Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Hi I was wondering if anyone could help. I got a email from my host company that there are some weird traffic coming from my server. A quick look into the log file revealed the sample log below. There are thousands of emails on the log file.

Can someone suggest how I can block all those emails being sent from my Linux server. I'm on Ubuntu 12.03 LTS if that helps.

Jan 31 09:52:30 myserver postfix/smtp[55852]: 03EC14869A: to=<QAnne-Pascale.Targe@ciera.ulaval.ca>, relay=exch-spam02.ulaval.ca[132.203.244.24]:25, delay=229193, delays=229193/0.17/0.47/0, dsn=4.0.0, status=deferred (host exch-spam02.ulaval.ca[132.203.244.24] refused to talk to me: 554-exch-spam02.ulaval.ca 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Jan 31 09:52:30 myserver postfix/smtp[55870]: connect to cluster8.us.messagelabs.com[216.82.241.132]:25: Connection refused
Jan 31 09:52:30 myserver postfix/smtp[55849]: 5049348710: to=<Qst-onge.mathieu.3@courrier.uqam.ca>, relay=mail3.uqam.ca[132.208.246.162]:25, delay=229188, delays=229187/0.15/0.52/0, dsn=4.0.0, status=deferred (host mail3.uqam.ca[132.208.246.162] refused to talk to me: 554-data.crochet.telecom.uqam.ca 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Jan 31 09:52:30 myserver postfix/smtp[55870]: connect to cluster8a.us.messagelabs.com[85.158.139.103]:25: Connection refused
Jan 31 09:52:30 myserver postfix/smtp[55861]: 3437C4876E: to=<racicot.yves@uqam.ca>, relay=mail3.uqam.ca[132.208.246.162]:25, delay=229181, delays=229180/0.2/0.45/0, dsn=4.0.0, status=deferred (host mail3.uqam.ca[132.208.246.162] refused to talk to me: 554-data.crochet.telecom.uqam.ca 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Jan 31 09:52:30 myserver postfix/smtp[55846]: 8503348BF7: to=<tremblayjg@csc-scc.gc.ca>, relay=mail2.csc-scc.gc.ca[198.103.56.136]:25, delay=228588, delays=228587/0.12/0.68/0, dsn=4.0.0, status=deferred (host mail2.csc-scc.gc.ca[198.103.56.136] refused to talk to me: 554-mxlaval.csc-scc.gc.ca 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Jan 31 09:52:30 myserver postfix/smtp[55870]: connect to cluster8a.us.messagelabs.com[216.82.251.230]:25: Connection refused
Jan 31 09:52:30 myserver postfix/smtp[55865]: A5E364984A: to=<vaillancourt.yves@uqam.ca>, relay=mail2.uqam.ca[132.208.246.165]:25, delay=228559, delays=228558/0.27/0.46/0, dsn=4.0.0, status=deferred (host mail2.uqam.ca[132.208.246.165] refused to talk to me: 554-data.hamecon.telecom.uqam.ca 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Jan 31 09:52:30 myserver postfix/smtp[55870]: F0E6948932: to=<rbrophy@bickertonbrokers.com>, relay=none, delay=229161, delays=229161/0.33/0.4/0, dsn=4.4.1, status=deferred (connect to cluster8a.us.messagelabs.com[216.82.251.230]:25: Connection refused)
Jan 31 09:52:30 myserver postfix/smtp[55843]: A83CA486EF: to=<Qjonathan.durand-folcol.1@ulaval.ca>, relay=exch-spam02.ulaval.ca[132.203.244.24]:25, delay=229191, delays=229190/0.27/0.48/0, dsn=4.0.0, status=deferred (host exch-spam02.ulaval.ca[132.203.244.24] refused to talk to me: 554-exch-spam02.ulaval.ca 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Jan 31 09:52:30 myserver postfix/smtp[55845]: 2E49B4866E: host mx11.exchange.telus.com[205.206.208.34] refused to talk to me: 554-mx21.exchange.telus.com 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.
Jan 31 09:52:30 myserver postfix/smtp[55856]: 12A4A4DF0A: to=<Ipoussons-poussettes@bellnet.ca>, relay=mxmta.bellnet.ca[67.69.240.61]:25, delay=231626, delays=231625/0.17/0.92/0, dsn=4.4.2, status=deferred (lost connection with mxmta.bellnet.ca[67.69.240.61] while receiving the initial server greeting)
Jan 31 09:52:30 myserver postfix/smtp[55845]: 2E49B4866E: host mx12.exchange.telus.com[205.206.208.35] refused to talk to me: 554-mx22.exchange.telus.com 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.
Jan 31 09:52:30 myserver postfix/smtp[55850]: 53A1948A8C: to=<Troy@ExitInTheSoo.com>, relay=presmtp.ex1.secureserver.net[72.167.238.201]:25, delay=228581, delays=228579/0.15/1.2/0, dsn=4.0.0, status=deferred (host presmtp.ex1.secureserver.net[72.167.238.201] refused to talk to me: 554-p3pismtp01-057.prod.phx3.secureserver.net 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Jan 31 09:52:31 myserver postfix/smtp[55844]: 955704945F: to=<tpeddigrew@cogeco.ca>, relay=MX.cogeco.ca[216.221.81.26]:25, delay=228598, delays=228596/0.1/1.4/0, dsn=4.4.2, status=deferred (lost connection with MX.cogeco.ca[216.221.81.26] while receiving the initial server greeting)
Jan 31 09:52:31 myserver postfix/smtp[55845]: 2E49B4866E: host mx13.exchange.telus.com[209.171.64.82] refused to talk to me: 554-mx24.exchange.telus.com 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.
Jan 31 09:52:31 myserver postfix/smtp[55845]: 2E49B4866E: to=<pwong@williamsengineering.com>, relay=mx14.exchange.telus.com[209.171.64.83]:25, delay=229196, delays=229194/0.1/1.6/0, dsn=4.0.0, status=deferred (host mx14.exchange.telus.com[209.171.64.83] refused to talk to me: 554-mx25.exchange.telus.com 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Jan 31 09:52:31 myserver postfix/smtp[55862]: 343EB486F0: to=<Qnicolas_gignac@inrs-ete.uquebec.ca>, relay=none, delay=229190, delays=229188/0.21/1.5/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=inrs-ete.uquebec.ca type=MX: Host not found, try again)
Jan 31 09:52:33 myserver postfix/smtp[55847]: 611C348731: to=<query@coastalwinds.com>, relay=none, delay=229189, delays=229185/0.13/3.3/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=coastalwinds.com type=MX: Host not found, try again)
Jan 31 09:52:33 myserver postfix/smtp[55848]: 6146948685: to=<Qfoisy.catherine.2@courrier.uqam.ca>, relay=mail3.uqam.ca[132.208.246.162]:25, delay=229195, delays=229191/0.14/3.5/0, dsn=4.0.0, status=deferred (host mail3.uqam.ca[132.208.246.162] refused to talk to me: 554-data.crochet.telecom.uqam.ca 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Jan 31 09:52:59 myserver postfix/smtp[55854]: connect to gmail.co[173.194.34.182]:25: Connection timed out
Jan 31 09:52:59 myserver postfix/smtp[55860]: connect to hortmail.com[65.55.39.10]:25: Connection timed out
Jan 31 09:52:59 myserver postfix/smtp[55855]: connect to saskpower.ca[65.39.140.84]:25: Connection timed out
Jan 31 09:52:59 myserver postfix/smtp[55855]: 022C148CCF: to=<rgin@saskpower.ca>, relay=none, delay=229153, delays=229123/0.15/30/0, dsn=4.4.1, status=deferred (connect to saskpower.ca[65.39.140.84]:25: Connection timed out)
Jan 31 09:53:00 myserver postfix/smtp[55866]: connect to remax-lethbridge.com[208.91.196.163]:25: Connection timed out
Jan 31 09:53:00 myserver postfix/smtp[55866]: B370A48B44: to=<remax@remax-lethbridge.com>, relay=none, delay=229168, delays=229137/0.28/30/0, dsn=4.4.1, status=deferred (connect to remax-lethbridge.com[208.91.196.163]:25: Connection timed out)
Jan 31 09:53:29 myserver postfix/smtp[55854]: connect to gmail.co[173.194.34.181]:25: Connection timed out
Jan 31 09:53:29 myserver postfix/smtp[55854]: 056994B723: to=<Wesleyscott99@gmail.co>, relay=none, delay=228541, delays=228481/0.19/60/0, dsn=4.4.1, status=deferred (connect to gmail.co[173.194.34.181]:25: Connection timed out)
Jan 31 09:53:29 myserver postfix/smtp[55860]: connect to hortmail.com[64.4.6.100]:25: Connection timed out
Jan 31 09:53:29 myserver postfix/smtp[55860]: 3F3DE48F58: to=<rmaliaa@hortmail.com>, relay=none, delay=229137, delays=229076/0.19/60/0, dsn=4.4.1, status=deferred (connect to hortmail.com[64.4.6.100]:25: Connection timed out)
share|improve this question
add comment

