1

My Spool folder grows daily to gigs of data. The server is used only by me. I have couple of e-mails created under a couple of my domains attached to that server, but there is near to none mail traffic that I initiate.

I mainly expected these mail boxes to receive mail which i grab out periodically.

I have a dovecot+postfix duo.

But since not so long ago, the whole mail setup seems to become funky. I don't really get any mail (though mail clients authenticate correctly - no errors) and I get my spool folder filling up the entire free space.

Upon checking mailq - it's full of garbage not related to me in any way = spam.

I shut down postfix for couple of days = mailq keeps growing. I've blocked port 25 for couple of days = mailq keeps growing...

mail.log is empty for unknown to me reason. mail.err has some irrelevant couple of lines.

How else can I check what's going on?

1 Answer 1

3

It is likely a local sender using the sendmail command; postfix doesn't need to be running for a local sender to add things to the mail queue. If you're running any web apps, I'd assume one has been compromised and is trying to send spam.

References:

http://www.postfix.org/mailq.1.html

http://www.postfix.org/postdrop.1.html

It is possible to limit which users can send via sendmail/postdrop. It may be worth enforcing use of the SMTP server along with SASL authentication, instead of allowing local users to drop directly into the queue.

2
  • I think you are right about the compromised web app (i have a couple, would suspect wordpress - will be checking it), but meanwhile, i even stopped sendmail - mailq still grows...i don't get it anymore:) and no logs anywhere... Commented Jul 1, 2017 at 11:55
  • "sendmail" is not a service you can stop (I mean, it is, if your system is running sendmail but you said you're running Postfix). The sendmail I'm talking about is the command provided by postfix to drop mail into the queue. It isn't a service. It starts when it is called, it drops mail directly into the queue, and then exits. You cannot stop it, but you can restrict which users can use it, as mentioned in my answer.
    – swelljoe
    Commented Jul 2, 2017 at 1:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .