Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have Postfix mail server. The mail server was spamming from an unexisting mail address so i used sender_restrictions in main.cf and sender_access (to discard mail from that mail address). Now the spam mail is sent through sendmail. See the log below.

May 17 17:21:50 ABC postfix/smtpd[1220]: connect from localhost.localdomain[127.0.0.1] 

May 17 17:21:50 ABC postfix/smtpd[1220]: setting up TLS connection from localhost.localdomain[127.0.0.1] 

May 17 17:21:50 ABC postfix/smtpd[1220]: TLS connection established from localhost.localdomain[127.0.0.1]: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits) 

May 17 17:21:50 ABC sendmail[1235]: STARTTLS=client, relay=[127.0.0.1], version=TLSv1/SSLv3, verify=FAIL, cipher=DHE-RSA-AES256-SHA, bits=256/256 

May 17 17:21:50 ABC postfix/smtpd[1220]: NOQUEUE: discard: RCPT from
localhost.localdomain[127.0.0.1]: <software@ABC>: Sender address triggers DISCARD action; from=<software@ABC> to=<hcoommontest@rubop.com> proto=ESMTP helo=<ABC> 

May 17 17:21:50 ABC postfix/smtpd[1220]: 623C21770846:
client=localhost.localdomain[127.0.0.1], sasl_sender=software@ABC 

May 17 17:21:50 ABC sendmail[1235]: q4HBpl9d001235:
to=hcoommontest@rubop.com, ctladdr=software (504/504), delay=00:00:03, xdelay=00:00:00, mailer=relay, pri=30120, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (Ok: queued as 623C21770846)

I want to block this mail.

share|improve this question

3 Answers 3

You have not fully uninstalled Eric Allman's sendmail package.

This is evidenced by the fact that the log still shows you using the sendmail package's sendmail binary - this should have been replaced with the postfix sendmail binary.

Revisit your installation procedure and correct this error.

Moreover, you should never DISCARD mail unless there is no other option.

In this case, you should REJECT the sender instead.

share|improve this answer
    
Thanks for the reply....I have stopped the sendmail service. DISCARD mail option is because it is spam going out from server...... –  bharath145 Jun 22 '12 at 3:46

You need to scan your system for viruses/malware. Spam is originating from the server itself!

See here:

May 17 17:21:50 ABC postfix/smtpd[1220]: connect from localhost.localdomain[127.0.0.1] 

As you can see spam is coming from 127.0.0.1 which is the loopback addess i.e. the same server, so there's no point in blocking sender address, you need to cleanup your server.

Does your server has a webserver, too? Might easily be a malicious script sending spam. If not probably someone got ssh access to the server (password guessing maybe?).

share|improve this answer
    
Thanks for the reply.... As a temporary workaround how can i restrict...as it sending only from one user (software) –  bharath145 May 18 '12 at 5:55
    
@bharath145 If you are sure that is just one user (as in a user in the /etc/passwd file you can block it via iptables, see here: cyberciti.biz/tips/… –  Mr Shunz May 18 '12 at 7:37
    
If the local mail is submitted via SMTP, there is every reason to restrict sender addresses. In fact, since he is already using (or at least has ocnfigured) submission, he should deny SMTP on the loopback address altogether - real mail comes from the outside. –  adaptr May 18 '12 at 15:36

Wikipedia has some good tips on limiting outbound spam: http://en.wikipedia.org/wiki/Anti-spam_techniques#Outbound_spam_protection. In a nutshell:

  • Take measures to get to know your users, and prevent spammers from compromising user accounts. For instance, install fail2ban and track bad login attempts to thwart brute-force password compromise.

  • Pass your outbound spam traffic through a filter (SpamAssassin is great), and then grok the SpamAssassin logs to look for the sender addresses that are causing problems. These are probably compromised in some way.

I hope this helps. It's a tough problem area.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.