Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Someone is using my server (probably from insecure form) to send out mass spam email.

I had a look at mailq but I cannot seem to find out where to look in order to solve this issue.

Is there a way to track down where these spam emails are coming from?

I'm using CentOS and Postfix

This is part of my main.cf file:

sendmail_path = /usr/sbin/sendmail.postfix

# newaliases_path: The full pathname of the Postfix newaliases command.
# This is the Sendmail-compatible command to build alias databases.
#
newaliases_path = /usr/bin/newaliases.postfix

# mailq_path: The full pathname of the Postfix mailq command.  This
# is the Sendmail-compatible mail queue listing command.
#
mailq_path = /usr/bin/mailq.postfix

# setgid_group: The group for mail submission and queue management
# commands.  This must be a group name with a numerical group ID that
# is not shared with other accounts, not even with the Postfix account.
#
setgid_group = postdrop

# html_directory: The location of the Postfix HTML documentation.
#
html_directory = no

# manpage_directory: The location of the Postfix on-line manual pages.
#
manpage_directory = /usr/share/man

# sample_directory: The location of the Postfix sample configuration files.
# This parameter is obsolete as of Postfix 2.1.
#
sample_directory = /usr/share/doc/postfix-2.3.3/samples

# readme_directory: The location of the Postfix README files.
#
readme_directory = /usr/share/doc/postfix-2.3.3/README_FILES
virtual_mailbox_domains = $virtual_mailbox_maps, hash:/var/spool/postfix/plesk/virtual_domains
virtual_alias_maps = $virtual_maps, hash:/var/spool/postfix/plesk/virtual
virtual_mailbox_maps = hash:/var/spool/postfix/plesk/vmailbox
transport_maps = hash:/var/spool/postfix/plesk/transport
smtpd_tls_cert_file = /etc/postfix/postfix_default.pem
smtpd_tls_key_file = $smtpd_tls_cert_file
smtpd_tls_security_level = may
smtpd_use_tls = yes
smtp_tls_security_level = may
smtp_use_tls = no
mynetworks = 127.0.0.0/8, 10.1.11.34/32
smtpd_sender_restrictions = check_sender_access hash:/var/spool/postfix/plesk/blacklists, permit_sasl_authenticated, check_client_access pcre:/var/spool/postfix/plesk/non_auth.re
smtp_send_xforward_command = yes
smtpd_authorized_xforward_hosts = 127.0.0.0/8
smtpd_sasl_auth_enable = yes
smtpd_recipient_restrictions = permit_mynetworks, check_client_access pcre:/var/spool/postfix/plesk/no_relay.re, reject_unauth_destination
virtual_mailbox_base = /var/qmail/mailnames
virtual_uid_maps = static:110
virtual_gid_maps = static:31
virtual_transport = plesk_virtual
plesk_virtual_destination_recipient_limit = 1
share|improve this question
    
@MichaelHampton I've added my main.cf file –  John Kim Jan 24 '13 at 0:47
    
You don't seem to be an open relay. So it's probably one of your customers sending spam. First go check your logs for entries related to one (or more) of the spam messages that went out. –  Michael Hampton Jan 24 '13 at 0:51
    
F0CDD146E5B 694 Tue Jan 22 10:17:15 apache@exmapledomain.com.au (delivery temporarily suspended: host mx.dca.untd.com[64.136.44.37] refused to talk to me: 550 Access denied...5aa0f0ed8ded05055191c1703991791d50f9a4f9145519d550a4d550d5d4a5d46d84d49‌​4b9...) mnjcook1@netzero.com This is what I'm getting. Where can I check for log? –  John Kim Jan 24 '13 at 0:55

2 Answers 2

up vote 1 down vote accepted

In cases like this, it is best to look in /var/log/mail.log for answers. Once you have the mail id of a message, grepping for all corresponding entries can give you most of what you may need to look for.

> grep F0CDD146E5B mail.log

Also, for this server, it is important to look at more messages with the reject text like that shown above. If you are getting alot of these, you server IP address may be on a blacklist.

You can check blacklisting at MX Toolbox by entering the IP address that your server is presenting to other servers on the internet. Remember that a firewall can be used to map the address to something else so just be sure you know your public IP address.

For logging, postfix with typically be configured to use syslog. Run > postconf | grep log to see your syslog_facility variable and how it is configured. On an Ubuntu system this will be set to "mail".

For managing a queue with emails that you really don't want to deliver, you can use postsuper to delete these message and clean up your queue. If the messages themselves are not important, it can be a quick way to empty the queue. Typical syntax to delete one message is > postsuper -d [mail id]. Here is one article about using postsuper which also shows how to delete everything or using a pattern against mailq output.

share|improve this answer
    
I cannot find anything in the mail.log is there any other log that I can have a look at for Postfix? –  John Kim Jan 24 '13 at 1:15
    
/var/log/maillog might be another option. Where did you find that error you had posted above? –  Tim Koscielski Jan 24 '13 at 1:22
    
Through mailq command –  John Kim Jan 24 '13 at 1:30

I have gotten on blacklists because other systems that share the same NATed IP address with my mail server were sending out spam. If you have any kind of border control device (IPS, firewall, etc), check for other systems sending traffic to port 25 outbound. It is best practice to deny outbound SMTP unless it is coming from your mail server.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.