Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This week, someone started to send spam-mails through my postfix-smtp access (I verified by logging in through telnet from an arbitrary pc and sending mails with any ids myself) on my server, with recipient and target being guestuser@mydomain.com. Since I have a catchall and mail-fowarding to my google account, I received all those (many) mails.

After a lot of configuration (I lost track of what change did what, going through dozends of topics here and over the net) that hole seems fixed. Still, what hapened?

Does port 25 need to be open and accepting for my catchall to work?

What configuration did I do wrong?

I remember the first thing I changed (that had an effect) was the inet_interface setting in main.cf, only later to find out that if this does not say "all", my mail to mydomain.com does not get forwarded any more.

share|improve this question
2  
1) catch all doesn't affect the port 25. 2) you should set up postfix so that it only accepts mail for your domain and mail for other domains only if the user sending the mail is authenticated. –  Jure1873 Nov 22 '12 at 17:22
2  
I don't see anything in your question that indicates an actual configuration problem. The closest I can come up with is use of a catch-all email address, that will often result in getting a lot of spam. But, someone being able to send mail to your domain through port 25 does not indicate that there is a configuration problem, that's how mail is normally delivered. –  qqx Nov 22 '12 at 17:50
1  
Using a catchall is an all-round bad idea. If you're truly paranoid about someone potentially misspelling an email address then set up aliases for common misspellings, or turn on VRFY, or just bounce undeliverable messages back to the sender so they know they screwed up. –  Sammitch Nov 22 '12 at 22:35
    
After not being able to make anything else work, I removed the catchall and forward on a per-email-address basis. Maybe as an explanation why I used the catchall: I started to use somelogin@mydomain.com for many website logins, with different "somelogin"s - well, in order to better trace spam. –  Andreas Reiff Nov 23 '12 at 7:00
add comment

1 Answer 1

Port 25 needs to be open or you can't receive any mail - spam or otherwise. Other systems connect to this port on your server to send them, the same way you did with telnet. At this point, you will need to make sure that no one can connect to your mail server and drop of mail for other domains. Otherwise you will be an open relay and will soon discover that you can't sent any mails either because any mail from your server is automatically denied.

The solution to your spam-problem is to implement a spam-filter on your system. This is an advanced topic and lots of work, and hardly worth the hassle for a simple catch-all.

Quite honestly: Your primary problem is that you run a mail server at all and don't know what you are doing. The fix is either to learn how e-mail is working and how to run a mail server (tip: This is actually not easy at all) or to disable your mail server completely and let some hosting provider do this for you (if you really need this mail domain). As a start, you could read the wikipedia entry on SMTP.

share|improve this answer
    
Your judgement of me as of now is correct, I am afraid. Still, I am here to further my knowledge. And I did a lot of research, just came not up with a solution yet. I take it someone directly accessing the SMTP is basically the same as someone sending a Spam-Mail to the same Email-Address, which would then be handled by the same SMTP in the same way?! (Also tested for Open Relay, sending to an addresss on another server, which failed.) –  Andreas Reiff Nov 23 '12 at 6:57
    
I agree 100% with SvenW. You should not be running a mail server accessible from the internet without a real good background on the topic. There are excellent books on this. –  Floyd Dec 7 '12 at 17:56
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.