4

I recently discovered this in my postfix-log:

Aug  4 11:09:12 mail postfix/smtpd[71597]: connect from unknown[59.88.35.206]
Aug  4 11:09:14 mail postfix/smtpd[71597]: Anonymous TLS connection established from unknown[59.88.35.206]: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
Aug  4 11:09:17 mail postfix/smtpd[71597]: 1AE3B7EC3D: client=unknown[59.88.35.206], sasl_method=PLAIN, [email protected]
Aug  4 11:09:30 mail postfix/cleanup[71606]: 1AE3B7EC3D: message-id=<[email protected]>
Aug  4 11:09:30 mail opendkim[24666]: 1AE3B7EC3D: DKIM-Signature field added (s=mail, d=MYDOMAINCOM2012)
Aug  4 11:09:30 mail postfix/qmgr[27543]: 1AE3B7EC3D: from=<[email protected]>, size=2149, nrcpt=20 (queue active)
Aug  4 11:09:31 mail postfix/smtpd[71611]: connect from MAIL.example.com[172.16.0.3]
Aug  4 11:09:31 mail postfix/smtpd[71611]: 14C4C7EC57: client=MAIL.example.com[172.16.0.3]
Aug  4 11:09:31 mail postfix/cleanup[71606]: 14C4C7EC57: message-id=<[email protected]>
Aug  4 11:09:31 mail postfix/smtpd[71611]: disconnect from MAIL.example.com[172.16.0.3]
Aug  4 11:09:31 mail postfix/qmgr[27543]: 14C4C7EC57: from=<[email protected]>, size=2891, nrcpt=20 (queue active)
Aug  4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug  4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug  4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug  4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug  4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug  4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug  4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug  4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug  4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug  4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug  4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug  4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug  4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug  4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug  4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug  4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug  4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug  4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug  4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug  4 11:09:31 mail postfix/qmgr[27543]: 1AE3B7EC3D: removed
Aug  4 11:09:31 mail postfix/smtpd[71597]: 968227EC58: client=unknown[59.88.35.206], sasl_method=PLAIN, [email protected]
Aug  4 11:09:31 mail postfix/smtp[71612]: 14C4C7EC57: to=<[email protected]>, relay=mx.bluebottle.com[136.243.21.189]:25, delay=0.61, delays=0.05/0.02/0.22/0.32, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as 37DBE9EC4)
Aug  4 11:09:32 mail postfix/smtp[71618]: 14C4C7EC57: to=<[email protected]>, relay=vfxplc.com.inbound10.mxlogic.net[208.65.144.3]:25, delay=1.6, delays=0.05/0.05/0.6/0.85, dsn=5.0.0, status=bounced (host vfxplc.com.inbound10.mxlogic.net[208.65.144.3] said: 554 Denied [CS] [b6d90c55.0.552923.00-2289.1107665.p02c11m005.mxlogic.net] (Mode: normal) (in reply to end of DATA command))
Aug  4 11:09:32 mail postfix/smtp[71616]: 14C4C7EC57: to=<[email protected]>, relay=mx4.hotmail.com[65.55.33.119]:25, delay=1.6, delays=0.05/0.04/0.49/1, dsn=2.0.0, status=sent (250  <[email protected]> Queued mail for delivery)
Aug  4 11:09:32 mail postfix/smtp[71614]: 14C4C7EC57: to=<[email protected]>, relay=equitydirect.co.ke.inbound10.mxlogicmx.net[208.65.145.3]:25, delay=1.6, delays=0.05/0.03/0.9/0.66, dsn=5.0.0, status=bounced (host equitydirect.co.ke.inbound10.mxlogicmx.net[208.65.145.3] said: 554 Denied [CS] [b6d90c55.0.778752.00-2304.1523550.s12p02m085.mxlogic.net] (Mode: normal) (in reply to end of DATA command))
Aug  4 11:09:32 mail postfix/smtp[71620]: 14C4C7EC57: to=<[email protected]>, relay=mx-eu.mail.am0.yahoodns.net[188.125.69.79]:25, delay=1.8, delays=0.05/0.07/0.08/1.6, dsn=2.0.0, status=sent (250 ok dirdel 4/2)
Aug  4 11:09:32 mail postfix/smtp[71620]: 14C4C7EC57: to=<[email protected]>, relay=mx-eu.mail.am0.yahoodns.net[188.125.69.79]:25, delay=1.8, delays=0.05/0.07/0.08/1.6, dsn=2.0.0, status=sent (250 ok dirdel 4/2)
Aug  4 11:09:32 mail postfix/smtp[71620]: 14C4C7EC57: to=<[email protected]>, relay=mx-eu.mail.am0.yahoodns.net[188.125.69.79]:25, delay=1.8, delays=0.05/0.07/0.08/1.6, dsn=2.0.0, status=sent (250 ok dirdel 4/2)
Aug  4 11:09:32 mail postfix/smtp[71620]: 14C4C7EC57: to=<[email protected]>, relay=mx-eu.mail.am0.yahoodns.net[188.125.69.79]:25, delay=1.8, delays=0.05/0.07/0.08/1.6, dsn=2.0.0, status=sent (250 ok dirdel 4/2)
Aug  4 11:09:32 mail postfix/smtp[71620]: 14C4C7EC57: to=<[email protected]>, relay=mx-eu.mail.am0.yahoodns.net[188.125.69.79]:25, delay=1.8, delays=0.05/0.07/0.08/1.6, dsn=2.0.0, status=sent (250 ok dirdel 4/2)
Aug  4 11:09:32 mail postfix/smtp[71620]: 14C4C7EC57: to=<[email protected]>, relay=mx-eu.mail.am0.yahoodns.net[188.125.69.79]:25, delay=1.8, delays=0.05/0.07/0.08/1.6, dsn=2.0.0, status=sent (250 ok dirdel 4/2)
