Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm still learning using linux, so please bear with me.

I have a setup on a debian server, with Virtualmin using Postfix for mail.

It's just a standard Virtualmin setup and everything has basically worked as I needed it to.

Now, all of a sudden I experienced that my mailqueue size exploded, taking up all of my disk space. Sadly, someone is using my server as an open mail relay for spamming hotmail, yahoo and similar accounts.

My problem is that I have no idea as how to stop it - or how they are sending the mails.

I did a postconf -n and this is what my config says:

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
allow_percent_hack = no
append_dot_mydomain = no
biff = no
broken_sasl_auth_clients = yes
config_directory = /etc/postfix
home_mailbox = Maildir/
inet_interfaces = all
mailbox_command = /usr/bin/procmail-wrapper -o -a $DOMAIN -d $LOGNAME
mailbox_size_limit = 0
mydestination = Debian-60-squeeze-64-minimal, digitalstorm.dk, localhost.dk, localhost
myhostname = digitalstorm.dk
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
readme_directory = no
recipient_delimiter = +
sender_bcc_maps = hash:/etc/postfix/bcc
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
smtpd_client_restrictions = permit_mynetworks permit_inet_interfaces reject_unknown_reverse_client_hostname permit_tls_all_clientcerts
smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination reject_unknown_reverse_client_hostname
smtpd_sasl_auth_enable = yes
smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes
transport_maps = hash:/etc/postfix/transport
virtual_alias_maps = hash:/etc/postfix/virtual

I get mail.log entries like these:

Mar 11 14:50:06 www postfix/qmgr[5577]: 67B4E15E638: from=<catalystcode@digitalstorm.dk>, size=36335, nrcpt=1 (queue active)
Mar 11 14:50:06 www postfix/smtp[5609]: DA8DD1A58DF: host mailin-02.mx.aol.com[205.188.190.1] refused to talk to me: 421 mtain-de04.r1000.mx.aol.com Service unavailable - try again later
Mar 11 14:50:07 www postfix/error[5771]: 6A27810CB59: to=<rickblackstalker@yahoo.com>, relay=none, delay=4727, delays=4726/0.98/0/0.58, dsn=4.7.0, status=deferred (delivery temporarily suspended: host mta6.am0.yahoodns.net[67.195.103.232] refused to talk to me: 421 4.7.0 [TS01] Messages from 78.47.152.115 temporarily deferred due to user complaints - 4.16.55.1; see http://postmaster.yahoo.com/421-ts01.html)
Mar 11 14:50:07 www postfix/qmgr[5577]: 68C8B16F079: from=<catalystcode@digitalstorm.dk>, size=43281, nrcpt=1 (queue active)

I tried disabling all my virtual hosts to verify if maybe a bad PHP script was causing it. But no, the mails kept flying through.

Now, I have no idea where to continue searching or how to close this hole.

Can someone point me in the right direction?

share|improve this question
    
And postfix is stopped to avoid further damage. –  Repox Mar 11 '12 at 15:50
    
check smtpd_client_restrictions and smtpd_recipient_restrictions in postfix documentation. –  Jure1873 Mar 11 '12 at 16:05
    
@Jure I tried several settings with that, but it seems like mails still getting through. –  Repox Mar 11 '12 at 17:47
    
I would recommend starting to see, whether your postfix is really accepting every email or how did the spams get into it. That mail.log entry is from your server sending the mail unsucesfully, you need to find the part where it got into the system. You could start with grepping the log using '6A27810CB59' as pattern. You can also test your SMTP server using telnet. –  Radek Hladík Mar 12 '12 at 1:19
    
And I forgot to mention that you need to clear the mails that are already in the queue. –  Radek Hladík Mar 12 '12 at 1:20
add comment

1 Answer

up vote 0 down vote accepted

I finally found that the problem wasn't with my Postfix configuration. I had a shell account which was compromised that allowed the intruder to send the mails directly from commandline.

share|improve this answer
    
its not good idea that users have shell acount on mail server –  B14D3 Mar 15 '12 at 7:22
    
I agree with you; shell accounts has also been closed now. –  Repox Mar 15 '12 at 8:39
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.