How to prevent abuse of SMTP by sending spam emails?

Question

I'm not an admin, I just created a website, and there's also a mail server on the server I payed for from my hosting provider. Most for what I learnt about mail servers is from an internet tutorials.

I'm using Open Panel (with Postfix), because I failed with configuring Exim properly. But my problems haven't come to an end.

Now I can see that my mail server probably (?) is being used by someone else, because in the /var/log/mail.log file I can see a lot of unknown email adresses, things like:

postfix/smtp[31747]: C1EF776612: to=<[email protected]>, relay=mail2.gieprod.com[195.182.17.37]:25, delay=21527, delays=21525/0.01/1.8/0, dsn=4.0.0, status=deferred (host mail2.gieprod.com[195.182.17.37] refused to talk to me: 554-mail2.gieprod.com 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)

or:

postfix/smtpd[31772]: NOQUEUE: reject: RCPT from smtp-sortant.sn.auf.org[213.154.65.69]: 550 5.1.1 <EmmanuelRoy@mydomain>: Recipient address rejected: User unknown in virtual mailbox table; from=<> to=<EmmanuelRoy@mydomain> proto=ESMTP helo=<smtp-sortant.sn.auf.org>

Does the last one means it ok, or it means something else?

These are not mine emails. And there's a lot of them, and their "RCPT TO" command usually takes 20 email adresses as I see in the log. Sometimes there appears "Throttling" (?) sentence. And they are using my domain name for many different fake email adresses as "MAIL FROM", e.g. chevassucathy@mydomain, AKZwart@mydomain, MichaelLESKINEN@mydomain, SantinaZappulla@mydomain and lots of others.

Yesterday evening I've used this to clear a queue for emails (I just learnt that there's something like a queue):

postsuper -d ALL

But today morning I can see that there are new not sent emails in a queue.

So, I wonder if I could restrict somehow using of SMTP on my server, like perhaps:

• I could restrict using SMTP from outside (non-local) to only determined IP numbers?
• I could not allow to send any other email adresses as "MAIL FROM" than related to the emails accounts existing (set up)?
• other ways?

Or, am I only able to prevent this by stopping SMTP service, and launching postfix when I actually want to send an email (very uncomfortable of course)?

EDIT: I tried to do a test on this site: http://www.aboutmyip.com/AboutMyXApp/QuickServerTest.jsp

Here's what I got:

    >>> 220 name ESMTP Postfix (Debian/GNU)
    <<< EHLO u16544016.aboutmyip.com 
    >>> 250-name
    >>> 250-PIPELINING
    >>> 250-SIZE 10240000
    >>> 250-VRFY
    >>> 250-ETRN
    >>> 250-STARTTLS
    >>> 250-AUTH PLAIN LOGIN
    >>> 250-ENHANCEDSTATUSCODES
    >>> 250-8BITMIME
    >>> 250 DSN
    <<< MAIL FROM: 
    >>> 250 2.1.0 Ok
    <<< RCPT TO: 
    >>> 554 5.7.1 : Recipient address rejected: Relay access denied
    <<< QUIT 

    Connection test: PASS
    Reverse IP Lookup: WARNING - Reverse IP lookup test failed on your server. Some servers on the Internet may reject emails from this server.

    Open relay test: PASS

EDIT2: Authentication

I thought that this is an authentication - this is a content of the /etc/postfix/sasl/smtpd.conf file:

pwcheck_method: authdaemond
log_level: 3
mech_list: PLAIN LOGIN
authdaemond_path: /var/run/courier/authdaemon/socket

The SMTP server when I telnet to it seem to require e.g. to pass "auth plain [base64 with email adress and pswd]" in order to use "MAIL TO" command.

Answer 1

At first glance, your first log line looks like your mail server is trying to send bounce messages to fake senders.

In other words, you get spam with a fake sender. This gets rejected, and your system tries to return an error message but fails. The bounce gets put in the deferred queue, to be tried again.

Short-term solution is indeed to clear the queue (but use postsuper -d ALL deferred to clear only that specific queue). Also first make sure there isn't any useful e-mail in there (mailq or postqueue -p).

But also, it seems that your server is on some kind of blacklist, which may be caused by your system being abused by spammers, but could also just mean that your hoster has a poor reputation for spam (reputation systems sometimes work by blocks of IP addresses).

See also here: https://serverfault.com/questions/115161/fixing-my-mtas-poor-reputation

Answer 2

The problem described here hardly fit into the category of prevention. It's damage control and some forensics. How to prevent abuse of SMTP? Read the manuals, understand your system or at least use hardened configs, upgrade and patch often, watch logs. And now to the problem solving:

If you ever have a problem like this, the first thing to do is damage control: stop the smtp server, backup. Next step is the forensics: check where those mails are coming from? How they managed to do this?

Spot the mail ID in the problematic log line (C1EF776612 in the question) and grep for it. (Something like grep C1EF776612 /var/log/mail.log).

Check for the first line. Where does the client connecting from?

• Is it localhost? You have a local problem. Most possibly one of your website got hacked. Please notice it is very possible to send mails even if you are not posting any mail from your sites. Furthermore any other service, even your own account could be hacked and can send mails.
• Is it other host? One of your clients compromised or you are open proxy (this is definitely not the case in the problem above)

If you are using milters (like amavis) all your mail might come from localhost anyway (i.e. from the milter). In this case you should check the milter log lines to get the original message ID. Previous grep should reveal this one too. A second grep on the second ID will show you the real source.

After identifying the attack vector, your can make preventive steps. There are many possibilities, unfortunately the topic is too broad to cover here.