Aug  4 11:09:33 mail postfix/smtp[71613]: 14C4C7EC57: to=<[email protected]>, relay=mx.bt.lon5.cpcloud.co.uk[65.20.0.49]:25, delay=2.5, delays=0.05/0.02/0.08/2.4, dsn=2.0.0, status=sent (250 <55BF549902860DA2> Mail accepted)
Aug  4 11:09:35 mail postfix/smtp[71615]: 14C4C7EC57: to=<[email protected]>, relay=mx1.safaricombusiness.co.ke[41.203.208.3]:25, delay=4.2, delays=0.05/0.03/2.6/1.5, dsn=2.0.0, status=sent (250 ok:  Message 1038363882 accepted)
Aug  4 11:09:35 mail postfix/smtp[71615]: 14C4C7EC57: to=<[email protected]>, relay=mx1.safaricombusiness.co.ke[41.203.208.3]:25, delay=4.2, delays=0.05/0.03/2.6/1.5, dsn=2.0.0, status=sent (250 ok:  Message 1038363882 accepted)
Aug  4 11:09:35 mail postfix/smtp[71615]: 14C4C7EC57: to=<[email protected]>, relay=mx1.safaricombusiness.co.ke[41.203.208.3]:25, delay=4.2, delays=0.05/0.03/2.6/1.5, dsn=2.0.0, status=sent (250 ok:  Message 1038363882 accepted)
Aug  4 11:09:36 mail postfix/smtp[71621]: 14C4C7EC57: to=<[email protected]>, relay=mta5.am0.yahoodns.net[98.138.112.32]:25, delay=5.7, delays=0.05/0.07/0.41/5.2, dsn=2.0.0, status=sent (250 ok dirdel 4/0)
Aug  4 11:09:36 mail postfix/smtp[71621]: 14C4C7EC57: to=<[email protected]>, relay=mta5.am0.yahoodns.net[98.138.112.32]:25, delay=5.7, delays=0.05/0.07/0.41/5.2, dsn=2.0.0, status=sent (250 ok dirdel 4/0)
Aug  4 11:09:36 mail postfix/smtp[71621]: 14C4C7EC57: to=<[email protected]>, relay=mta5.am0.yahoodns.net[98.138.112.32]:25, delay=5.7, delays=0.05/0.07/0.41/5.2, dsn=2.0.0, status=sent (250 ok dirdel 4/0)
Aug  4 11:09:36 mail postfix/smtp[71621]: 14C4C7EC57: to=<[email protected]>, relay=mta5.am0.yahoodns.net[98.138.112.32]:25, delay=5.7, delays=0.05/0.07/0.41/5.2, dsn=2.0.0, status=sent (250 ok dirdel 4/0)
Aug  4 11:09:43 mail postfix/cleanup[71606]: 968227EC58: message-id=<[email protected]>
Aug  4 11:09:43 mail opendkim[24666]: 968227EC58: DKIM-Signature field added (s=mail, d=MYDOMAINCOM2012)
Aug  4 11:09:43 mail postfix/qmgr[27543]: 968227EC58: from=<[email protected]>, size=2204, nrcpt=20 (queue active)
Aug  4 11:09:43 mail postfix/smtpd[71611]: connect from MAIL.example.com[172.16.0.3]
Aug  4 11:09:43 mail postfix/smtpd[71611]: B0D2D7EC70: client=MAIL.example.com[172.16.0.3]
Aug  4 11:09:43 mail postfix/cleanup[71606]: B0D2D7EC70: message-id=<[email protected]>
Aug  4 11:09:43 mail postfix/smtpd[71611]: disconnect from MAIL.example.com[172.16.0.3]
Aug  4 11:09:43 mail postfix/qmgr[27543]: B0D2D7EC70: from=<[email protected]>, size=2946, nrcpt=20 (queue active)
Aug  4 11:09:43 mail amavis[24687]: (24687-07) Passed CLEAN {RelayedOpenRelay}, [59.88.35.206]:4678 [59.88.35.206] <[email protected]> -> <[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>, Queue-ID: 968227EC58, Message-ID: <[email protected]>, mail_id: JR1l308kvN-H, Hits: -, size: 2531, queued_as: B0D2D7EC70, 378 ms
Aug  4 11:09:43 mail postfix/lmtp[71609]: 968227EC58: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=13, delays=12/0/0.01/0.38, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as B0D2D7EC70)
Aug  4 11:09:43 mail postfix/lmtp[71609]: 968227EC58: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=13, delays=12/0/0.01/0.38, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as B0D2D7EC70)
Aug  4 11:09:43 mail postfix/lmtp[71609]: 968227EC58: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=13, delays=12/0/0.01/0.38, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as B0D2D7EC70)
Aug  4 11:09:43 mail postfix/lmtp[71609]: 968227EC58: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=13, delays=12/0/0.01/0.38, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as B0D2D7EC70)
Aug  4 11:09:43 mail postfix/lmtp[71609]: 968227EC58: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=13, delays=12/0/0.01/0.38, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as B0D2D7EC70)
Aug  4 11:09:43 mail postfix/lmtp[71609]: 968227EC58: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=13, delays=12/0/0.01/0.38, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as B0D2D7EC70)
Aug  4 11:09:43 mail postfix/lmtp[71609]: 968227EC58: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=13, delays=12/0/0.01/0.38, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as B0D2D7EC70)
Aug  4 11:09:43 mail postfix/lmtp[71609]: 968227EC58: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=13, delays=12/0/0.01/0.38, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as B0D2D7EC70)
Aug  4 11:09:43 mail postfix/lmtp[71609]: 968227EC58: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=13, delays=12/0/0.01/0.38, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as B0D2D7EC70)
Aug  4 11:09:43 mail postfix/lmtp[71609]: 968227EC58: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=13, delays=12/0/0.01/0.38, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as B0D2D7EC70)
Aug  4 11:09:43 mail postfix/lmtp[71609]: 968227EC58: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=13, delays=12/0/0.01/0.38, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as B0D2D7EC70)

172.16.0.3 is the internal IP of my mailserver-jail.

I have a little trouble interpreting this log. Does it mean that someone is using my username ([email protected]) to send spam? If so, then how is it possible and how do I fix it?

This is my Postfix main.cf:

### GENERAL
smtpd_banner = $myhostname ESMTP $mail_name
biff = no
append_dot_mydomain = no
daemon_directory = /usr/local/libexec/postfix
command_directory = /usr/local/sbin
myhostname = MAIL.example.com
myorigin = example.com
mydestination = 172.16.0.3
#relayhost =
mynetworks = 172.16.0.0/12 127.0.0.0/8
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
alias_database = hash:/etc/aliases
alias_maps = $alias_database
message_size_limit = 50000000
smtpd_helo_required = yes

### VIRTUAL
virtual_mailbox_domains = pgsql:/usr/local/etc/postfix/postgres-virtual-mailbox-domains.cf
virtual_mailbox_base = /var/vmail
virtual_mailbox_maps = pgsql:/usr/local/etc/postfix/postgres-virtual-mailbox-maps.cf
virtual_alias_maps = pgsql:/usr/local/etc/postfix/postgres-virtual-alias-maps.cf
virtual_minimum_uid = 150
virtual_uid_maps = static:150
virtual_gid_maps = static:6
virtual_transport = dovecot
dovecot_destination_recipient_limit = 1

### SASL Authentication
smtpd_sasl_auth_enable = yes
smtpd_sasl_exceptions_networks = $mynetworks
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth

smtpd_tls_cert_file = /usr/local/etc/ssl/MAIL.example.com/private.crt
smtpd_tls_key_file = /usr/local/etc/ssl/MAIL.example.com/private.key
smtpd_tls_CAfile = /usr/local/etc/ssl/MAIL.example.com/cacert.pem
smtpd_tls_security_level = may
smtpd_tls_received_header = no
smtpd_tls_loglevel = 1
smtpd_use_tls = yes
smtpd_tls_auth_only = yes
tls_random_source = dev:/dev/urandom

debug_peer_level                = 2
debugger_command                =
show_user_unknown_table_name    = no

### LIMITATIONS
smtpd_client_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    reject_rbl_client ix.dnsbl.manitu.net,
    reject_rbl_client dnsbl.sorbs.net,
    reject_rbl_client sbl-xbl.spamhaus.org,
    reject_rbl_client zen.spamhaus.org,
    reject_rbl_client blackholes.easynet.nl,
    reject_rbl_client dialup.blacklist.jippg.org,
    reject_rbl_client cbl.abuseat.org,
    reject_rbl_client bl.spamcop.net,
    reject_rbl_client sbl.spamhaus.org,
    reject_rbl_client t1.dnsbl.net.au,
    reject_rhsbl_client block.rhs.mailpolice.com,
    reject_rhsbl_client dynamic.rhs.mailpolice.com,
    reject_rhsbl_client rhsbl.sorbs.net,
    reject_rhsbl_client bogusmx.rfc-ignorant.org

smtpd_sender_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    reject_unknown_sender_domain,
    reject_sender_login_mismatch,
    reject_rhsbl_sender rhsbl.sorbs.net,
    reject_rhsbl_sender rddb.dnsbl.net.au,
    reject_rhsbl_sender endn.dnsbl.net.au,
    reject_rhsbl_sender rhsbl.sorbs.net,
    reject_rhsbl_sender block.rhs.mailpolice.com,
    reject_rhsbl_sender dynamic.rhs.mailpolice.com

smtpd_recipient_restrictions =
  permit_mynetworks,
  permit_sasl_authenticated,
  reject_unauth_destination,
  reject_unknown_recipient_domain,
  reject_rbl_client ix.dnsbl.manitu.net,
  reject_rbl_client dnsbl.sorbs.net,
  reject_rbl_client bl.spamcop.net,
  reject_rbl_client zen.spamhaus.org,
  reject_rbl_client dnsbl-1.uceprotect.net


readme_directory = /usr/local/share/doc/postfix
sample_directory = /usr/local/etc/postfix
sendmail_path = /usr/local/sbin/sendmail
html_directory = /usr/local/share/doc/postfix
setgid_group = maildrop
manpage_directory = /usr/local/man
newaliases_path = /usr/local/bin/newaliases
mailq_path = /usr/local/bin/mailq
queue_directory = /var/spool/postfix
mail_owner = postfix
data_directory = /var/db/postfix
disable_vrfy_command = yes
smtpd_delay_reject = yes
content_filter = amavisfeed:[172.16.0.3]:10024
#receive_override_options = no_address_mappings
smtpd_milters = inet:172.16.0.3:54321
non_smtpd_milters = inet:172.16.0.3:54321
milter_default_action = accept
inet_protocols = ipv4

172.16.0.3:54321 is OpenDKIM.

And this is my master.cf:

