0

there might have been answers to this many times. But I can't seem to find one that fits my issues so here we go:

I've ran an email server on my centos machine for over four months without problem, but had to remove and reinstall postfix/dovecot wiping their configurations. Now after setting everything up, I receive on average 43 Unknown mail returned to sender being dumped into my mailbox each hour. Each one containing scam/sex line messages with possible virus payloads in certain amounts of them. Before adding any configurations etc, could anyone give a rough sense of direction where the issue lies? I'm not running an open relay, or so I believe to be not running one. Tested via mxtoolbox.com etc. I've had Clamav on the machine since I ever got it, so I'm confidently ruling out any system compromise. But what troubles me is I get hundreds of these inside my /var/log/maillog file each minutes:

Does anyone have even a remote clue what could be causing this?

1
  • I don't think you have an open relay, you might have a "contact us", "tell a friend", or some other similar function on your site. That some bot is taking advantage of and using your server to mail out from.
    – Henry
    Apr 13, 2016 at 19:41

2 Answers 2

1

most likely you are open relay mail server, you can check here http://mxtoolbox.com/diagnostic.aspx

open relay means that anyone can use you mail exchange unchallenged. you will need to look at the documentation around securing you mail server.

1
  • Lake, it is open relay - I was able to send mails from the terminal using your exchange - also you should delete your logs from the comments above.
    – Sum1sAdmin
    Apr 9, 2016 at 20:41
1
  1. if emails are being sent by legitimate user/accounts, some of them might have fallen victims of malware that is using their email clients to send these messages, do you have any way to know their current OS/mail client? Logs may help you with that
  2. if you are not using SSL/TLS for your IMAP connections, IMAP credentials might have been captured through many possible means (wifi sniffing, local malware, network sniffing at your VPS provider, etc.) by someone and they are being reused to send these undesired outgoing email
  3. Clamav only checks incoming/outgoing email content, but it doesn't perform any checks on the server for rootkits or trojans, that could be a reason too, your server could be compromised and from there anything could be happening.

Mitigation recommended:

  • set up new mail server with SSL/TLS support for your IMAP
  • migrate only the most important accounts
  • change password credentials for accounts where you had issues
  • migrate domains and DNS pointers where you are using mail (notify users?)
  • enable mail services with a higher logging level to what you are using now & watch carefully if any undesired mail is being sent

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .