0

I use ubuntu with postfix/dovecot for e-mail purpose. Now I have the problem that mails are being sent by unauthorized user, despite the fact that I don't have an open relay.

My mail.log contains such lines:

Mar  9 14:12:00 my-host postfix/pickup[10204]: 670148A00C6: uid=10002 from=<spam@sender.com>
Mar  9 14:12:00 my-host postfix/cleanup[12610]: 670148A00C6: message-id=<c94dd1e890114811b2f62c221380c5da@my-host.com>
Mar  9 14:12:00 my-host postfix/qmgr[9110]: 670148A00C6: from=<spam@sender.com>, size=780, nrcpt=1 (queue active)
Mar  9 14:12:01 my-host postfix/smtp[12594]: 670148A00C6: to=<victim@mail.ch>, relay=mx1.data.ch[212.212.212.212]:25, delay=1.1, delays=0.1/0/0.55/0.49, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as 6F6A0200C0)
Mar  9 14:12:01 my-host postfix/qmgr[9110]: 670148A00C6: removed

I thought my postfix setup is correct :

smtpd_sender_restrictions = check_sender_access hash:/var/spool/postfix/plesk/blacklists, permit_sasl_authenticated
smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_rbl_client zen.spamhaus.org

Where does the mail come from? I don't see a login from the spammer, so it has to be some script on the host. I really would like to locate the source but I don't know how.

2

The pickup(8) daemon waits for hints that new mail has been dropped into the maildrop directory, and feeds it into the cleanup(8) daemon. Ill-formatted files are deleted without notifying the originator.


The "maildrop" queue

Messages that have been submitted via the Postfix sendmail(1) command, but not yet brought into the main Postfix queue by the pickup(8) service, await processing in the "maildrop" queue.

Therefore, the first line tells that the mail comes from a local source via Sendmail:

Mar  9 14:12:00 my-host postfix/pickup[10204]: 670148A00C6: uid=10002 from=<spam@sender.com>

It also tells that the originating user has UID 10002. Look for any scripts run as that user. I'd first compare the web server logs for the user i.e. the VirtualHosts related to that account – at and just before Mar 9 14:12:00. That might reveal a HTTP request (most likely a POST request) that was used for sending this email.

  • 1
    Thanks the source was a buggy/old public contact form in joomla which was misused by spambots. I could identify it with the access-logs. – Peter Mar 9 at 17:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.