 smtp      inet  n       -       n       -       -       smtpd
 pickup    unix  n       -       n       60      1       pickup
 cleanup   unix  n       -       n       -       0       cleanup
 qmgr      unix  n       -       n       300     1       qmgr
 tlsmgr    unix  -       -       n       1000?   1       tlsmgr
 rewrite   unix  -       -       n       -       -       trivial-rewrite
 bounce    unix  -       -       n       -       0       bounce
 defer     unix  -       -       n       -       0       bounce
 trace     unix  -       -       n       -       0       bounce
 verify    unix  -       -       n       -       1       verify
 flush     unix  n       -       n       1000?   0       flush
 proxymap  unix  -       -       n       -       -       proxymap
 proxywrite unix -       -       n       -       1       proxymap
 smtp      unix  -       -       n       -       -       smtp
 relay     unix  -       -       n       -       -       smtp
 showq     unix  n       -       n       -       -       showq
 error     unix  -       -       n       -       -       error
 retry     unix  -       -       n       -       -       error
 discard   unix  -       -       n       -       -       discard
 local     unix  -       n       n       -       -       local
 virtual   unix  -       n       n       -       -       virtual
 lmtp      unix  -       -       n       -       -       lmtp
 anvil     unix  -       -       n       -       1       anvil
 scache    unix  -       -       n       -       1       scache
 dovecot    unix  -       n       n       -       -       pipe
    flags=DRhu user=vmail:mail argv=/usr/local/libexec/dovecot/deliver -f ${sender} -d ${user}@${nexthop}
 amavisfeed unix  -       -       n       -       2       lmtp
    -o lmtp_data_done_timeout=1200
    -o lmtp_send_xforward_command=yes
172.16.0.3:10025 inet n - n - - smtpd
   -o content_filter=
   -o smtpd_delay_reject=no
   -o smtpd_client_restrictions=permit_mynetworks,reject
   -o smtpd_helo_restrictions=
   -o smtpd_sender_restrictions=
   -o smtpd_recipient_restrictions=permit_mynetworks,reject
   -o smtpd_data_restrictions=reject_unauth_pipelining
   -o smtpd_end_of_data_restrictions=
   -o smtpd_restriction_classes=
   -o mynetworks=172.16.0.0/12
   -o smtpd_error_sleep_time=0
   -o smtpd_soft_error_limit=1001
   -o smtpd_hard_error_limit=1000
   -o smtpd_client_connection_count_limit=0
   -o smtpd_client_connection_rate_limit=0
   -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters,no_address_mappings
   -o local_header_rewrite_clients=
   -o smtpd_milters=
   -o local_recipient_maps=
   -o relay_recipient_maps=
Improve this question
3
  • Seems like external relay is happening. Include following value in main.conf & try. smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination Restart postfix . Refer serverfault.com/questions/665258/…
    – serverliving.com
    Aug 4, 2015 at 12:20
  • @StackPlayer: I included it in main.conf. Is it normal, that open relay tests don't detect this kind of relay?
    – fmeyers
    Aug 4, 2015 at 12:39
  • 1
    Open relay tests do not detect this because it is not an open relay. It is a password protected relay. The password has been compromised but the relay can still only be used by those who have it, not by everyone.
    – Tilman Schmidt
    Aug 4, 2015 at 13:52

2 Answers 2

Reset to default
6

Does it mean that someone is using my username ([email protected]) to send spam?

YES

This log line was the proof of it.

Aug  4 11:09:17 mail postfix/smtpd[71597]: 1AE3B7EC3D: client=unknown[59.88.35.206], sasl_method=PLAIN, [email protected]

As you have permit_sasl_authenticated in main.cf, then you authorize anyone who knows your credential to send email via your server.

If so, then how is it possible?

There many ways to make your credential leaked.

  • Keylogger planted in your computer
  • Worm sends sensitive information (including your credential)
  • Weak password was retrieved via brute-force or guessing
  • Phising email
  • And many others...

and how do I fix it?

First disable the account, either change its status in postgre database or change the password into random one. Identify how your credential was leaked and fix that hole too.

Additional notes:

Your postfix configuration was fine. Although it's little bit overlapping each other as you repeat some of the restriction in each stage. You should also verify that each rhsbl/rbl provider was still active maintaining the blacklist to avoid false-positives.

Improve this answer
4

The log shows that someone has obtained the password for the mail account [email protected] and is using it to send SPAM through the server.

  • The entry at time 11:09:17 shows a successful SASL authentication from IP address 59.88.35.206 with username [email protected].
  • The entry at 11:09:30 shows reception and queuing of a message with sender address [email protected] with twenty declared recipients over that connection.
  • The entries timestamped 11:09:31 show these twenty copies being first forwarded internally within Postfix and then sent out to the recipients.

The most frequent cause for that kind of incident is a user falling for a phishing mail telling him or her to enter his or her mail address and password on some credentials harvesting web form.

To fix:

  • Change that account's password immediately.
  • Choose a (more) sensible password, specifically one not used anywhere else.
  • Be (more) careful not to reveal that password to anybody, specifically do not enter it on any website.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .