Page 1 of 8 123 ... LastLast
Results 1 to 10 of 79

Thread: My server is sending spam

  1. #1
    Join Date
    Sep 2008
    Beans
    193
    Distro
    Ubuntu 12.04 Precise Pangolin

    My server is sending spam

    Okay, I got a phone call from my ISP telling me that my server is sending spam. So I guess someone is using my server to spam. How can I troubleshoot and fix this before they cut me off the net for good?

    I appreciate all the help I can get on this matter. Thanks for reading!

  2. #2
    Join Date
    Nov 2008
    Location
    Sheffield, UK
    Beans
    1,516
    Distro
    Ubuntu

    Re: My server is sending spam

    Do you have a mail server installed?

    Test open relay here

    http://www.mailradar.com/openrelay/

  3. #3
    Join Date
    Oct 2005
    Location
    Al Ain
    Beans
    7,808

    Re: My server is sending spam

    First kill all email:
    iptables -I -i eth0 -p tcp --dport 25 -j DROP

    Now you can investigate things at your leasure.

  4. #4
    Join Date
    Sep 2008
    Beans
    193
    Distro
    Ubuntu 12.04 Precise Pangolin

    Re: My server is sending spam

    Quote Originally Posted by SlugSlug View Post
    Do you have a mail server installed?

    Test open relay here

    http://www.mailradar.com/openrelay/
    It says port 25 is closed and the command does not work. I'm looking in my mail logs and there are lots of stuff. Let me post it for you.


    Here is one line out of thousands!
    Nov 12 06:44:10 roger-G31T-M7 postfix/error[8030]: 0A417145035: to=<avist@keytown.com>, relay=none, delay=2050, delays=1949/96/0/4.7, dsn=4.4.2, status=deferred (delivery temporarily suspended: lost connection with smtp.nenett.no[81.167.36.150] while sending RCPT TO)
    Last edited by AvengerX9; November 16th, 2012 at 03:42 PM.

  5. #5
    Join Date
    Sep 2008
    Beans
    193
    Distro
    Ubuntu 12.04 Precise Pangolin

    Re: My server is sending spam

    I turned off my postfix mail server. It seems like the mail log have stopped getting new records now. How can I fix this to prevent it from being used to spam again ?

  6. #6
    Join Date
    Oct 2006
    Location
    NL, EU
    Beans
    1,476
    Distro
    Ubuntu Development Release

    Re: My server is sending spam

    Do not allow relays.
    You might want to read through this for a solid mailserver configuration
    I'm thinking about it

  7. #7
    Join Date
    Sep 2008
    Beans
    193
    Distro
    Ubuntu 12.04 Precise Pangolin

    Re: My server is sending spam

    how can I disable relays ?

  8. #8
    Join Date
    Jun 2007
    Location
    Porirua, New Zealand
    Beans
    Hidden!
    Distro
    Ubuntu

    Re: My server is sending spam

    Quote Originally Posted by AvengerX9 View Post
    how can I disable relays ?
    Having something like this in your main.cf file will often be a help:
    Code:
    smtpd_recipient_restrictions =
        reject_invalid_hostname, 
        reject_non_fqdn_sender, 
        reject_non_fqdn_recipient, 
        reject_unknown_sender_domain, 
        reject_unknown_recipient_domain, 
        reject_unauth_pipelining, 
        permit_mynetworks, 
        reject_unauth_destination, 
        reject_rbl_client bl.spamcop.net 
        permit
    The important line is "reject_unauth_destination", which limits the incoming mail that doesn't arrive via your own network to destinations in Postfix's "mydestination =" line in the main.cf file.
    Last edited by lisati; November 16th, 2012 at 09:34 PM. Reason: reword to explain
    Forum DOs and DON'Ts
    Never assume that information you find using a search engine is up-to-date.

  9. #9
    Join Date
    Sep 2008
    Beans
    193
    Distro
    Ubuntu 12.04 Precise Pangolin

    Re: My server is sending spam

    Can I just add this to the bottom of my main.cf file or should I place it somewhere else in there ?

  10. #10
    Join Date
    Sep 2008
    Beans
    193
    Distro
    Ubuntu 12.04 Precise Pangolin

    Re: My server is sending spam

    Now I'm also getting this in my mail log, but I don't know what it means

    postfix/postfix-script[####]warning: not owned by postfix: /var/lib/postfix/./verify_cache

Page 1 of 8 123 ... LastLast

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •