0

This question already has an answer here:

Since one week, i get lot of spams sent from my server, which using Postfix. All these spams are sending from an mail address like this :

XXXXXX@ mywebsite . com

XXXXXXX = random name all these mail addresses didnt exist of course but they can send spam (to aol, gmail, etc.)

I tried to block sending mail from domain, but it didnt work. (it works only when i send the mail from my existing mail address, but the spamers still can send spam...) this link : serverfault.com/questions/517945/how-to-block-sending-mail-from-domain-in-postfix

Here is an extract of my dovecot log : Code:

Sep 10 18:51:04 auth-worker(27351): Info: sql(paula_thomas@ mywebsite . com): unknown user

each 4-5 minutes

From my mail.log :

> Sep 10 18:54:23 my-host postfix/qmgr[26436]: 1754037021E2:
> from=<grace_mcdonald@ mywebsite . com>, size=1251, nrcpt=1 (queue
> active) Sep 10 18:54:23 my-host postfix/lmtp[27584]: 028053701ECE:
> to=<audrey_lane@ mywebsite . com>, relay=myhostname.
> fr[private/dovecot-lmtp], delay=0.15, delays=0.09/0/0/0.07, dsn=5.1.1,
> status=bounced (host myhostname. fr[private/dovecot-lmtp] said: 550
> 5.1.1 <audrey_lane@ mywebsite . com> User doesn't exist: audrey_lane@ mywebsite . com (in reply to RCPT TO command)) Sep 10 18:54:23 my-host
> postfix/pickup[27034]: 27DC83701E50: uid=5010 from=<grace_mcdonald@
> mywebsite . com> Sep 10 18:54:23 my-host postfix/cleanup[27220]:
> 27DC83701E50: message-id=<c7f61a098fd9f9ec2e1dc242d57be877@ mywebsite
> . fr> Sep 10 18:54:23 my-host postfix/qmgr[26436]: 27DC83701E50:
> from=<grace_mcdonald@ mywebsite . com>, size=1220, nrcpt=1 (queue
> active) Sep 10 18:54:23 my-host postfix/pickup[27034]: 3BC733701DBD:
> uid=5010 from=<audrey_lane@ mywebsite . com> Sep 10 18:54:23 my-host
> postfix/cleanup[27259]: 3BC733701DBD:
> message-id=<67ee6823a83f3bb73e5f5717c2905be5@ mywebsite . fr> Sep 10
> 18:54:23 my-host postfix/qmgr[26436]: 3BC733701DBD: from=<audrey_lane@
> mywebsite . com>, size=1238, nrcpt=1 (queue active) Sep 10 18:54:23
> my-host postfix/pickup[27034]: 577763701DC6: uid=5010
> from=<audrey_lane@ mywebsite . com> Sep 10 18:54:23 my-host
> postfix/cleanup[27220]: 577763701DC6:
> message-id=<ce07dac8196b58ab895833ffe69be4e5@ mywebsite . fr> Sep 10
> 18:54:23 my-host postfix/qmgr[26436]: 577763701DC6: from=<audrey_lane@
> mywebsite . com>, size=1239, nrcpt=1 (queue active) Sep 10 18:54:23
> my-host postfix/pickup[27034]: 6A1B7370229E: uid=5010
> from=<audrey_lane@ mywebsite . com> Sep 10 18:54:23 my-host
> postfix/cleanup[27259]: 6A1B7370229E:
> message-id=<e1e88d4dc65dce78da6a03b8e165624a@ mywebsite . fr> Sep 10
> 18:54:23 my-host postfix/qmgr[26436]: 6A1B7370229E: from=<audrey_lane@
> mywebsite . com>, size=1219, nrcpt=1 (queue active) Sep 10 18:54:23
> my-host postfix/pickup[27034]: 746EA3701D7C: uid=5010
> from=<audrey_lane@ mywebsite . com> Sep 10 18:54:23 my-host
> postfix/cleanup[27220]: 746EA3701D7C:
> message-id=<b6380a13f78128602b3fce4ebc69b369@ mywebsite . fr> Sep 10
> 18:54:23 my-host postfix/qmgr[26436]: 746EA3701D7C: from=<audrey_lane@
> mywebsite . com>, size=1237, nrcpt=1 (queue active) Sep 10 18:54:23
> my-host postfix/smtp[27253]: 847553701DD2: to=<jamie.innes93@
> hotmail.co.uk>, relay=mx3.hotmail.com[65.55.33.135]:25, delay=2.7,
> delays=0.68/0/1.4/0.53, dsn=2.0.0, status=sent (250
> <c0b1f97f035a4ee8f10ebf8a93e350d9@ mywebsite . fr> Queued mail for
> delivery) Sep 10 18:54:23 my-host postfix/lmtp[27291]: 99B0C3701DD2:
> to=<grace_mcdonald@ mywebsite . com>, relay=myhostname.
> fr[private/dovecot-lmtp], delay=0.15, delays=0.06/0/0/0.09, dsn=5.1.1,
> status=bounced (host myhostname. fr[private/dovecot-lmtp] said: 550
> 5.1.1 <grace_mcdonald@ mywebsite . com> User doesn't exist: grace_mcdonald@ mywebsite . com (in reply to RCPT TO command)) Sep 10
> 18:54:23 my-host postfix/lmtp[27584]: A85D537022BB:
> to=<grace_mcdonald@ mywebsite . com>, relay=myhostname.
> fr[private/dovecot-lmtp], delay=0.14, delays=0.09/0/0/0.04, dsn=5.1.1,
> status=bounced (host myhostname. fr[private/dovecot-lmtp] said: 550
> 5.1.1 <grace_mcdonald@ mywebsite . com> User doesn't exist: grace_mcdonald@ mywebsite . com (in reply to RCPT TO command)) Sep 10
> 18:54:23 my-host postfix/lmtp[27291]: D86373701D29:
> to=<grace_mcdonald@ mywebsite . com>, relay=myhostname.
> fr[private/dovecot-lmtp], delay=0.06, delays=0.03/0/0/0.03, dsn=5.1.1,
> status=bounced (host myhostname. fr[private/dovecot-lmtp] said: 550
> 5.1.1 <grace_mcdonald@ mywebsite . com> User doesn't exist: grace_mcdonald@ mywebsite . com (in reply to RCPT TO command)) Sep 10
> 18:54:24 my-host postfix/lmtp[27584]: 255483701DD2: to=<audrey_lane@
> mywebsite . com>, relay=myhostname. fr[private/dovecot-lmtp],
> delay=0.07, delays=0.03/0/0/0.03, dsn=5.1.1, status=bounced (host
> myhostname. fr[private/dovecot-lmtp] said: 550 5.1.1 <audrey_lane@
> mywebsite . com> User doesn't exist: audrey_lane@ mywebsite . com (in
> reply to RCPT TO command)) Sep 10 18:54:24 my-host
> postfix/smtp[27246]: 72DF63702308: to=<galipete@ msn.com>,
> relay=mx1.hotmail.com[65.55.92.136]:25, delay=2.3,
> delays=0.54/0/1.4/0.41, dsn=2.0.0, status=sent (250
> <ca761254081f994ec23ef61df24a0761@ mywebsite . fr> Queued mail for
> delivery) Sep 10 18:54:24 my-host postfix/smtp[27280]: B31E43701E88:
> to=<leirbag22@ hotmail.com>, relay=mx4.hotmail.com[65.55.92.168]:25,
> delay=2.3, delays=0.79/0/1.1/0.41, dsn=2.0.0, status=sent (250
> <fab1aae28bfdd94e83cab45536ed995b@ mywebsite . fr> Queued mail for
> delivery) Sep 10 18:54:24 my-host postfix/smtp[27711]: 949E0370231B:
> to=<thebestcj18@ hotmail.com>, relay=mx1.hotmail.com[65.54.188.94]:25,
> delay=2.4, delays=0.47/0/1.4/0.52, dsn=2.0.0, status=sent (250
> <66f45a301693aaffd963970cf505ad0b@ mywebsite . fr> Queued mail for
> delivery) Sep 10 18:54:25 my-host postfix/smtp[27253]: 746EA3701D7C:
> to=<e_romero_0606@ live.com>, relay=mx3.hotmail.com[207.46.8.199]:25,
> delay=3, delays=1.1/0.01/1.3/0.51, dsn=2.0.0, status=sent (250
> <b6380a13f78128602b3fce4ebc69b369@ mywebsite . fr> Queued mail for
> delivery) Sep 10 18:54:25 my-host postfix/smtp[27300]: 577763701DC6:
> to=<rpmccreary@ hotmail.com>, relay=mx1.hotmail.com[65.55.33.135]:25,
> delay=3, delays=0.93/0/1.4/0.62, dsn=2.0.0, status=sent (250
> <ce07dac8196b58ab895833ffe69be4e5@ mywebsite . fr> Queued mail for
> delivery)

All mails contains links (porno, poker, etc.)

Here is my config file : /etc/postfix/main.cf

Code:
#######################
## GENERALS SETTINGS ##
#######################

smtpd_banner         = $myhostname ESMTP $mail_name (Debian/GNU)
biff                 = no
append_dot_mydomain  = no
readme_directory     = no
delay_warning_time   = 4h
mailbox_command      = procmail -a "$EXTENSION"
recipient_delimiter  = +
disable_vrfy_command = yes
message_size_limit   = 502400000
mailbox_size_limit   = 1024000000

inet_interfaces = all
inet_protocols = ipv4

myhostname    = mon.domaine.fr
myorigin      = mon.domaine.fr
mydestination = localhost localhost.$mydomain
mynetworks    = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
relayhost     =

alias_maps     = hash:/etc/aliases
alias_database = hash:/etc/aliases

####################
## TLS PARAMETERS ##
####################
# Smtp ( OUTGOING / Client )
smtp_tls_loglevel            = 1
smtp_tls_security_level      = may
#smtp_tls_CAfile              = /etc/ssl/certs/ca.cert.pem
smtp_tls_protocols           = !SSLv2, !SSLv3
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3
smtp_tls_mandatory_ciphers   = high
smtp_tls_exclude_ciphers     = aNULL, eNULL, EXPORT, DES, 3DES, RC2, RC4, MD5, PSK, SRP, DSS, AECDH, ADH
smtp_tls_note_starttls_offer = yes

# ---------------------------------------------------------------------------------------------------

# Smtpd ( INCOMING / Server )
smtpd_tls_loglevel            = 1
#smtpd_tls_auth_only           = yes
smtpd_tls_security_level      = may
smtpd_tls_received_header     = yes
smtpd_tls_protocols           = !SSLv2, !SSLv3
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
smtpd_tls_mandatory_ciphers   = medium

# Infos (voir : postconf -d)
# Medium cipherlist = aNULL:-aNULL:ALL:!EXPORT:!LOW:+RC4:@ STRENGTH
# High cipherlist   = aNULL:-aNULL:ALL:!EXPORT:!LOW:!MEDIUM:+RC4:@ STRENGTH

# smtpd_tls_exclude_ciphers   = NE PAS modifier cette directive pour des raisons de compatibilité
#                               avec les autres serveurs de mail afin d'éviter une erreur du type
#                               "no shared cipher" ou "no cipher overlap" puis un fallback en
#                               plain/text...
# smtpd_tls_cipherlist        = Ne pas modifier non plus !

#smtpd_tls_CAfile              = $smtp_tls_CAfile
#smtpd_tls_cert_file           = /etc/ssl/certs/mailserver.crt
#smtpd_tls_key_file            = /etc/ssl/private/mailserver.key
smtp_tls_CAfile                 = /etc/letsencrypt/live/myhostname. fr/chain.pem
smtpd_tls_cert_file             = /etc/letsencrypt/live/myhostname. fr/cert.pem
smtpd_tls_key_file              = /etc/letsencrypt/live/myhostname. fr/privkey.pem
smtpd_tls_dh1024_param_file   = $config_directory/dh2048.pem
smtpd_tls_dh512_param_file    = $config_directory/dh512.pem

tls_preempt_cipherlist = yes
tls_random_source      = dev:/dev/urandom

smtp_tls_session_cache_database  = btree:${data_directory}/smtp_scache
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
lmtp_tls_session_cache_database  = btree:${data_directory}/lmtp_scache

# ----------------------------------------------------------------------

#####################
## SASL PARAMETERS ##
#####################

smtpd_sasl_auth_enable          = yes
#smtp_sasl_auth_enable          = yes
smtpd_sasl_type                 = dovecot
smtpd_sasl_path                 = private/auth
smtpd_sasl_security_options     = noanonymous
smtpd_sasl_tls_security_options = $smtpd_sasl_security_options
smtpd_sasl_local_domain         = $mydomain
smtpd_sasl_authenticated_header = yes

broken_sasl_auth_clients = yes

##############################
## VIRTUALS MAPS PARAMETERS ##
##############################

virtual_uid_maps        = static:5000
virtual_gid_maps        = static:5000
virtual_minimum_uid     = 5000
virtual_mailbox_base    = /var/mail
virtual_transport       = lmtp:unix:private/dovecot-lmtp
virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf
virtual_mailbox_maps    = mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf
virtual_alias_maps      = mysql:/etc/postfix/mysql-virtual-alias-maps.cf

######################
## ERRORS REPORTING ##
######################
######################

# notify_classes = bounce, delay, resource, software
notify_classes = resource, software

error_notice_recipient     = me@ gmail. com
# delay_notice_recipient   = admin@ domain. tld
# bounce_notice_recipient  = admin@ domain. tld
# 2bounce_notice_recipient = admin@ domain. tld

##################
## RESTRICTIONS ##
##################

smtpd_recipient_restrictions =
     check_sender_access hash:/etc/postfix/rejected-recipient,
     reject_invalid_hostname,
     reject_unauth_pipelining,
     # permit_mynetworks,
     permit_sasl_authenticated,
     reject_non_fqdn_recipient,
     reject_unauth_destination,
     reject_unknown_recipient_domain,
     reject_rbl_client zen.spamhaus. org

smtpd_helo_restrictions =
     permit_mynetworks,
     permit_sasl_authenticated,
     reject_invalid_helo_hostname,
     reject_non_fqdn_helo_hostname
     # reject_unknown_helo_hostname

smtpd_client_restrictions =
     permit_mynetworks,
     permit_inet_interfaces,
     permit_sasl_authenticated,
     # reject_plaintext_session,
     # reject_unauth_pipelining

smtpd_sender_restrictions =
     check_sender_access hash:/etc/postfix/rejected-recipient,
     reject_non_fqdn_sender,
     reject_unknown_sender_domain
     #reject_sender_login_mismatch

smtpd_milters = unix:/opendkim/opendkim.sock, unix:/opendmarc/opendmarc.sock, unix:/clamav/clamav-milter.ctl
mime_header_checks = regexp:/etc/postfix/header_checks
header_checks = regexp:/etc/postfix/header_checks

In this config, i have updated to this configuration (just added reject_rbl options) : this link : howtoforge . com/block_spam_at_mta_level_postfix

So i have added :

##################
## RESTRICTIONS ##
##################

smtpd_helo_required = yes
disable_vrfy_command = yes
strict_rfc821_envelopes = yes
invalid_hostname_reject_code = 554
multi_recipient_bounce_reject_code = 554
non_fqdn_reject_code = 554
relay_domains_reject_code = 554
unknown_address_reject_code = 554
unknown_client_reject_code = 554
unknown_hostname_reject_code = 554
unknown_local_recipient_reject_code = 554
unknown_relay_recipient_reject_code = 554
unknown_sender_reject_code = 554
unknown_virtual_alias_reject_code = 554
unknown_virtual_mailbox_reject_code = 554
unverified_recipient_reject_code = 554
unverified_sender_reject_code = 554

smtpd_recipient_restrictions =
#check_sender_access hash:/etc/postfix/rejected-recipient
reject_invalid_hostname,
reject_unknown_recipient_domain,
reject_unauth_pipelining,
permit_mynetworks,
permit_sasl_authenticated,
reject_non_fqdn_recipient,
reject_unauth_destination,
reject_unknown_recipient_domain,
reject_rbl_client zen.spamhaus. org,
#reject_rbl_client multi.uribl. com,
reject_rbl_client dsn.rfc-ignorant. org,
reject_rbl_client dul.dnsbl.sorbs. net,
reject_rbl_client list.dsbl. org,
reject_rbl_client sbl-xbl.spamhaus. org,
reject_rbl_client bl.spamcop. net,
reject_rbl_client dnsbl.sorbs. net,
reject_rbl_client cbl.abuseat. org,
reject_rbl_client dnsbl.sorbs. net,
reject_rbl_client cbl.abuseat. org,
reject_rbl_client ix.dnsbl.manitu. net,
reject_rbl_client combined.rbl.msrbl. net,
reject_rbl_client rabl.nuclearelephant. com,
reject_rbl_client badconf.rhsbl.sorbs. net,
reject_rbl_client ix.dnsbl.manitu. net,
reject_rbl_client nomail.rhsbl.sorbs. net,
permit

smtpd_helo_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_invalid_helo_hostname,
reject_non_fqdn_helo_hostname
# reject_unknown_helo_hostname

smtpd_client_restrictions =
permit_mynetworks,
permit_inet_interfaces,
permit_sasl_authenticated
# reject_plaintext_session,
# reject_unauth_pipelining

smtpd_sender_restrictions =
#reject_sender_login_mismatch,
#reject_authenticated_sender_login_mismatch,
reject_unauthenticated_sender_login_mismatch,
reject_unknown_sender_domain,
permit_sasl_authenticated,
#check_sender_access hash:/etc/postfix/rejected-recipient,
reject_non_fqdn_sender

It was working perfectly but now, the spammers use mail address : XXXXXXX@ mywebsite . fr (instead of mywebsite . com) !

dovecot log :

Sep 14 10:02:15 auth-worker(10943): Info: sql(della_hall@ mywebsite . fr): unknown user
Sep 14 10:02:17 auth-worker(10943): Info: sql(joshua_spence@ mywebsite . fr): unknown user
Sep 14 10:02:18 auth-worker(10943): Info: sql(geraldine_fleming@ mywebsite . fr): unknown user
Sep 14 10:02:20 auth-worker(10943): Info: sql(genevieve_garcia@ mywebsite . fr): unknown user
Sep 14 10:02:20 auth-worker(10943): Info: sql(molly_munoz@ mywebsite . fr): unknown user
Sep 14 10:02:20 auth-worker(11073): Info: sql(jeanne_rhodes@ mywebsite . fr): unknown user
Sep 14 10:02:20 auth-worker(10943): Info: sql(samuel_barlow@ mywebsite . fr): unknown user
Sep 14 10:02:22 auth-worker(10943): Info: sql(julie_perez@ mywebsite . fr): unknown user
Sep 14 10:03:28 auth-worker(10943): Info: sql(dana_brewer@ mywebsite . fr): unknown user
Sep 14 10:03:29 auth-worker(10943): Info: sql(dana_brewer@ mywebsite . fr): unknown user
Sep 14 10:03:30 auth-worker(10943): Info: sql(dana_brewer@ mywebsite . fr): unknown user
Sep 14 10:03:31 auth-worker(10943): Info: sql(luz_newman@ mywebsite . fr): unknown user
Sep 14 10:03:33 auth-worker(10943): Info: sql(luz_newman@ mywebsite . fr): unknown user
Sep 14 10:05:01 auth-worker(11736): Info: sql(marian_mccormick@ mywebsite . fr): unknown user
Sep 14 10:05:01 auth-worker(11736): Info: sql(marian_mccormick@ mywebsite . fr): unknown user
Sep 14 10:05:03 auth-worker(11736): Info: sql(emma_welch@ mywebsite . fr): unknown user
Sep 14 10:05:03 auth-worker(11736): Info: sql(emma_welch@ mywebsite . fr): unknown user
Sep 14 10:06:51 auth-worker(11736): Info: sql(jennie_wheeler@ mywebsite . fr): unknown user
Sep 14 10:06:51 auth-worker(11736): Info: sql(samantha_porter@ mywebsite . fr): unknown user
Sep 14 10:06:51 auth-worker(11736): Info: sql(jennie_wheeler@ mywebsite . fr): unknown user
Sep 14 10:10:15 auth-worker(12510): Info: sql(lynda_little@ mywebsite . fr): unknown user
Sep 14 10:10:17 auth-worker(12510): Info: sql(deanna_salazar@ mywebsite . fr): unknown user
Sep 14 10:10:18 auth-worker(12510): Info: sql(deanna_salazar@ mywebsite . fr): unknown user
Sep 14 10:12:54 auth-worker(12871): Info: sql(candace_neal@ mywebsite . fr): unknown user
Sep 14 10:12:54 auth-worker(12871): Info: sql(suzanne_rodriguez@ mywebsite . fr): unknown user
Sep 14 10:12:54 auth-worker(12871): Info: sql(suzanne_rodriguez@ mywebsite . fr): unknown user
Sep 14 10:13:10 auth-worker(12871): Info: sql(suzanne_rodriguez@ mywebsite . fr): unknown user
Sep 14 10:13:19 auth-worker(12871): Info: sql(marsha_harris@ mywebsite . fr): unknown user
Sep 14 10:13:21 auth-worker(12871): Info: sql(marsha_harris@ mywebsite . fr): unknown user
Sep 14 10:13:21 auth-worker(12871): Info: sql(marsha_harris@ mywebsite . fr): unknown user
Sep 14 10:13:22 auth-worker(12871): Info: sql(marsha_harris@ mywebsite . fr): unknown user
Sep 14 10:13:26 auth-worker(12871): Info: sql(lorraine_bryant@ mywebsite . fr): unknown user
Sep 14 10:13:29 auth-worker(12871): Info: sql(lorraine_bryant@ mywebsite . fr): unknown user
Sep 14 10:13:29 auth-worker(12871): Info: sql(lorraine_bryant@ mywebsite . fr): unknown user
Sep 14 10:13:31 auth-worker(12871): Info: sql(gloria_mckinney@ mywebsite . fr): unknown user
Sep 14 10:14:32 auth-worker(13283): Info: sql(daniel_pickett@ mywebsite . fr): unknown user
Sep 14 10:14:32 auth-worker(13283): Info: sql(daniel_pickett@ mywebsite . fr): unknown user
Sep 14 10:14:33 auth-worker(13283): Info: sql(daniel_pickett@ mywebsite . fr): unknown user

Please, do you have any solution for me ?

marked as duplicate by Sven Sep 16 '16 at 9:04

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • Do you have SMTP Open Relay enabled? if so turn it off – Rene Sep 14 '16 at 20:09
  • Hello,thank you very much for your quick reply. I have tested with spamhelp.org/shopenrelay/shopenrelaytest.php But i get error below : Testing 62.XXX.XXX.XXX on port 25... Error - could not connect to server Is there any way to check if the SMTP relay is enabled please ? I get this in my conf : relay_domains = $mydestination relay_domains_reject_code = 554 – anthony974 Sep 14 '16 at 20:19
  • use this service to find out more mxtoolbox.com/diagnostic.aspx – Rene Sep 15 '16 at 5:45
0

Thanks everybody / Rene I solved the problem : my wordpress, even if is updated correctly, was infected with backdoor and threads files.

  • Please read the link I put on top of your question and follow it - nuke your server and reinstall. – Sven Sep 16 '16 at 9:05

Not the answer you're looking for? Browse other questions tagged or ask your own question.