I use ubuntu with postfix/dovecot for e-mail purpose. Now I have the problem that mails are being sent by unauthorized user, despite the fact that I don't have an open relay.
mail.log contains such lines:
Mar 9 14:12:00 my-host postfix/pickup: 670148A00C6: uid=10002 from=<email@example.com> Mar 9 14:12:00 my-host postfix/cleanup: 670148A00C6: message-id=<firstname.lastname@example.org> Mar 9 14:12:00 my-host postfix/qmgr: 670148A00C6: from=<email@example.com>, size=780, nrcpt=1 (queue active) Mar 9 14:12:01 my-host postfix/smtp: 670148A00C6: to=<firstname.lastname@example.org>, relay=mx1.data.ch[188.8.131.52]:25, delay=1.1, delays=0.1/0/0.55/0.49, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as 6F6A0200C0) Mar 9 14:12:01 my-host postfix/qmgr: 670148A00C6: removed
I thought my postfix setup is correct :
smtpd_sender_restrictions = check_sender_access hash:/var/spool/postfix/plesk/blacklists, permit_sasl_authenticated smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_rbl_client zen.spamhaus.org
Where does the mail come from? I don't see a login from the spammer, so it has to be some script on the host. I really would like to locate the source but I don't know how.