I have one Postfix SMTP server with hundreds of users, which are using it to send e-mails as authenticated users.

Sometimes one account is hacked and thousand e-mails become to go out from the SMTP server, starting a spam flooding to hundreds of e-mail addresses.

This obviously make my server to be inserted into many blacklist and when I realise I need to:

  • fix the hacked account (and educate users to use good password and to change them frequently)
  • stop the flooding removing spam messages from the outgoing queue
  • check the IP address into blacklists and remove them if needed
  • monitor outgoing e-mails to check if they are marked as spam

Now I want to understand how I can efficiently prevent the flooding before it happens, because we cannot risk to be inserted into any blacklist. I think this could be reached with:

  • force users to use a good password: this can be easily reached if you are using an authentication backend like Active Directory, but what about Postfix users and virtual domains saved into the database?
  • activating fail2ban on SMTP services (but this does not work if hackers already know passwords and use them at the first try)
  • implementing some flooding detection like outgoing rate detection for the same users which could stop relay for a specific user if it's spamming: what technology can be used on top of Postfix to achieve this?
  • monitoring: some Nagios/Icinga checks for the elements in the Postfix outgoing queue (but could be too late)
  • monitoring: a lot of services which can check if the IP address is into some blacklist (but too late)

Any other idea?

  • My first experience with LDAP was with the ancient ancestor of 389-ds, and the directory passwords were initially seeded from a unix shadow password file. These passwords needed to be marked {crypt} when they were set, but it worked, and provided a graceful transition from local passwords to network passwords. I would expect other password databases and other LDAP servers could be handled in a similar fashion. (Similar, not exactly the same. The specific differences would need to be worked out.) – Ed Grimm Jan 26 at 23:09
  • I was a postmaster for most of the prior decade, but reorged out of that position about 11 years ago. At that time, I was frustrated with the dearth of tools to detect and block spam flooding from a local user to outside. Reading this question, I thought, surely things have improved by this point. I thought this would be an easy google search by this point. I was clearly wrong. To me, it's simple; if you want to stop spam, support ISPs blocking it before they send it. – Ed Grimm Jan 26 at 23:45
  • Question: how does client email get to your server? Does it enter through the same SMTP port as external email, does it get placed on postfix's pickup queue like it was generated locally on the server, or something else? – Ed Grimm Jan 26 at 23:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.