0

I'm keep seeing these lines in the Postfix maillog, from serveral unknown non-local email-addresses:

Oct  3 08:47:32 srv04 postfix/pickup[86325]: F020C5C1101: uid=80 from=<[email protected]>
Oct  3 08:47:32 srv04 postfix/cleanup[87544]: F020C5C1101: message-id=<[email protected]>
Oct  3 08:47:33 srv04 postfix/qmgr[86326]: F020C5C1101: from=<[email protected]>, size=621, nrcpt=1 (queue active)
Oct  3 08:47:34 srv04 postfix/smtp[87546]: F020C5C1101: to=<[email protected]>, relay=mta5.am0.yahoodns.net[74.6.137.63]:25, delay=2, delays=0.2/0.02/0.55/1.2, dsn=2.0.0, status=sent (250 ok dirdel)
Oct  3 08:47:34 srv04 postfix/qmgr[86326]: F020C5C1101: removed

I'm logging mail with PHP, and they doesn't seem to be coming from any PHP-scripts either?!

mail.add_x_header = On
mail.log = /var/log/phpmail.log

The Postfix email server i set up as a simple only sending local email from a few websites (Magento, Wordpress etc).

Thanks,

Improve this question
4
  • One of two things: Either your postfix is configured to act as an open relay, or your server has been compromised so that something other than your PHP log is being used to send the emails. It is impossible to tell which from what little information you give.
    – Jenny D
    Oct 3, 2018 at 8:30
  • We have tested the server for open relay issues, and it's not open, so it must be something else. The server is a newly installed FreeBSD 11.2.
    – Aknot
    Oct 3, 2018 at 13:46
  • Tack för ditt svar också, så klart! ;-)
    – Aknot
    Oct 3, 2018 at 13:53
  • Varsågod! Jag skulle satsa en slant på att det körs något script i webbservern som inte borde köras... Lycka till!
    – Jenny D
    Oct 3, 2018 at 13:54

1 Answer 1

Reset to default
1

UID 80 is probably what your web server is running as, so you can be quite sure that something on your web server has been compromised and is sending mail.

That you don't see this in the PHP mail log is because the rogue script is probably not usign the mail() function but is directly invoking sendmail (which is why the UID 80 is logged by postfix).

You need to investigate your web server log for accesses at the time of the mails being received, that way you might find out what script is doing this. But first: stop your web server to stop this spam being sent out. It's a matter of time until your server is blacklisted.

probably best to wipe the document root and restore from backup. Then ensure that all updates to web server and web applications is applies to prevent a repetition of events.

Improve this answer
2
  • Thanks for your answer! The server is installed from scratch, it's a fresh FreeBSD 11.2, including all server software. The only thing that's moved, is all websites (Magento, Wordpress etc). Isn't there a way to check what's invoking sendmail in some way?
    – Aknot
    Oct 3, 2018 at 13:49
  • As I wrote, check what's being accessed on the webserver at the times of the mail being sent.
    – wurtel
    Oct 5, 2018 at 8:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .