Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

As you will see I'm a newbie in Postfix. I use it through Webmin.

One of my server's user got his email account info stolen, and I found almost 100 000 emails in Postfix queue sent from this email - or to this email.

After I removed everything I found a few items in the queue which had neither as sender or dest an email belonging to a domain managed by the server (lots of yandex.ru). How is it possible? What should I change to prevent this to happen again? (sending emails from domains not managed by the server).

Also, is there a parameter to limit the number of emails sent by an individual account?

Many thanks!

UPDATE: Below is the config

enter image description here

share|improve this question
add comment

3 Answers

up vote 3 down vote accepted

First you should check your server relay stat whether it's open relay or secured using sasl authentication. And you use policyd to limit the mails sent by an individual account.

share|improve this answer
    
Thanks, but as I said I don't know Postfix or mailservers well, so I am not sure of what you mean by "server relay stat" or "policyd". –  Nabab Sep 12 '12 at 11:12
1  
server relay stat means your server is allow other mail server to relay mails or not and policyd is a tool to limit the mails sent by an account. –  user128296 Sep 12 '12 at 11:36
add comment

Check that your postfix server is open relay (many online tools).

If it is, do the following :

  • Stop postfix.
  • Fix the configuation.
  • Check if your server IP has been blacklisted.

Please don't run postfix on a server connected to the internet if you are a postfix newbie, you can :

  • Get skilled with postfix on computers that are disconnected from the internet (hint : Think of a home laptop whose outgoing and incoming port 25 tcp are closed by the firewall/isp).
  • Get someone skilled to do the job for you
  • Get "packaged" configurations of postfix (most vendors/distro double check they ship default postfix configuration that are not openrelay).

If your server is not open relay, you can start looking at hosted websites if any (search for unprotected contact forms...); mail logs (/var/log/mail.log) and tcpdump on port 25 can also contain valuable information.

share|improve this answer
add comment

The "sending emails from domains not managed by the server" happens bacause your system may be an "open relay". To prevent your system from being open relay add in /etc/postfix/main.cf:-

smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_sender_restrictions = reject_unknown_sender_domain

Next to "limit the number of emails sent by an individual account" you can see:-Policyd

It has sender based qoutas.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.