35

A bit confused when reading through the logs of my smtp/mail server, I'm turning this questions to you guys.

In the maillog files I'm seeing entries for postfix/smtp as well as postfix/smtpd. I can also see that there are possible settings for smtp as well as smtpd in the file main.cf

Trying to find some reasonable explanation through google search seemed to be impossible, so here is my question to you guys.

My server was kind of compromised and the spam mails where going through postfix/smtp and not smtpd. Please help me to understand. Thanks in advance!

Improve this question

1 Answer 1

Reset to default
46

postfix/smtpd - This is typically the SMTP daemon process for handling incoming mail and routing to the appropriate internal location.

postfix/smtp - This is typically the SMTP daemon process for delivering mail out to the world.

If you're seeing alot of postfix/smtp log entries, these would be all of the SMTP connections sending spam out to other nodes.

This blog post gives a pretty good overview of interpreting postfix logs.

Improve this answer
7
  • 1
    This is just so confusing. Thanks to the guy who gave me the down vote, very mature. Considering your answer, why would I restrict my SMTP relay usage by this setting smtpd_recipient_restrictions = permit_sasl_authenticated, when my problem is postfix/smtp sending out spam mails?
    – Edwin Krause
    Commented Jun 5, 2015 at 18:43
  • @EdwinKrause Have you considered that there may be a program or script on your server that is connecting to the MTA locally and sending emails? The last few times I have had a spammy server was due to a compromised CMS (Wordpress/Joomla/etc) either becomming or allowing upload of a spam-sending script.
    – Justin Pearce
    Commented Jun 5, 2015 at 18:48
  • That's an interesting thought... I have seen some comment like this before... I'm not using Joomla or Wordpress, but fileupload is possible of course. What would be the easiest way to find the file?
    – Edwin Krause
    Commented Jun 5, 2015 at 18:53
  • 1
    @EdwinKrause It is a reasonable assumption that the spam messages are coming from inside the server. If not, the next place to look would be compromised client (someone's email account getting hacked, malware on the end user node, etc).
    – Justin Pearce
    Commented Jun 5, 2015 at 19:47
  • 1
    Great, thanks for that... I'm currently fighting with enabling mail.log for logging the the php mail command
    – Edwin Krause
    Commented Jun 5, 2015 at 20:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .