Postfix is Still Sending out SPAM despite closing the Famous "Open Relay"

Question

Lets pretend for a second there , my client's website is thatshowithappened.com A couple of weeks ago our server was an open relay , we fixed that.

And now after putting

smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
smtpd_recipient_restrictions =
        reject_invalid_hostname,
        reject_non_fqdn_hostname,
        reject_unknown_sender_domain,
        reject_unknown_recipient_domain,
        reject_non_fqdn_sender,
        reject_non_fqdn_recipient,
        reject_unlisted_recipient,
        permit_mynetworks,
        permit_sasl_authenticated,
        reject_unauth_destination,
    reject_rbl_client zen.spamhaus.org=127.0.0.[2..11]
#       check_policy_service inet:127.0.0.1:10101,
        reject_rbl_client zen.spamhaus.org,
        reject_rbl_client bl.spamcop.net,
        reject_rbl_client psbl.surriel.com,
#       reject_rbl_client dnsbl.sorbs.net,
        reject_rbl_client b.barracudacentral.org

It did the trick and I accidentally flushed the message queue , Now I cannot know which script was responsible for sending out SPAM, since I already checked that its not a CRON Job , So this is what gets into my mail logs

Mar 20 06:39:53 thatshowithappened postfix/smtpd[1413]: NOQUEUE: reject: RCPT from hwsrv-234497.hostwindsdns.com[104.168.142.169]: 554 5.7.1 Service unavailable; Client host [104.168.142.169] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/104.168.142.169; from=<mysql@thatshowithappened.com> to=<1029mandaditos@gmail.com> proto=ESMTP helo=<hwsrv-234497.hostwindsdns.com>
Mar 20 06:39:57 thatshowithappened postfix/smtpd[1411]: NOQUEUE: reject: RCPT from hwsrv-234497.hostwindsdns.com[104.168.142.169]: 554 5.7.1 Service unavailable; Client host [104.168.142.169] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/104.168.142.169; from=<library@thatshowithappened.com> to=<1029mandaditos@gmail.com> proto=ESMTP helo=<hwsrv-234497.hostwindsdns.com>
Mar 20 06:40:00 thatshowithappened postfix/smtpd[1413]: NOQUEUE: reject: RCPT from hwsrv-234497.hostwindsdns.com[104.168.142.169]: 554 5.7.1 Service unavailable; Client host [104.168.142.169] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/104.168.142.169; from=<linux@thatshowithappened.com> to=<1029mandaditos@gmail.com> proto=ESMTP helo=<hwsrv-234497.hostwindsdns.com>
Mar 20 06:40:03 thatshowithappened postfix/smtpd[1411]: NOQUEUE: reject: RCPT from hwsrv-234497.hostwindsdns.com[104.168.142.169]: 554 5.7.1 Service unavailable; Client host [104.168.142.169] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/104.168.142.169; from=<student@thatshowithappened.com> to=<1029mandaditos@gmail.com> proto=ESMTP helo=<hwsrv-234497.hostwindsdns.com>
Mar 20 06:40:07 thatshowithappened postfix/smtpd[1413]: NOQUEUE: reject: RCPT from hwsrv-234497.hostwindsdns.com[104.168.142.169]: 554 5.7.1 Service unavailable; Client host [104.168.142.169] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/104.168.142.169; from=<accounts@thatshowithappened.com> to=<1029mandaditos@gmail.com> proto=ESMTP helo=<hwsrv-234497.hostwindsdns.com>
Mar 20 06:40:10 thatshowithappened postfix/smtpd[1411]: NOQUEUE: reject: RCPT from hwsrv-234497.hostwindsdns.com[104.168.142.169]: 554 5.7.1 Service unavailable; Client host [104.168.142.169] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/104.168.142.169; from=<java@thatshowithappened.com> to=<1029mandaditos@gmail.com> proto=ESMTP helo=<hwsrv-234497.hostwindsdns.com>
Mar 20 06:40:13 thatshowithappened postfix/smtpd[1413]: NOQUEUE: reject: RCPT from hwsrv-234497.hostwindsdns.com[104.168.142.169]: 554 5.7.1 Service unavailable; Client host [104.168.142.169] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/104.168.142.169; from=<daemon@thatshowithappened.com> to=<1029mandaditos@gmail.com> proto=ESMTP helo=<hwsrv-234497.hostwindsdns.com>
Mar 20 06:40:16 thatshowithappened postfix/smtpd[1411]: NOQUEUE: reject: RCPT from hwsrv-234497.hostwindsdns.com[104.168.142.169]: 554 5.7.1 Service unavailable; Client host [104.168.142.169] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/104.168.142.169; from=<dragon@thatshowithappened.com> to=<1029mandaditos@gmail.com> proto=ESMTP helo=<hwsrv-234497.hostwindsdns.com>
Mar 20 06:40:19 thatshowithappened postfix/smtpd[1413]: NOQUEUE: reject: RCPT from hwsrv-234497.hostwindsdns.com[104.168.142.169]: 554 5.7.1 Service unavailable; Client host [104.168.142.169] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/104.168.142.169; from=<download@thatshowithappened.com> to=<1029mandaditos@gmail.com> proto=ESMTP helo=<hwsrv-234497.hostwindsdns.com>
Mar 20 06:40:22 thatshowithappened postfix/smtpd[1411]: NOQUEUE: reject: RCPT from hwsrv-234497.hostwindsdns.com[104.168.142.169]: 554 5.7.1 Service unavailable; Client host [104.168.142.169] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/104.168.142.169; from=<firewall@thatshowithappened.com> to=<1029mandaditos@gmail.com> proto=ESMTP helo=<hwsrv-234497.hostwindsdns.com>
Mar 20 06:40:31 thatshowithappened postfix/smtpd[1411]: NOQUEUE: reject: RCPT from hwsrv-234497.hostwindsdns.com[104.168.142.169]: 554 5.7.1 Service unavailable; Client host [104.168.142.169] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/104.168.142.169; from=<visitor@thatshowithappened.com> to=<1029mandaditos@gmail.com> proto=ESMTP helo=<hwsrv-234497.hostwindsdns.com>
Mar 20 06:40:35 thatshowithappened postfix/smtpd[1413]: NOQUEUE: reject: RCPT from hwsrv-234497.hostwindsdns.com[104.168.142.169]: 554 5.7.1 Service unavailable; Client host [104.168.142.169] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/104.168.142.169; from=<zero@thatshowithappened.com> to=<1029mandaditos@gmail.com> proto=ESMTP helo=<hwsrv-234497.hostwindsdns.com>
Mar 20 06:40:38 thatshowithappened postfix/smtpd[1411]: NOQUEUE: reject: RCPT from hwsrv-234497.hostwindsdns.com[104.168.142.169]: 554 5.7.1 Service unavailable; Client host [104.168.142.169] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/104.168.142.169; from=<proxy@thatshowithappened.com> to=<1029mandaditos@gmail.com> proto=ESMTP helo=<hwsrv-234497.hostwindsdns.com>
Mar 20 06:40:41 thatshowithappened postfix/smtpd[1413]: NOQUEUE: reject: RCPT from hwsrv-234497.hostwindsdns.com[104.168.142.169]: 554 5.7.1 Service unavailable; Client host [104.168.142.169] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/104.168.142.169; from=<matrix@thatshowithappened.com> to=<1029mandaditos@gmail.com> proto=ESMTP helo=<hwsrv-234497.hostwindsdns.com>
Mar 20 06:40:44 thatshowithappened postfix/smtpd[1411]: NOQUEUE: reject: RCPT from hwsrv-234497.hostwindsdns.com[104.168.142.169]: 554 5.7.1 Service unavailable; Client host [104.168.142.169] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/104.168.142.169; from=<msfadmin@thatshowithappened.com> to=<1029mandaditos@gmail.com> proto=ESMTP helo=<hwsrv-234497.hostwindsdns.com>
Mar 20 06:40:48 thatshowithappened postfix/smtpd[1413]: NOQUEUE: reject: RCPT from hwsrv-234497.hostwindsdns.com[104.168.142.169]: 554 5.7.1 Service unavailable; Client host [104.168.142.169] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/104.168.142.169; from=<cookie@thatshowithappened.com> to=<1029mandaditos@gmail.com> proto=ESMTP helo=<hwsrv-234497.hostwindsdns.com>
Mar 20 06:40:50 thatshowithappened postfix/smtpd[1411]: NOQUEUE: reject: RCPT from hwsrv-234497.hostwindsdns.com[104.168.142.169]: 554 5.7.1 Service unavailable; Client host [104.168.142.169] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/104.168.142.169; from=<winner@thatshowithappened.com> to=<1029mandaditos@gmail.com> proto=ESMTP helo=<hwsrv-234497.hostwindsdns.com>
Mar 20 06:40:54 thatshowithappened postfix/smtpd[1413]: NOQUEUE: reject: RCPT from hwsrv-234497.hostwindsdns.com[104.168.142.169]: 554 5.7.1 Service unavailable; Client host [104.168.142.169] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/104.168.142.169; from=<123456@thatshowithappened.com> to=<1029mandaditos@gmail.com> proto=ESMTP helo=<hwsrv-234497.hostwindsdns.com>
Mar 20 06:40:57 thatshowithappened postfix/smtpd[1411]: NOQUEUE: reject: RCPT from hwsrv-234497.hostwindsdns.com[104.168.142.169]: 554 5.7.1 Service unavailable; Client host [104.168.142.169] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/104.168.142.169; from=<home@thatshowithappened.com> to=<1029mandaditos@gmail.com> proto=ESMTP helo=<hwsrv-234497.hostwindsdns.com>
Mar 20 06:41:00 thatshowithappened postfix/smtpd[1413]: NOQUEUE: reject: RCPT from hwsrv-234497.hostwindsdns.com[104.168.142.169]: 554 5.7.1 Service unavailable; Client host [104.168.142.169] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/104.168.142.169; from=<secret@thatshowithappened.com> to=<1029mandaditos@gmail.com> proto=ESMTP helo=<hwsrv-234497.hostwindsdns.com>
Mar 20 06:41:03 thatshowithappened postfix/smtpd[1411]: NOQUEUE: reject: RCPT from hwsrv-234497.hostwindsdns.com[104.168.142.169]: 554 5.7.1 Service unavailable; Client host [104.168.142.169] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/104.168.142.169; from=<password@thatshowithappened.com> to=<1029mandaditos@gmail.com> proto=ESMTP helo=<hwsrv-234497.hostwindsdns.com>
Mar 20 06:41:07 thatshowithappened postfix/smtpd[1413]: NOQUEUE: reject: RCPT from hwsrv-234497.hostwindsdns.com[104.168.142.169]: 554 5.7.1 Service unavailable; Client host [104.168.142.169] blocked

it appears like there a dictionary of words the spammer is using with our own domain thatshowithappened.com, I don't know where to look or at-least how to know the message headers after the message is already sent or rejected as above.

I tried mailq and postqueue -p But its always empty , and its true since the messages are not in queue nor deferred right?

# postcat -q 4DEC51723309
postcat: fatal: open queue file 4DEC51723309: No such file or directory

The CPU is between 90% - 100% , so although its not sending SPAM , but it kills my machine (Centos7 running Postfix 2.x).

What do you suggest that we do? Any other ways to debug this?

PS: I 've enabled the PHP headers so as to track which script is sending out SPAM mail.add_x_header = On mail.log = /var/log/phpmail.log

BTW I hope the question is not like "My PC doesn't work. What to do?" :D

I 've tried checking out other questions like this which are similar to mine, but no luck.

Kindly Assist.

One reject every 4 seconds would not cause high CPU. Something else is causing that on your system. NOQUEUE means the message was not queued. Postfix on a tiny VM can reject hundreds of messages per second without causing problems. You should be able to spot the cause of the cpu load in `top`. — Aaron, Mar 23 '18 at 18:30
Its because I grepped the maillogs to 'to=`<1029mandaditos@gmail.com>'` so as to focus on *one problem* at a time, Apart from this email address it also shows alot of other *email addresses* and *random IPs* `` and from `` , Whenever disable Postfix ... the CPU seems to go back to normal hhmmm #weird — Fahad, Mar 25 '18 at 12:19
Thank you for your reply @Aaron , If only we could get those **message headers**, Is there a way we are missing? — Fahad, Mar 25 '18 at 12:27

score 3 · Answer 1 · answered Mar 22 '18 at 16:51

3

The log entries you posted show that some other machine is trying to relay spam through your mail server, but your mail server is rejecting them.

If this is causing your high CPU load, then consider firewalling the remote IP address temporarily so that it can no longer connect. This should bring an immediate relief.

iptables -I INPUT -s 104.168.142.169 -j DROP

You can also use fail2ban to do this, as it already has preconfigured jails which process the postfix logs; they merely need to be enabled. For instance, put in your jail.local:

[postfix]
enabled = true

answered Mar 22 '18 at 16:51

Michael Hampton

244,070
43
506
972

I tried blocking this IP using fail2ban , There was some relief but since `I filtered the logs above using that sent adress` , I only managed to block that individual IP , I think we are being attacked by a *random botnet* so blocking individual IPs is going to be hard but we are still doing it , Thank you. Disabling Postfix does not put the messages on queue , If it were .. I would 've checked the message headers and solve this matter ASAP. Thank you for your reply though – Fahad Mar 25 '18 at 12:25

Postfix is Still Sending out SPAM despite closing the Famous "Open Relay"

1 Answers1