Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have problem When I am check my Mail.log , my postfix seem send random mail to random users, and I don't understand why like this, I assumsed this is spam.

I am never create some script to send message like this log, and my postfix no open relay and using authentication username and password, that log like user can sendmail without password.

someone can suggestion me ? what happen with my postfix and how I can fix that?

note : I have some web application (wordpress) in my server.

this is my mail.log , I have been edit my domain in to mydomain.com .

Sep 12 13:20:56 dev postfix/qmgr[2252]: 026EA19AD97: from=<>, size=3138, nrcpt=1 (queue active)
Sep 12 13:20:56 dev postfix/qmgr[2252]: 98D1E19AD94: removed
Sep 12 13:20:56 dev postfix/smtp[3117]: B119619AD9D: to=<lukenlizforever@hotmail.com>, relay=mx2.hotmail.com[65.55.92.184]:25, delay=1.4, delays=0/0/0.83/0.59, dsn=5.0.0, status=bounced (host mx2.hotmail.com[65.55.92.184] said: 550 Requested action not taken: mailbox unavailable (in reply to RCPT TO command))
Sep 12 13:20:56 dev postfix/cleanup[3748]: 65E4419AD94: message-id=<20130912062056.65E4419AD94@mydomain.com>
Sep 12 13:20:56 dev postfix/bounce[3552]: B119619AD9D: sender non-delivery notification: 65E4419AD94
Sep 12 13:20:56 dev postfix/qmgr[2252]: 65E4419AD94: from=<>, size=3178, nrcpt=1 (queue active)
Sep 12 13:20:56 dev postfix/qmgr[2252]: B119619AD9D: removed
Sep 12 13:20:56 dev postfix/smtp[3121]: 0335819AD93: to=<lukenl@hotmail.com>, relay=mx2.hotmail.com[65.55.92.152]:25, delay=1.6, delays=0/0/0.79/0.83, dsn=2.0.0, status=sent (250  <20130912062054.DFDB119AD7D@mydomain.com> Queued mail for delivery)

here I am testing open relay from http://mxtoolbox.com/ enter image description here

and this is the warning from http://mxtoolbox.com/ enter image description here

share|improve this question
    
But seems to be an open relay. Do a test. –  Pazi ツ Sep 12 '13 at 6:46
    
I have been test and update my screenshot, I think my problem is about postfix.org/BACKSCATTER_README.html Backscatter, but I have follow like that link, it's still same.. –  viyancs Sep 12 '13 at 6:51
    
I suspect your server is compromised and someone is using it to send spam. The consecutive alphabetical email addresses appear to support this. How many of these unknown emails have been sent? (Use grep -c "status=\(sent\|bounced\)" mail.log). You can see the contents of mail in the mail queue with postcat /var/spool/postfix/deferred/B/B119619AD9D. You can find out more about where it's coming from by finding a connection from line in your log. –  Ladadadada Sep 12 '13 at 7:14
4  
I also find it amusing that Luke and Liz obviously didn't last forever because their email address is bouncing. –  Ladadadada Sep 12 '13 at 7:15
    
Can also be a unsecure web application.. –  Pazi ツ Sep 12 '13 at 7:18
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.