7

I'm not an admin, I just created a website, and there's also a mail server on the server I payed for from my hosting provider. Most for what I learnt about mail servers is from an internet tutorials.

I'm using Open Panel (with Postfix), because I failed with configuring Exim properly. But my problems haven't come to an end.

Now I can see that my mail server probably (?) is being used by someone else, because in the /var/log/mail.log file I can see a lot of unknown email adresses, things like:

postfix/smtp[31747]: C1EF776612: to=<[email protected]>, relay=mail2.gieprod.com[195.182.17.37]:25, delay=21527, delays=21525/0.01/1.8/0, dsn=4.0.0, status=deferred (host mail2.gieprod.com[195.182.17.37] refused to talk to me: 554-mail2.gieprod.com 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)

or:

postfix/smtpd[31772]: NOQUEUE: reject: RCPT from smtp-sortant.sn.auf.org[213.154.65.69]: 550 5.1.1 <EmmanuelRoy@mydomain>: Recipient address rejected: User unknown in virtual mailbox table; from=<> to=<EmmanuelRoy@mydomain> proto=ESMTP helo=<smtp-sortant.sn.auf.org>

Does the last one means it ok, or it means something else?

These are not mine emails. And there's a lot of them, and their "RCPT TO" command usually takes 20 email adresses as I see in the log. Sometimes there appears "Throttling" (?) sentence. And they are using my domain name for many different fake email adresses as "MAIL FROM", e.g. chevassucathy@mydomain, AKZwart@mydomain, MichaelLESKINEN@mydomain, SantinaZappulla@mydomain and lots of others.

Yesterday evening I've used this to clear a queue for emails (I just learnt that there's something like a queue):

postsuper -d ALL

But today morning I can see that there are new not sent emails in a queue.

So, I wonder if I could restrict somehow using of SMTP on my server, like perhaps:

  • I could restrict using SMTP from outside (non-local) to only determined IP numbers?
  • I could not allow to send any other email adresses as "MAIL FROM" than related to the emails accounts existing (set up)?
  • other ways?

Or, am I only able to prevent this by stopping SMTP service, and launching postfix when I actually want to send an email (very uncomfortable of course)?

EDIT: I tried to do a test on this site: http://www.aboutmyip.com/AboutMyXApp/QuickServerTest.jsp

Here's what I got:

    >>> 220 name ESMTP Postfix (Debian/GNU)
    <<< EHLO u16544016.aboutmyip.com 
    >>> 250-name
    >>> 250-PIPELINING
    >>> 250-SIZE 10240000
    >>> 250-VRFY
    >>> 250-ETRN
    >>> 250-STARTTLS
    >>> 250-AUTH PLAIN LOGIN
    >>> 250-ENHANCEDSTATUSCODES
    >>> 250-8BITMIME
    >>> 250 DSN
    <<< MAIL FROM: 
    >>> 250 2.1.0 Ok
    <<< RCPT TO: 
    >>> 554 5.7.1 : Recipient address rejected: Relay access denied
    <<< QUIT 

    Connection test: PASS
    Reverse IP Lookup: WARNING - Reverse IP lookup test failed on your server. Some servers on the Internet may reject emails from this server.

    Open relay test: PASS

EDIT2: Authentication

I thought that this is an authentication - this is a content of the /etc/postfix/sasl/smtpd.conf file:

pwcheck_method: authdaemond
log_level: 3
mech_list: PLAIN LOGIN
authdaemond_path: /var/run/courier/authdaemon/socket

The SMTP server when I telnet to it seem to require e.g. to pass "auth plain [base64 with email adress and pswd]" in order to use "MAIL TO" command.

6
  • 1
    As far as I understand you have no authentication method on your SMTP server. This allows everyone to use it to send emails, and this has probably been discovered by some automated scanner. Read this to enable SASL: postfix.state-of-mind.de/patrick.koetter/smtpauth/…
    – BgrWorker
    Aug 5, 2015 at 8:36
  • @SebastianoRoncato I edited my question regarding authentication ("Edit2" at the bottom)
    – forsberg
    Aug 5, 2015 at 9:11
  • You said you are also hosting a website. Did you configure any email function on this site? Could there be vulnerabilities on the site that would allow an attacker to use your email server through it? (example: a joomla vulnerability that could allow external access to the com_mailto component, a webapp vulnerability that allows external use of the PHP mail function, a php code injection ...)
    – BgrWorker
    Aug 5, 2015 at 9:37
  • @SebastianoRoncato For the moment, I'm not using mailing from a website at all - so there's no such possibility to come email from HTTP at the moment, only standard pure SMTP. But I'm using Thunderbird app to get / send emails - so maybe this way it's possible to attack (not sure)?
    – forsberg
    Aug 5, 2015 at 9:52
  • 1
    I think your question should be "how to configure your MTA to stop relaying external email". This is more suited for serverfault. Aug 5, 2015 at 11:59

2 Answers 2

2

At first glance, your first log line looks like your mail server is trying to send bounce messages to fake senders.

In other words, you get spam with a fake sender. This gets rejected, and your system tries to return an error message but fails. The bounce gets put in the deferred queue, to be tried again.

Short-term solution is indeed to clear the queue (but use postsuper -d ALL deferred to clear only that specific queue). Also first make sure there isn't any useful e-mail in there (mailq or postqueue -p).

But also, it seems that your server is on some kind of blacklist, which may be caused by your system being abused by spammers, but could also just mean that your hoster has a poor reputation for spam (reputation systems sometimes work by blocks of IP addresses).

See also here: https://serverfault.com/questions/115161/fixing-my-mtas-poor-reputation

0

The problem described here hardly fit into the category of prevention. It's damage control and some forensics. How to prevent abuse of SMTP? Read the manuals, understand your system or at least use hardened configs, upgrade and patch often, watch logs. And now to the problem solving:

If you ever have a problem like this, the first thing to do is damage control: stop the smtp server, backup. Next step is the forensics: check where those mails are coming from? How they managed to do this?

Spot the mail ID in the problematic log line (C1EF776612 in the question) and grep for it. (Something like grep C1EF776612 /var/log/mail.log).

Check for the first line. Where does the client connecting from?

  • Is it localhost? You have a local problem. Most possibly one of your website got hacked. Please notice it is very possible to send mails even if you are not posting any mail from your sites. Furthermore any other service, even your own account could be hacked and can send mails.
  • Is it other host? One of your clients compromised or you are open proxy (this is definitely not the case in the problem above)

If you are using milters (like amavis) all your mail might come from localhost anyway (i.e. from the milter). In this case you should check the milter log lines to get the original message ID. Previous grep should reveal this one too. A second grep on the second ID will show you the real source.

After identifying the attack vector, your can make preventive steps. There are many possibilities, unfortunately the topic is too broad to cover here.

1
  • Well, I read a bit in meanwhile in the subject, and applied some suggestions from comments under my question. Now I set postfix to use some kind of auth. From now on in mail.log I can see spammers trying to use open relay SMTP server no more. However, the problem now is that even I cannot log in to the server. I tried multiple auth options, neither works (though when I use sasl auth directly with the same user and pswd, I can be authenticated; if I use the same ones when telneting to SMTP, it doesn't authenticate me...). BTW now I can see a lot of lines like from=<[email protected] in mail.log
    – forsberg
    Sep 17, 2015 at 11:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .