0

My postfix server and website (WordPress, Apache) resides on the same server box. 2 days ago, we decided to use 3rd party smtp relay host for our mail server. All the DKIM and spf records are in place. They are also validated as domain by the 3rd party smtp provider.

So far, so good. I received message from the 3rd party provider stating that I need to remove gmail, aol etc. free senders from my validation list. Somehow, some people tries to send mails using our smtp server. Seemingly, this originates from the website. Here is the maillog sniplet to show what is going on:

Maillog excerpt

Mar 2 21:55:13 linsvr postfix/pickup[29824]: 25277220008: uid=48 from=
Mar 2 21:55:13 linsvr postfix/cleanup[31693]: 25277220008: message-id=<[email protected]>
Mar 2 21:55:13 linsvr opendkim[25596]: 25277220008: no signing table match for '[email protected]'
Mar 2 21:55:13 linsvr opendkim[25596]: 25277220008: no signature data Mar 2 21:55:13 linsvr postfix/qmgr[9766]: 25277220008: from=, size=638, nrcpt=1 (queue active)
Mar 2 21:55:13 linsvr amavis[15091]: (15091-12) ESMTP :10024 /var/spool/amavisd/tmp/amavis-20190302T140517-15091-fQptiP_v: -> SIZE=638 Received: from mail.mydomain.com ([127.0.0.1]) by localhost (mail.mydomain.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP for ; Sat, 2 Mar 2019 21:55:13 +0300 (+03) Mar 2 21:55:13 linsvr amavis[15091]: (15091-12) Checking: ZnqhsWDKWMOr [127.0.0.1] ->
Mar 2 21:55:13 linsvr amavis[15091]: (15091-12) p001 1 Content-Type: text/html, 7bit, size: 157, SHA1 digest: 69dbad8db3546a316ce6dbb17f2b13d26c929154
Mar 2 21:55:13 linsvr amavis[15091]: (15091-12) wbl: soft-whitelisted (-20) sender => , recip_key="."
Mar 2 21:55:29 linsvr amavis[15091]: (15091-12) spam-tag, -> , No, score=-6.956 tagged_above=-999 required=6.2 tests=[AM.WBL=-20, BAYES_99=3.5, BAYES_999=0.2, DKIM_ADSP_CUSTOM_MED=0.001, FREEMAIL_FORGED_FROMDOMAIN=0.001, FREEMAIL_FROM=0.001, FSL_BULK_SIG=0.839, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, HTML_MIME_NO_HTML_TAG=0.377, KAM_LINKBAIT3=1.5, MALFORMED_FREEMAIL=0.001, MIME_HTML_ONLY=0.723, NML_ADSP_CUSTOM_MED=0.9, NO_RELAYS=-0.001, RAZOR2_CF_RANGE_51_100=2.5, RAZOR2_CHECK=2.5] autolearn=no autolearn_force=no Mar 2 21:55:29 linsvr postfix/smtpd[31781]: connect from localhost[127.0.0.1]
Mar 2 21:55:29 linsvr postfix/smtpd[31781]: EAD92220007: client=localhost[127.0.0.1] Mar 2 21:55:29 linsvr postfix/cleanup[31693]: EAD92220007: message-id=<[email protected]>
Mar 2 21:55:29 linsvr postfix/qmgr[9766]: EAD92220007: from=, size=1708, nrcpt=1 (queue active)
Mar 2 21:55:29 linsvr postfix/smtpd[31781]: disconnect from localhost[127.0.0.1]
Mar 2 21:55:29 linsvr amavis[15091]: (15091-12) ZnqhsWDKWMOr FWD from -> , BODY=7BIT 250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as EAD92220007
Mar 2 21:55:29 linsvr amavis[15091]: (15091-12) Passed CLEAN {RelayedInbound}, [127.0.0.1] -> , Message-ID: <[email protected]>, mail_id: ZnqhsWDKWMOr, Hits: -6.956, size: 671, queued_as: EAD92220007, 16754 ms
Mar 2 21:55:29 linsvr amavis[15091]: (15091-12) TIMING-SA total 16625 ms - parse: 0.74 (0.0%), extract_message_metadata: 8 (0.0%), get_uri_detail_list: 0.49 (0.0%), tests_pri_-1000: 2.00 (0.0%), tests_pri_-950: 0.76 (0.0%), tests_pri_-900: 1.07 (0.0%), tests_pri_-90: 8 (0.0%), check_bayes: 6 (0.0%), b_tokenize: 2.1 (0.0%), b_tok_get_all: 0.95 (0.0%), b_comp_prob: 1.13 (0.0%), b_tok_touch_all: 0.06 (0.0%), b_finish: 0.56 (0.0%), tests_pri_0: 11061 (66.5%), check_dkim_signature: 0.49 (0.0%), check_spf: 0.25 (0.0%), tests_pri_10: 4290 (25.8%), check_dcc: 4283 (25.8%), tests_pri_20: 1179 (7.1%), check_razor2: 1175 (7.1%), tests_pri_30: 58 (0.3%), check_pyzor: 56 (0.3%), tests_pri_500: 7 (0.0%), get_report: 0.80 (0.0%)
Mar 2 21:55:29 linsvr amavis[15091]: (15091-12) size: 671, TIMING [total 16757 ms] - SMTP greeting: 1.5 (0%)0, SMTP EHLO: 0.5 (0%)0, SMTP pre-MAIL: 0.3 (0%)0, SMTP MAIL: 0.8 (0%)0, SMTP pre-DATA-flush: 0.8 (0%)0, SMTP DATA: 41 (0%)0, check_init: 0.4 (0%)0, digest_hdr: 0.3 (0%)0, digest_body: 0.1 (0%)0, collect_info: 0.8 (0%)0, mime_decode: 5 (0%)0, get-file-type1: 15 (0%)0, parts_decode: 0.1 (0%)0, check_header: 0.3 (0%)0, AV-scan-1: 19 (0%)1, spam-wb-list: 1.1 (0%)1, SA msg read: 0.5 (0%)1, SA parse: 1.3 (0%)1, SA check: 16620 (99%)100, decide_mail_destiny: 8 (0%)100, notif-quar: 0.3 (0%)100, fwd-connect: 18 (0%)100, fwd-mail-pip: 8 (0%)100, fwd-rcpt-pip: 0.2 (0%)100, fwd-data-chkpnt: 0.0 (0%)100, write-header: 0.3 (0%)100, fwd-data-contents: 0.0 (0%)100, fwd-end-chkpnt: 6 (0%)100, prepare-dsn: 0.6 (0%)100, report: 1.3 (0%)100, main_log_entry: 3.5 (0%)100, update_snmp: 1.1 (0%)100, SMTP pre-response: 0.2 (0%)100, SMTP response: 0.2 (0%)100, unlink-2-files: 0.2 (0%)100, rundown: 0.6 (0%)100
Mar 2 21:55:29 linsvr postfix/smtp[31699]: 25277220008: to=, relay=127.0.0.1[127.0.0.1]:10024, delay=17, delays=0.07/0.01/0/17, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as EAD92220007) Mar 2 21:55:29 linsvr postfix/qmgr[9766]: 25277220008: removed Mar 2 21:55:30 linsvr postfix/smtp[31784]: EAD92220007: to=, relay=in.mailjet.com[104.199.96.85]:25, delay=0.5, delays=0.01/0.02/0.4/0.07, dsn=2.0.0, status=sent (250 OK queued as 49e13879-c3e9-4012-ba3a-c7caff2b9d41)
Mar 2 21:55:30 linsvr postfix/qmgr[9766]: EAD92220007: removed}

Can someone enlighten me on this? And how to fix?

Thanks.

3
  • 1
    Not sure what exactly they asked of you. You may be an open relay perhaps. But as a random note: most self-hosting e-mail servers from the companies I know of have the top 2 deny all positions occupied by AOL and hotmail. 99.98% of what's coming from there is confirmed spam.
    – Overmind
    Mar 4, 2019 at 12:35
  • They ask us to delete any gmail, hotmail, etc address in the sender list. It is not open relay as confirmed by some testing sites. However, I suspect that someone has got the username:password of a legitimate user or WordPress site has a security problem. The code sniplet show that those email originates from the website. But, I don't know how.
    – sse450
    Mar 4, 2019 at 12:52
  • This is strange, why would you authorize such senders initially ?
    – Overmind
    Mar 4, 2019 at 13:08

1 Answer 1

1

The Postfix pickup process seems to be indicating that these messages are being generated locally by the apache user.

Is your WordPress version up to date with security updates? If not, it's probably being hacked. The intruder may have used a WordPress vulnerability that allows them to submit a PHP script of their own to be run by WordPress, and that script is acting as an unauthorized email generator/forwarder. They might even be doing that separately for each email they're sending, and making the script delete itself as it's done its deed.

Otherwise, do you have an unprotected or vulnerable email sending script (PHP, CGI or whatever) in your website?

Your Postfix email server might not be an open relay, and that is what those testing sites are likely to be testing; but something in the Apache + PHP + WordPress combination is allowing the intruder to get in and use the local facilities to send email out. And as far as Postfix is concerned, those messages are originating locally, so they are not subject to relay checks.

As a result, even though your Postfix may not be an open relay, your server taken as a whole effectively is. The intruder just needs to use a bit more complex protocol than plain SMTP to submit messages, but the "exploit an unpatched WordPress" protocol is very well known among spammers.

2
  • This is my guess also.
    – Overmind
    Mar 4, 2019 at 13:29
  • WordPress was not updated untill 2-3 days ago. I think you are right. The must be a problem with Apache + PHP + WordPress. I had plugin for newsletter. Deactivated now. I will check it carefully and report if I find anything. Thank you.
    – sse450
    Mar 4, 2019 at 13:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .