Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I was browsing the logs and I noticed the undesired mails are sent through my server. How to prevent this?

Log

Jun 24 18:29:31 mail postfix/pickup[13853]: 6BD3D17012CB: uid=65534 from= edmondo@ferrettispa.it>

Jun 24 18:29:31 mail postfix/cleanup[13901]: 6BD3D17012CB: message-id=<00bb01ce70f9$def3a480$201e000a@69.lv>

Jun 24 18:29:31 mail postfix/qmgr[13854]: 6BD3D17012CB: from=<edmondo@ferrettispa.it>, size=1145, nrcpt=1 (queue active)

Jun 24 18:29:33 mail postfix/smtp[13906]: 6BD3D17012CB: to=<carlo.dago@istruzione.it>, relay=mx.sidi.istruzione.it[89.97.132.171]:25, delay=2.5, delays=0.14/0/0.14/2.3, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as CB89D50096)

Jun 24 18:29:33 mail postfix/qmgr[13854]: 6BD3D17012CB: removed

main.cf

smtpd_sender_restrictions =     hash:/etc/postfix/access,
                                permit_mynetworks,
                                reject_non_fqdn_sender,
                                reject_unknown_sender_domain,
                                permit
smtpd_client_restrictions = check_client_access hash:/etc/postfix/access

smtpd_recipient_restrictions = check_recipient_access hash:/etc/postfix/access,
                               check_sender_access hash:/etc/postfix/access,
                               permit_mynetworks,
                               permit_sasl_authenticated,
                               reject_non_fqdn_hostname,
                               reject_invalid_hostname,
                                reject_non_fqdn_sender,
                                reject_unknown_sender_domain
                                reject_non_fqdn_recipient,
                                reject_unknown_recipient_domain,
                                reject_unauth_destination,
                               reject_unknown_recipient_domain,
#                              check_policy_service inet:127.0.0.1:10023,
                               reject_rbl_client list.dsbl.org,
                                reject_rbl_client sbl.spamhaus.org,
                                reject_rbl_client cbl.abuseat.org,
                                reject_rbl_client dul.dnsbl.sorbs.net,
share|improve this question
add comment

1 Answer 1

Your mail server has been cracked. Notice the "pickup" service in the log? That means that message has been locally injected (by uid 65534), and not received via tcp/25 SMTPD port, so no amount of SMTPD restrictions will have any effect.

You could disable pickup service in master.cf, but that would disable all local clients sending mail, and attacker could circumvent it by connecting to localhost:25 instead. Then you'd also have to disable relaying ALL mails from localhost (by removing all entries that match that host from mynetworks in main.cf - anything that starts with "127." or "[::1]" meaning localhost, as well as any other IPs/hostnames matching your host)

(the real answer is to fix the bug through which attacker gained access to your system, and remove any backdoors)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.