode@digitalstorm.dk>, size=36335, nrcpt=1 (queue active)
Mar 11 14:50:06 www postfix/smtp[5609]: DA8DD1A58DF: host mailin-02.mx.aol.com[205.188.190.1] refused to talk to me: 421 mtain-de04.r1000.mx.aol.com Service unavailable - try again later
Mar 11 14:50:07 www postfix/error[5771]: 6A27810CB59: to=<rickblackstalker@yahoo.com>, relay=none, delay=4727, delays=4726/0.98/0/0.58, dsn=4.7.0, status=deferred (delivery temporarily suspended: host mta6.am0.yahoodns.net[67.195.103.232] refused to talk to me: 421 4.7.0 [TS01] Messages from 78.47.152.115 temporarily deferred due to user complaints - 4.16.55.1; see http://postmaster.yahoo.com/421-ts01.html)
Mar 11 14:50:07 www postfix/qmgr[5577]: 68C8B16F079: from=<catalystcode@digitalstorm.dk>, size=43281, nrcpt=1 (queue active)
I tried disabling all my virtual hosts to verify if maybe a bad PHP script was causing it. But no, the mails kept flying through.
Now, I have no idea where to continue searching or how to close this hole.
Can someone point me in the right direction?
