Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've had some serious spam issues with my local postfix installation, until I found out that there was a postfix user wich was allowed to relay mails (I still don't know why this was possible in the first place, as relaying was closed for the whole server)..

I disallowed submitting mails for this user.

Anyway, my problem now is to figure out the IP address which still tries to connect to my server and to relay mails.

The log (mail.info and mail.err) shows this:

Jan 5 15:16:29 mailservername postfix/sendmail[9907]: fatal: User username(12345) is not allowed to submit mail

But it doesn't log an IP address anywhere.

Can someone tell me how to log that IP address?

Oh and if someone has an idea why a single user can relay mails despite the fact that relaying is closed, I'd be very grateful, too :)

Thanks in advance and best, Julian

share|improve this question
    
Have you looked for instructions about this in the postfix documentation? –  Andrew Schulman Jan 5 at 14:49
    
Sure, but couldn't find anything specific. Do you have a link to a certain section or anything else for me? :-\ –  Julian Jan 5 at 15:31
1  
Maybe it's a local user/script which trys to send mails. When sending mail (ex. with local mail command) your logfile doesn't include an ip address. –  deagh Jan 5 at 17:22
    
Thanks! But is there any way to find out which script may cause this trouble? –  Julian Jan 5 at 19:11

1 Answer 1

up vote 0 down vote accepted

This is a local mail submission, as evident by the "sendmail" part of the log message. Unlike an incoming network connection (which would contain "smtpd" as the logging subsystem), there is no way for postfix to determine - reliably - which IP initiated the request.

An educated guess would be that the server in question is used for hosting web applications, and one of these contains a script that is vulnerable to spamming. In this case, identify which virtual host runs as user "username" with UID 12345, and correlate it's access logs with the Postfix logs. This will show you which IP initiated the malicious request.

The real fix, in this case, would be to fix the script that can be misused for spamming, of course.

share|improve this answer
    
Thanks, Stefan! You're right, there are hosted websites. I took down the relevant customer website as it was hacked (joomla..). BUT: Theres no script left accessible by the relevant user but the log files keep getting filled with the messages I posted above. How could that be possible? –  Julian Jan 6 at 13:26
    
If the message still appears, then there is at least one script left. Or perhaps it's more than one hosted site. Did you try a find /path/to/webroot -type f -uid 12345, replacing paths/uid as necessary? –  Stefan Förster Jan 6 at 13:47
    
It's nothing left :-/ The result is empty. And this user only has access to that one directory. The message still appears, though. Do you have any ideas left? Thanks for helping! Edit: Damn! Found one.. disguised well.. thanks!! –  Julian Jan 6 at 13:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.