Last night my server was compromised (I guess - one of outdated PHP CMS's) and many spam messages were sent.
I have restricted access to Postfix (via authorized_submit_users
directive in main.cf
) which resulted in successful damage control - now sending of spam is prevented and I get enteries like:
Jun 13 10:12:16 aurora postfix/sendmail[11715]: fatal: User www-data(33) is not allowed to submit mail
Jun 13 10:12:16 aurora postfix/sendmail[11717]: fatal: User www-data(33) is not allowed to submit mail
Jun 13 10:12:17 aurora postfix/sendmail[11719]: fatal: User www-data(33) is not allowed to submit mail
Jun 13 10:12:18 aurora postfix/sendmail[11721]: fatal: User www-data(33) is not allowed to submit mail
Jun 13 10:12:19 aurora postfix/sendmail[11723]: fatal: User www-data(33) is not allowed to submit mail
My question is - what to do to find script that is trying to abuse my Postfix server - is there a way for Postfix to tell me what is triggering command on local system?
I cannot keep web server user (www-data
) away from option to send emails forever.