Subject: postfix spam relay problem
To: None <tech-userlevel@NetBSD.ORG>
From: Kent Polk <kent@goathill.org>
List: tech-userlevel
Date: 09/27/2001 00:45:05
I just discovered that my someone has been using my postfix mailer
to deliver spam this afternoon.
Now :
# By default, Postfix relays mail
# - from trusted clients whose IP address matches $mynetworks,
# - from trusted clients matching $relay_domains or subdomains thereof,
# - from untrusted clients to destinations that match $relay_domains
# or subdomains thereof, except addresses with sender-specified routing.
now I have *none of the relay options* turned on, and I have
specifically listed the ip address of the local hosts that are
allowed to relay using:
mynetworks = ....
the maillist shows:
Sep 26 03:03:17 tiamat postfix/qmgr[369]: AD2EFE9B: from=<f3clzs10g@msn.com>,
size=1833, nrcpt=48 (queue active)
Sep 26 03:03:17 tiamat postfix/qmgr[369]: AC0DE111C: from=<7lpv9jwxe10@msn.com>,
size=1860, nrcpt=48 (queue active)
Sep 26 03:03:17 tiamat postfix/qmgr[369]: AA7EDE78: from=<jrx3@msn.com>,
size=1831, nrcpt=48 (queue active)
Sep 26 03:03:17 tiamat postfix/qmgr[369]: A4E29116B: from=<>, size=6556, nrcpt=1
(queue active)
...
Sep 26 03:04:38 tiamat postfix/smtp[3107]: AD2EFE9B: to=<xxx@dellnet.com>,
relay=none, delay=125045, status=deferred (Name service error for dellnet.com:
Host not found, try again)
...
and ps showed a long list of processes before I shut postfix down:
postfix 7660 0.0 0.2 136 536 ?? S 6:56PM 0:00.00 flush -t unix -u
postfix 7659 0.0 0.2 136 536 ?? S 6:56PM 0:00.01 flush -t unix -u
postfix 7654 0.0 0.2 188 616 ?? S 6:55PM 0:00.01 smtp -t unix -u
postfix 7650 0.0 0.2 152 552 ?? S 6:54PM 0:00.02 bounce -n defer
postfix 7582 0.0 0.2 188 624 ?? I 6:53PM 0:00.01 smtp -t unix -u
postfix 7572 0.0 0.2 196 628 ?? S 6:53PM 0:00.01 smtp -t unix -u
postfix 7515 0.0 0.3 216 656 ?? S 6:51PM 0:00.02 smtp -t unix -u
postfix 7514 0.0 0.3 228 668 ?? S 6:51PM 0:00.03 smtp -t unix -u
postfix 7513 0.0 0.3 212 652 ?? I 6:51PM 0:00.02 smtp -t unix -u
postfix 7512 0.0 0.3 212 652 ?? S 6:51PM 0:00.02 smtp -t unix -u
postfix 7511 0.0 0.3 212 652 ?? S 6:51PM 0:00.02 smtp -t unix -u
...
What else is required to shut down relaying except for the hosts
specified by mynetworks?