0

My postfix server and website (WordPress, Apache) resides on the same server box. 2 days ago, we decided to use 3rd party smtp relay host for our mail server. All the DKIM and spf records are in place. They are also validated as domain by the 3rd party smtp provider.

So far, so good. I received message from the 3rd party provider stating that I need to remove gmail, aol etc. free senders from my validation list. Somehow, some people tries to send mails using our smtp server. Seemingly, this originates from the website. Here is the maillog sniplet to show what is going on:

Maillog excerpt

Mar 2 21:55:13 linsvr postfix/pickup[29824]: 25277220008: uid=48 from=
Mar 2 21:55:13 linsvr postfix/cleanup[31693]: 25277220008: message-id=<20190302185513.25277220008@mail.mydomain.com>
Mar 2 21:55:13 linsvr opendkim[25596]: 25277220008: no signing table match for 'senderemail@gmail.com'
Mar 2 21:55:13 linsvr opendkim[25596]: 25277220008: no signature data Mar 2 21:55:13 linsvr postfix/qmgr[9766]: 25277220008: from=, size=638, nrcpt=1 (queue active)
Mar 2 21:55:13 linsvr amavis[15091]: (15091-12) ESMTP :10024 /var/spool/amavisd/tmp/amavis-20190302T140517-15091-fQptiP_v: -> SIZE=638 Received: from mail.mydomain.com ([127.0.0.1]) by localhost (mail.mydomain.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP for ; Sat, 2 Mar 2019 21:55:13 +0300 (+03) Mar 2 21:55:13 linsvr amavis[15091]: (15091-12) Checking: ZnqhsWDKWMOr [127.0.0.1] ->
Mar 2 21:55:13 linsvr amavis[15091]: (15091-12) p001 1 Content-Type: text/html, 7bit, size: 157, SHA1 digest: 69dbad8db3546a316ce6dbb17f2b13d26c929154
Mar 2 21:55:13 linsvr amavis[15091]: (15091-12) wbl: soft-whitelisted (-20) sender => , recip_key="."
Mar 2 21:55:29 linsvr amavis[15091]: (15091-12) spam-tag, -> , No, score=-6.956 tagged_above=-999 required=6.2 tests=[AM.WBL=-20, BAYES_99=3.5, BAYES_999=0.2, DKIM_ADSP_CUSTOM_MED=0.001, FREEMAIL_FORGED_FROMDOMAIN=0.001, FREEMAIL_FROM=0.001, FSL_BULK_SIG=0.839, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, HTML_MIME_NO_HTML_TAG=0.377, KAM_LINKBAIT3=1.5, MALFORMED_FREEMAIL=0.001, MIME_HTML_ONLY=0.723, NML_ADSP_CUSTOM_MED=0.9, NO_RELAYS=-0.001, RAZOR2_CF_RANGE_51_100=2.5, RAZOR2_CHECK=2.5] autolearn=no autolearn_force=no Mar 2 21:55:29 linsvr postfix/smtpd[31781]: connect from localhost[127.0.0.1]
Mar 2 21:55:29 linsvr postfix/smtpd[31781]: EAD92220007: client=localhost[127.0.0.1] Mar 2 21:55:29 linsvr postfix/cleanup[31693]: EAD92220007: message-id=<20190302185513.25277220008@mail.mydomain.com>
Mar 2 21:55:29 linsvr postfix/qmgr[9766]: EAD92220007: from=, size=1708, nrcpt=1 (queue active)
Mar 2 21:55:29 linsvr postfix/smtpd[31781]: disconnect from localhost[127.0.0.1]
Mar 2 21:55:29 linsvr amavis[15091]: (15091-12) ZnqhsWDKWMOr FWD from -> , BODY=7BIT 250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as EAD92220007
Mar 2 21:55:29 linsvr amavis[15091]: (15091-12) Passed CLEAN {RelayedInbound}, [127.0.0.1] -> , Message-ID: <20190302185513.25277220008@mail.mydomain.com>, mail_id: ZnqhsWDKWMOr, Hits: -6.956, size: 671, queued_as: EAD92220007, 16754 ms
Mar 2 21:55:29 linsvr amavis[15091]: (15091-12) TIMING-SA total 16625 ms - parse: 0.74 (0.0%), extract_message_metadata: 8 (0.0%), get_uri_detail_list: 0.49 (0.0%), tests_pri_-1000: 2.00 (0.0%), tests_pri_-950: 0.76 (0.0%), tests_pri_-900: 1.07 (0.0%), tests_pri_-90: 8 (0.0%), check_bayes: 6 (0.0%), b_tokenize: 2.1 (0.0%), b_tok_get_all: 0.95 (0.0%), b_comp_prob: 1.13 (0.0%), b_tok_touch_all: 0.06 (0.0%), b_finish: 0.56 (0.0%), tests_pri_0: 11061 (66.5%), check_dkim_signature: 0.49 (0.0%), check_spf: 0.25 (0.0%), tests_pri_10: 4290 (25.8%), check_dcc: 4283 (25.8%), tests_pri_20: 1179 (7.1%), check_razor2: 1175 (7.1%), tests_pri_30: 58 (0.3%), check_pyzor: 56 (0.3%), tests_pri_500: 7 (0.0%), get_report: 0.80 (0.0%)
Mar 2 21:55:29 linsvr amavis[15091]: (15091-12) size: 671, TIMING [total 16757 ms] - SMTP greeting: 1.5 (0%)0, SMTP EHLO: 0.5 (0%)0, SMTP pre-MAIL: 0.3 (0%)0, SMTP MAIL: 0.8 (0%)0, SMTP pre-DATA-flush: 0.8 (0%)0, SMTP DATA: 41 (0%)0, check_init: 0.4 (0%)0, digest_hdr: 0.3 (0%)0, digest_body: 0.1 (0%)0, collect_info: 0.8 (0%)0, mime_decode: 5 (0%)0, get-file-type1: 15 (0%)0, parts_decode: 0.1 (0%)0, check_header: 0.3 (0%)0, AV-scan-1: 19 (0%)1, spam-wb-list: 1.1 (0%)1, SA msg read: 0.5 (0%)1, SA parse: 1.3 (0%)1, SA check: 16620 (99%)100, decide_mail_destiny: 8 (0%)100, notif-quar: 0.3 (0%)100, fwd-connect: 18 (0%)100, fwd-mail-pip: 8 (0%)100, fwd-rcpt-pip: 0.2 (0%)100, fwd-data-chkpnt: 0.0 (0%)100, write-header: 0.3 (0%)100, fwd-data-contents: 0.0 (0%)100, fwd-end-chkpnt: 6 (0%)100, prepare-dsn: 0.6 (0%)100, report: 1.3 (0%)100, main_log_entry: 3.5 (0%)100, update_snmp: 1.1 (0%)100, SMTP pre-response: 0.2 (0%)100, SMTP response: 0.2 (0%)100, unlink-2-files: 0.2 (0%)100, rundown: 0.6 (0%)100
Mar 2 21:55:29 linsvr postfix/smtp[31699]: 25277220008: to=, relay=127.0.0.1[127.0.0.1]:10024, delay=17, delays=0.07/0.01/0/17, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as EAD92220007) Mar 2 21:55:29 linsvr postfix/qmgr[9766]: 25277220008: removed Mar 2 21:55:30 linsvr postfix/smtp[31784]: EAD92220007: to=, relay=in.mailjet.com[104.199.96.85]:25, delay=0.5, delays=0.01/0.02/0.4/0.07, dsn=2.0.0, status=sent (250 OK queued as 49e13879-c3e9-4012-ba3a-c7caff2b9d41)
Mar 2 21:55:30 linsvr postfix/qmgr[9766]: EAD92220007: removed}

Can someone enlighten me on this? And how to fix?

Thanks.

  • 1
    Not sure what exactly they asked of you. You may be an open relay perhaps. But as a random note: most self-hosting e-mail servers from the companies I know of have the top 2 deny all positions occupied by AOL and hotmail. 99.98% of what's coming from there is confirmed spam. – Overmind Mar 4 at 12:35
  • They ask us to delete any gmail, hotmail, etc address in the sender list. It is not open relay as confirmed by some testing sites. However, I suspect that someone has got the username:password of a legitimate user or WordPress site has a security problem. The code sniplet show that those email originates from the website. But, I don't know how. – sse450 Mar 4 at 12:52
  • This is strange, why would you authorize such senders initially ? – Overmind Mar 4 at 13:08
1

The Postfix pickup process seems to be indicating that these messages are being generated locally by the apache user.

Is your WordPress version up to date with security updates? If not, it's probably being hacked. The intruder may have used a WordPress vulnerability that allows them to submit a PHP script of their own to be run by WordPress, and that script is acting as an unauthorized email generator/forwarder. They might even be doing that separately for each email they're sending, and making the script delete itself as it's done its deed.

Otherwise, do you have an unprotected or vulnerable email sending script (PHP, CGI or whatever) in your website?

Your Postfix email server might not be an open relay, and that is what those testing sites are likely to be testing; but something in the Apache + PHP + WordPress combination is allowing the intruder to get in and use the local facilities to send email out. And as far as Postfix is concerned, those messages are originating locally, so they are not subject to relay checks.

As a result, even though your Postfix may not be an open relay, your server taken as a whole effectively is. The intruder just needs to use a bit more complex protocol than plain SMTP to submit messages, but the "exploit an unpatched WordPress" protocol is very well known among spammers.

  • This is my guess also. – Overmind Mar 4 at 13:29
  • WordPress was not updated untill 2-3 days ago. I think you are right. The must be a problem with Apache + PHP + WordPress. I had plugin for newsletter. Deactivated now. I will check it carefully and report if I find anything. Thank you. – sse450 Mar 4 at 13:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.