Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We seem to be having a lot of spam emails in our mail.log file. For example

Mar 11 18:23:01 localhost postfix/qmgr[1452]: 87945226BD: removed
Mar 11 18:23:01 localhost postfix/smtp[8809]: 87945226BD: to=<rtaergyrsdwadghfc@gmail.com>, relay=email-smtp.us-east-1.amazonaws.com[xxx.xxx.xxx.xxx]:25, delay=1.6, delays=0.02/0.03/0.78/0.75, dsn=2.0.0, status=sent (250 Ok 0000013d5ab120a5-11d24ebe-f43a-4b98-82a3-9ffcb03a6d93-000000)



Mar 11 18:16:10 localhost postfix/smtp[8678]: 36032226BE: to=<s4or118a12@titanemail.info>, relay=email-smtp.us-east-1.amazonaws.com[xx.xx.xx.xx]:25, delay=1.2, delays=0.01/0/0.81/0.4, dsn=2.0.0, status=sent (250 Ok)
Mar 11 18:16:09 localhost postfix/qmgr[1452]: A232E226BD: removed
Mar 11 18:16:09 localhost postfix/qmgr[1452]: 36032226BE: from=<>, size=3015, nrcpt=1 (queue active)
Mar 11 18:16:09 localhost postfix/bounce[8681]: A232E226BD: sender non-delivery notification: 36032226BE
Mar 11 18:16:09 localhost postfix/cleanup[8676]: 36032226BE: message-id=<20130311181609.36032226BE@ip-10-32-0-15.eu-west-1.compute.internal>

Our current setup uses Amazon SES with two or three verified domains so I am not too sure why these are saying 'sent'.

Is is worth blocking them via iptables? If yes, then how would we do that, since it's not showing their ip address?

Any help or advice appreciated.

UPDATE

I can confirm the email addresses above are spam (checked them against some spam forums).

About the Open Relay configuration, we checked our IP against this test here open relay test and it passed.

Here is our main.cf file, without the comments:

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
config_directory = /etc/postfix
delay_warning_time = 4h
disable_vrfy_command = yes
inet_interfaces = all
mailbox_size_limit = 0
maximal_backoff_time = 8000s
maximal_queue_lifetime = 7d
minimal_backoff_time = 1000s
mydestination = ip-10-32-0-15.eu-west-1.compute.internal, localhost.eu-west-1.compute.internal, , localhost
myhostname = ip-10-32-0-15.eu-west-1.compute.internal
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mynetworks_style = host
myorigin = /etc/mailname
readme_directory = no
recipient_delimiter = +
relayhost = email-smtp.us-east-1.amazonaws.com:25
smtp_helo_timeout = 60s
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
smtp_tls_note_starttls_offer = yes
smtp_tls_security_level = encrypt
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtp_use_tls = yes
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
smtpd_client_restrictions = reject_rbl_client sbl.spamhaus.org, reject_rbl_client blackholes.easynet.nl, reject_rbl_client dnsbl.njabl.org
smtpd_data_restrictions = reject_unauth_pipelining
smtpd_delay_reject = yes
smtpd_hard_error_limit = 12
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks, warn_if_reject reject_non_fqdn_hostname, reject_invalid_hostname, permit
smtpd_recipient_limit = 16
smtpd_recipient_restrictions = reject_unauth_pipelining, permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_unauth_destination, check_policy_service inet:127.0.0.1:10023, permit
smtpd_sender_restrictions = permit_mynetworks, warn_if_reject reject_non_fqdn_sender, reject_unknown_sender_domain, reject_unauth_pipelining, permit
smtpd_soft_error_limit = 3
smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes
unknown_local_recipient_reject_code = 450
share|improve this question

2 Answers 2

up vote 0 down vote accepted

The short answer is No.

About IP addresses, it should show them in the mail.log - grep for "connect from" string [grep "connect from" mail.log|grep -v localhost]

If you are inclined to black list IPs on your own you can actually use "check_client_access" to both white and black list IPs and domain names.

Lastly you can use pflogsumm ("Postfix Log Entry Summarizer") to get a list of IPs summarized by counts besides a host of other information. If you are running your own mail server it servers well to cron this report to run daily to get a summary of what is going on with your server.

So the long answer is, you already have a good blocking mechanism, why bother with fitting in these IPs and spending your time.

share|improve this answer

Looks like you've got open relay configuration - close it. You can try to check SPF + DKIM or use DSPAM to cut off spam messages.

share|improve this answer
    
How can you tell? There are no email addresses listed (oops). –  Michael Hampton Mar 11 '13 at 20:05
    
Can you paste your main.cf file here..? –  Abhishek Anand Amralkar Mar 11 '13 at 20:11
    
I've updated the answer. Cheers for your help –  Titi Dumi Mar 12 '13 at 9:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.