4 Answers

  1. postsuper -h ALL will stop outgoing mail from your server. Do that. Right now. Yes, it will affect actual real mail. But your server has already been blacklisted so much of your real mail won't be delivered anyway.

  2. Look at the headers for one of the spam mails. That's how you find out where they came from. I can't give you more information without seeing those headers.

  3. Clean out the spam from your queue. If you're not concerned with any "real" mail still in the queue, deleting the whole queue will be quickest and easiest. This is done with postqueue -d ALL. If you don't want to delete the whole queue, print out the queue contents with postqueue -p. Then, for each mail that you actually do want to send, look at the queue ID for that mail and remove it from hold with postsuper -H queue_ID. Once you're done with that (and have copied the contents of some spam mail for further analysis) you can clean out the remaining spams in the hold queue by running postsuper -d ALL hold.

  4. If there is, you need to shut postfix down. Right now. Don't re-start it until you've figured out where the spam is coming from and are certain that you have stopped it. There is information about how to secure a postfix server at the postfix documentation. If you've already done that but spam is still coming through, it's probably through some web service or other malware. Figuring that out is beyond the scope of this question.

  5. Your mailserver is blacklisted. You need to either setup mail relay through e.g. an ISPs server, or you need to get off of the blacklists. There's information about that at http://www.spamhaus.org/ .

share|improve this answer
    
Thanks Jenny, I've deleted the queue and stopped the postfix service until I can work out what's going on. My IP is now blacklisted - which is a shame. :-( –  Helen Jan 31 at 11:28
    
I've been there... If you need help reading the headers, drop me an email to the address listed in my profile. It's been a while since I did postmaster/abuse work, but I still have some contacts in the anti-spam business. –  Jenny D Jan 31 at 11:39
add comment

The log fragment you provided isn't enough to give you a reply. This log fragment only shows delivery attempts to servers that aren't responding. They also seem to be misspelled addresses (gmail.co, hortmail.com, ...)

share|improve this answer
    
The misspellings are on the log. I just copied and pasted the last few lines of the log. –  Helen Jan 31 at 10:16
    
I understand. Those misspellings are there because users of your mail server (or spammers) were sending to misspelled domain names. That's not your fault. –  JaviLM Jan 31 at 10:34
add comment

There can me a couple of reasons for this.

Does your server accept incoming connections on port 25? If so, does it need to? It might be an open proxy, letting anyone use your SMTP server distribute e-mail.

If it's a web server, it might have malware installed through e.g. forum software or WordPress (for the latter, you can use automatic scanning software like http://wordpress.org/plugins/gotmls/).

It would help to figure out where the e-mails are sent from.

share|improve this answer
add comment

The new log you added shows that other mail servers are rejecting email coming from your server because it's in a black list, most likely because spam is (or was) sent from your side. That's probably the weird traffic that your hosting provider was talking about.

This log shows that yes, your server was sending spam and is now listed in anti-spam blacklists, but this is not enough yet to find the reason.

I'd advice to check your system for rootkits/backdoors. This tool might help:

http://www.rootkit.nl/projects/rootkit_hunter.html

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.