I host a public-facing web server running Debian Wheezy, and latest versions of Postfix, Apache, PHP, Spamassassin, ClamAV, rootkit hunter. Apache is configured with a handful of vhosts, each tied to a user and secured with suExec, and Suhosin. The websites run Wordpress and ModX and by the law of averages given the number of installations on this one server at least 20% of the websites will, at any given time, have some kind of vulnerability be it from the CMS itself or from an out-of-date plugins.
I have notifications from the excellent MX Toolbox website which monitors IP addresses against 100+ blacklists.
When I hear that my IP address has yet again been added to a given blacklist, I ssh in immediately, pause Postfix
wait a few seconds, view the mail queue
and from this I can tell immediately the source user/vhost of the spam because all mails come from "email@example.com", where "mywebsite.com" is the domain hosted on the vhost that caused the problem.
Then I run a manual malware detection scan using the excellent maldet, and the problem goes away. If I patch all known plugins and software on the site, the problem goes away for c.6 months. If I don't it comes back within about a week.
For testing purposes I have left Postfix stopped for months on end, but some trojans apparently bypass the mail server and send mail directly. (I know this from server resource monitoring, blacklist watches, and bounced spam emails coming back to my domain. Not to mention the Postfix mailq fills up with e.g. 65,000 unsent mails.)
As I care more about mail authenticity than the ability to send emails through websites I host, I've taken a number of steps, namely ensuring my SPF records for each domain do not recognise my own server as an authoritative source of mail for that domain. At the very least this means my domain names aren't being automatically blacklisted.
My question. Is there a clever way to simply block all outgoing email using IPTABLES? I don't just mean blocking mail sent using the email server Postfix, but ALL traffic that could end up with my server being blacklisted?
Until I find other ways of solving this problem I don't mind disallowing websites from sending any mails out. This is NOT ideal as I use some to generate my own business, but I can find other solutions in the meantime.