Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm having some issues with a mail server.

Every 5 minutes, I see a list of about a hundred lines like the following (taken from /var/log/maillog):

Mar 31 15:03:59 hostname postfix/qmgr[19856]: 75588C1CEE: from=<user@mydomain.com>, size=6859, nrcpt=9 (queue active)
Mar 31 15:03:59 hostname postfix/qmgr[19856]: 7E16FC203A: from=<userh@mydomain.com>, size=8345, nrcpt=8 (queue active)
Mar 31 15:03:59 hostname postfix/qmgr[19856]: 732D9C11EC: from=<user@mydomain.com>, size=5250, nrcpt=11 (queue active)

Where user@mydomain.com is the email address of one my users.

Here's my main.cf file:

queue_directory = /var/spool/postfix
command_directory = /usr/sbin
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
mail_owner = postfix
myhostname = hostname.mydomain
mydomain = mydomain
myorigin = $mydomain
inet_interfaces = localhost
inet_protocols = all
mydestination = $myhostname, localhost.$mydomain, localhost
unknown_local_recipient_reject_code = 550
mynetworks = 127.0.0.0/8, [::1]/128
alias_maps = hash:/etc/aliases
header_checks = regexp:/etc/postfix/header_checks
debug_peer_level = 2
debugger_command =
         PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
         ddd $daemon_directory/$process_name $process_id & sleep 5
sendmail_path = /usr/sbin/sendmail.postfix
newaliases_path = /usr/bin/newaliases.postfix
mailq_path = /usr/bin/mailq.postfix
setgid_group = postdrop
html_directory = no
manpage_directory = /usr/share/man
bounce_queue_lifetime = 6h
mailbox_size_limit = 51200000
message_size_limit = 10240000
luser_relay =
recipient_delimiter = +
message_strip_characters = \0
broken_sasl_auth_clients = yes
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $mydomain
smtpd_use_tls = yes
smtpd_tls_cert_file = /etc/postfix/cert.pem
smtpd_tls_key_file = /etc/postfix/key.pem
smtpd_tls_loglevel = 1
smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination
mailbox_transport = mailpostfilter
content_filter = mailprefilter
transport_maps = hash:/etc/postfix/transport
virtual_alias_maps = $alias_maps, $virtual_maps, ldap:/etc/postfix/zarafa-aliases.cf, ldap:/etc/postfix/zarafa-groups.cf
local_recipient_maps = $alias_maps $virtual_alias_maps
zarafa_destination_recipient_limit = 1
relayhost =

Is there anything I can do to stop the massive number of emails that are showing up in the log?

share|improve this question
3  
Figure out what they're doing and cut their account if they're spamming? –  Michael Hampton Mar 31 '13 at 19:29

2 Answers 2

up vote 0 down vote accepted

For starters you should check those messages that are in the queue to see what this is all about. postqueue is your friend there. Make a note where the messages originate, in case your MTA is responsible for the email on a whole network (which seems to be the case). Investigate on that host for the origin of the messages themselves.

Next thing I would suspend that particular user account for the investigation. Check all possible sources you can think of in your scenario, such as cron jobs, other kinds of scripts, externally triggered (e.g. via a website) scripts.

Once you figured out what is the cause and cut it off, make sure to put rate limiting in place. anvil is the responsible component in Postfix and there are various settings you can tune to limit outgoing and incoming email via main.cf, see this README.

Note: let's assume for a moment that there are no messages in the queue left, enforce the rate limit as a first step before you start the investigation of what's in the queue.

share|improve this answer
    
It turns out it was a bunch of undeliverable emails stuck in the queue. Postfix was attempting to resend them every 5 minutes. Thanks for your help! –  amillerrhodes Apr 1 '13 at 22:46

(I assume you're not an open relay)

If you are hosting any kind of PHP pages then take a close look at them.

This can be caused by a webpage being exploited. Web page exploits are commonly used to send spam.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.