Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I got a report from my root server provider of abuse - someone has been sending phishing mail through my server's Postfix (the headers originate from my server's IP). What should I check for? The server itself doesn't seem to be hacked.

share|improve this question
    
It doesn't need to be hacked if it is misconfigured - try spamhelp.org/shopenrelay –  symcbean Jun 14 '12 at 15:11

1 Answer 1

up vote 2 down vote accepted

inspecting full headers of phishing mails can contains some clues. there are few options:

  • messages came from your server and via postifx - then you should be able to find corresponding entries in postfix log
  • messages came from your server but not via postfix - maybe there was some rouge code that implemented own smtp sender or maybe someone relied ip traffic via your server [think ssh tunnel]
  • messages never passed your box [i doubt it's the case but it's possible to hijack a route]
share|improve this answer
    
It's the first case –  Kornel Kisielewicz Jun 14 '12 at 13:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.