0

I've been reading a lot of topics here for the last 2 hours, made some change and yet I'm not sure how things happened and if things are fixed.

First, this morning, I received an email from OVH, saying a lot of SPAM was sent from my server and that my IP was blocked from using the port 25 until I fix the problem. They also associated a sample of the message responsible for this ban:

Destination IP: 168.95.6.64 - Message-ID: [email protected] - Spam score: 391
Destination IP: 168.95.6.58 - Message-ID: [email protected] - Spam score: 371
Destination IP: 168.95.6.58 - Message-ID: [email protected] - Spam score: 371
Destination IP: 168.95.5.11 - Message-ID: [email protected] - Spam score: 371
Destination IP: 168.95.5.64 - Message-ID: [email protected] - Spam score: 371

Quite panicked, I desactivated Postfix and tried to tweak the settings to make it more secure: Settings Here through webmin

I then checked my logs and yet, I still see curious unknown some connection, from I don't know where, I don't know who, and I don't know why.

Curent Maillog:

May 24 15:32:12 web postfix/smtpd[19826]: connect from unknown[89.248.171.131]
May 24 15:32:12 web postfix/smtpd[19826]: disconnect from unknown[89.248.171.131]
May 24 15:32:14 web postfix/smtpd[19826]: connect from static-68-236-199-191.nwrk.east.verizon.net[68.236.199.191]
May 24 15:32:14 web postfix/smtpd[19826]: NOQUEUE: reject: RCPT from static-68-236-199-191.nwrk.east.verizon.net[68.236.199.191]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.1.142]>
May 24 15:32:14 web postfix/smtpd[19826]: disconnect from static-68-236-199-191.nwrk.east.verizon.net[68.236.199.191]
May 24 15:33:34 web postfix/smtpd[19826]: warning: hostname hostby.planet-telecom.eu does not resolve to address 91.197.232.50: Name or service not known
May 24 15:33:34 web postfix/smtpd[19826]: connect from unknown[91.197.232.50]
May 24 15:33:34 web postfix/smtpd[19826]: disconnect from unknown[91.197.232.50]
May 24 15:34:31 web postfix/smtpd[19826]: warning: hostname hostby.planet-telecom.eu does not resolve to address 91.197.232.50: Name or service not known
May 24 15:34:31 web postfix/smtpd[19826]: connect from unknown[91.197.232.50]
May 24 15:34:32 web postfix/smtpd[19826]: disconnect from unknown[91.197.232.50]
May 24 15:34:32 web postfix/smtpd[19826]: warning: hostname hostby.planet-telecom.eu does not resolve to address 91.197.232.50: Name or service not known
May 24 15:34:32 web postfix/smtpd[19826]: connect from unknown[91.197.232.50]
May 24 15:34:32 web postfix/smtpd[19826]: disconnect from unknown[91.197.232.50]
May 24 15:34:36 web postfix/smtpd[19826]: warning: hostname hostby.planet-telecom.eu does not resolve to address 91.197.232.50: Name or service not known
May 24 15:34:36 web postfix/smtpd[19826]: connect from unknown[91.197.232.50]
May 24 15:34:36 web postfix/smtpd[19826]: disconnect from unknown[91.197.232.50]

Here's my current message log:

May 24 15:32:45 web systemd: Got automount request for /proc/sys/fs/binfmt_misc, triggered by 19554 (find)
May 24 15:32:45 web systemd: Mounting Arbitrary Executable File Formats File System...
May 24 15:32:45 web systemd: Mounted Arbitrary Executable File Formats File System.
May 24 15:33:01 web systemd: Started Session 3792 of user site1.
May 24 15:33:01 web systemd: Starting Session 3792 of user site1.
May 24 15:34:01 web systemd: Started Session 3793 of user site1.
May 24 15:34:01 web systemd: Starting Session 3793 of user site1.
May 24 15:35:01 web systemd: Started Session 3794 of user mailman.
May 24 15:35:01 web systemd: Starting Session 3794 of user mailman.
May 24 15:35:01 web systemd: Started Session 3795 of user root.
May 24 15:35:01 web systemd: Starting Session 3795 of user root.
May 24 15:35:02 web su: (to postgres) root on none
May 24 15:35:50 web clamd: SelfCheck: Database modification detected. Forcing reload.
May 24 15:35:50 web clamd[1361]: SelfCheck: Database modification detected. Forcing reload.
May 24 15:35:50 web clamd[1361]: Reading databases from /var/lib/clamav
May 24 15:35:50 web clamd: Reading databases from /var/lib/clamav
May 24 15:35:58 web clamd[1361]: Database correctly reloaded (4399850 signatures)
May 24 15:35:58 web clamd: Database correctly reloaded (4399850 signatures)
May 24 15:37:01 web systemd: Started Session 3796 of user site1.
May 24 15:37:01 web systemd: Starting Session 3796 of user site1.

I have about 16 Ips on my server and only one was affected by the spam. I just launched a malware detect on the server, and will update if anything is found.

My main concern is how could this happen? I have 16 characters password such as "&VGq7T=:x\4_.cBQ" for every user. Every website is hosted on a different IP and has different users and emails activated. I could identify from old logs.

Heres what my mail log looked like during the spamming process:

May 24 14:57:31 web postfix/pickup[1457]: AE9D4221009: uid=535 from=<user2>
May 24 14:57:31 web postfix/cleanup[10527]: AE9D4221009: message-id=<[email protected]>
May 24 14:57:31 web postfix/qmgr[4581]: AE9D4221009: from=<[email protected]>, size=6059, nrcpt=1 (queue active)
May 24 14:57:32 web postfix/local[10529]: AE9D4221009: to=<[email protected]>, orig_to=<user2>, relay=local, delay=151, delays=150/0/0/0.83, dsn=5.2.0, status=bounced (can't create user output file)
May 24 14:57:32 web postfix/bounce[11771]: AE9D4221009: sender non-delivery notification: 85B3A22100E
May 24 14:57:32 web postfix/qmgr[4581]: AE9D4221009: removed

The website associated with user2 has been taken down.

I also had a lot of line such as 

 May 24 14:13:08 web postfix/smtpd[28842]: warning: unknown[220.247.201.45]: SASL LOGIN authentication failed: authentication failure

I would love some insight, to know if the problem is resolved and where it could have come from. It's very frustrating, not being a server admin and dealing with those kind of issues in the rush. But at least I'm learning I guess. I apologize in advance for my lack of basic knowledge on Postfix. I hope I have been clear enough for someone to give me a few directions to look at, and if needed, I can bring more details/logs.

UPDATE:

I can access my email from my computer but cannot use the smtp anymore. I guess it has to do with the changes in settings I did.

Here's my conf file : http://pastebin.com/CuYrp4sC

Improve this question
2
  • Your postfix instance is supposed to handle only localy posted emails ? was the port 25 open from the internet (try a telnet [IP] 25 from a computer whith internet access)? Can we have your postfix configuration file /etc/postfix/main.cf ?
    – ob_dev
    May 24, 2016 at 15:26
  • @oubounaim I attached my conf file in a pastebin. I'm the sole user of those mailbox (I own the 16 websites, all on wordpress). I noticed that I can't send message anymore, the smtp rejects me. the port 25 is not open.
    – None
    May 24, 2016 at 16:43

1 Answer 1

Reset to default
0

The way SMTP works, you might not want to block them from connecting... you just want to limit what they can do.

An example policy might be: - authorized users may send mail to anyone - unauthorized users may send mail to your local users only

In postfix, I think that just means filling in your local domains in the "mydestination" "relayhost" and "mynetworks" config. For example:

mydestination = mysite.com, someinternalname.company, localhost
relayhost =
mynetworks = 192.168.99.0/24 10.32.0.0/24 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128

And I'm not sure if myorigin and mydomain options are relevant here.

But if you really want to block them completely, use a firewall to block it from the public network.

Improve this answer
1
  • I checked 2 things in this setting panel which seems to suit for this link It happened again today on another IP of my server. It's very frustrating, I have no idea of how SMTP and relays works and I can't find clear tutorials on how to set it up when you have multiple IPs and domains.
    – None
    May 25, 2016 at 16:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .