1

I have a centos 6.5 server running apache and hosting about 8 domains. There is also postfix 2.6 installed serving these local domains to send emails generated by php (website contact forms). Postfix installation is default. No modifications have been made to main.cf or any other file.

Now, one of the websites has been hacked and is sending spam emails using addresses such as: random_user1@hacked_domain.com, random_user2@hacked_domain.com, random_user3@hacked_domain.com (hacked_domain.com is the actual domain name of the hacked website)

I want to block this particular (local) domain from sending, while all other domains sould send normally. So far, I have created a "blacklist" which I saved in postfix folder named "rbl_blacklist" and looks like that:

hacked_domain.com    REJECT

How can I use this file in main.cf in order to prevent messages from ***@hacked_domain.com from being sent?

(also, any other suggestions are welcome)

EDIT:

I do not want to block certain users, since there aren't any! I just want to block all email messages that are sent from: *@hacked_domain.com from being sent!

  • 1
    Possible duplicate of Postfix block local user from sending – iwaseatenbyagrue Mar 16 '17 at 8:10
  • @iwaseatenbyagrue I am not asking about blocking a single user here, but about a whole local domain name. – captain theo Mar 16 '17 at 8:13
  • I think this is a duplicate of serverfault.com/questions/530406/… - you should be able to sender smtpd_sender_restrictions to use an access db, and configure the required action for these emails (see postfix.org/access.5.html) – iwaseatenbyagrue Mar 16 '17 at 8:13
  • I do understand that, but figured that question was very close to your use case: you need to block one domain of several, and the mechanisms suggested in the answers of that question are I think the same you would need to use - you would just be using a different matching. This is only my opinion, of course, and the intention was to try and point to what seemed like a good approach - not to dismiss your question. – iwaseatenbyagrue Mar 16 '17 at 8:16
  • @iwaseatenbyagrue It's no point in blocking certain user(s) as these are generated automatically by the hacked website (like hundreds per minute). Until I find the origin of the problem, I need a drastic solution to prohibit the entire domain name. – captain theo Mar 16 '17 at 8:19
1

The approach mentionned in the question I suggested might be a duplicate of this one (Postfix block local user from sending) can help prevent your issue if a single, local account is being used to submit these emails in the first place.

Since you mentionned a "php (website contact forms).", I had assumed you might have one user running PHP per domain, and would be able to prevent the user linked to the form on the hacked domain from submitting emails.

However, if you do need to prevent postfix from sending out emails from that domain, you could use smptd_sender_restrictions (http://www.postfix.org/postconf.5.html#smtpd_sender_restrictions) - which is also mentioned in the question I linked to.

Spefically, you could use check_sender_access and configure a suitable lookup table, e.g:

 smtpd_sender_restrictions = check_sender_access hash:/etc/postfix/block_spam_access

You could then use the blacklist you created to populate /etc/postfix/block_spam_access (or whatever path you chose), and this should help.

See http://www.postfix.org/access.5.html for other options than REJECT (DISCARD may be useful).

Another approach might be using transport maps, possibly using sender_dependent_relayhost_maps (http://www.postfix.org/postconf.5.html#sender_dependent_relayhost_maps).

See http://www.postfix.org/transport.5.html for the transport syntax - you probably want something like: hacked_domain.tld error:mail for hacked_domain.tld is not deliverable

  • Thank you for your answer, but that didn't work. Maybe because these messages are generated by php and not by a particular user :( By the way, there are no users configured on this server, as this is only for web-hosting. (there is a different mail server serving mail for this domain with register users, and works fine!) – captain theo Mar 16 '17 at 8:48
  • I tried the "blackhole" solution but didn't work. It works when the recipient is whatever@hacked_domain.com but when the sender is whatever@hacked_domain.com is relaying :( – captain theo Mar 16 '17 at 9:25
1

The solution was "header_checks"

In main.cf comment out any "header_checks" lines -if exist and then add:

header_checks = pcre:/etc/postfix/header_checks.pcre

Create header_checks.pcre file (at the postfix folder)

# cd /etc/postfix
# vi header_checks.pcre

inside header_checks.pcre file added the following line:

/^From:((?![^@]*?user1|[^@]*?user2|[^@]*?user3|[^@]*?webmaster)[^@]*?)@hacked_domain\.com/ DISCARD

(we allow only user1, user2, user3 and webmaster to send emails -the other addresses get discarded!)

# service postfix restart

...and worked!

Hope that helps others with similar issues!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.