Last night my postfix mail server(Debian Squeeze with dovecot, roundcube, opendkim and spamassassin enabled) started sending out spam from a single domain of mine like these:

$cat mail.log|grep D6930B76EA9
Jul 31 23:50:09 myserver postfix/pickup[28675]: D6930B76EA9: uid=65534 from=<myemail@mydomain.dk>
Jul 31 23:50:09 myserver postfix/cleanup[27889]: D6930B76EA9: message-id=<4DD98EC6-A7B9-D0B2-A9AE-1E0FEF1EA28B@mydomain.dk>
Jul 31 23:50:09 myserver postfix/qmgr[7018]: D6930B76EA9: from=<myemail@mydomain.dk>, size=957, nrcpt=1 (queue active)
Jul 31 23:50:09 myserver postfix/error[7819]: D6930B76EA9: to=<randommail@yahoo.com>, relay=none, delay=0.03, delays=0.02/0/0/0, dsn=4.4.2, status=deferred (delivery temporarily suspended: lost connection with mta5.am0.yahoodns.net[] while sending RCPT TO)

The domain in question did not have any accounts enabled but only a catchall alias set through postfixadmin - most emails were send from a specific address I use frequently but some were also sent from bogus addresses. None of the other virtual domains handled by postfix were affected.

How can I find out what process was feeding postfix/sendmail or more info on where they originated? As far as I can tell php mail() wasn't used and I've run several open relay tests. I did a little tinkering(removed winbind from the server and ipv6 addresses from main.cf) after the attack and it seems to have subsided but I still have no idea how my server was suddenly sending out spam. Maybe I fixed it - maybe I didn't. Can anyone help figuring out how I was compromised? Anywhere else I should look? I've run Linux Malware Detect on recently changed files but nothing found.

  • What do you allow relaying from? – NickW Aug 1 '14 at 13:17
  • localhost / only. Considering it's coming from uid 65534(Nobody) it must be some local process feeding it :/ Just can't figure out which one :( – Anders Braüner Nielsen Aug 1 '14 at 14:31
  • 1
    Is it still going? Any process that talks to the internet is (in theory) possibly going to allow someone to get it to do things it wasn't intended to. Anything running under java, or offering some place to write files (even /tmp) should be investigated, php is always a prime culprit in the second case. – NickW Aug 1 '14 at 14:37
  • I don't really see anything suspicious going on now but I wish to get the originating process from the postfix message I'd - is this simply impossible? Is there any good way to log what sendmail picks up? – Anders Braüner Nielsen Aug 2 '14 at 9:10

You can't determine the culprit process through the Message-ID as it can be forged (and probalby is).

The only way ist to replace the sendmail program with a wrapper shell script. This script can then be used to log everything you need. Like parent process ID, user and other process information.

The pickup program of Postfix is triggered by the sendmail program. More information can be found here http://www.postfix.org/sendmail.1.html Maybe it helps to increase the logging of the Postfix's sendmail.

  • Actually I believe I got the id's confused - the ID I'm referring to in this case would be D6930B76EA9 and not the message ID. You might be right in any case that a wrapper is the way to go, though. Does this make a difference? – Anders Braüner Nielsen Aug 22 '14 at 10:13
  • @AndersBraünerNielsen no it makes no difference. The id you are referring to is called the Queue-Id. The Queue-Id is totally random and not related to any source information. – mailq Oct 8 '14 at 7:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.