<table cellspacing="0" cellpadding="0" border="0" ><tr><td valign="top" style="font: inherit;">Since a week, one of my private mailservers was used as a spam-relay, and listed in several public spam-lists. <BR>This mailserver uses dovecot, postfix, sasl-auth, and was running for months without problem. <BR>The speciality is, that this compromised mailserver is running in a virtual machine. <BR><BR>I guess, that this might be one "vulnarability" used by the spammers, because ifconfig of my virtual machine shows: <BR>----------- <BR>lo Link encap:Local Loopback <BR> inet addr:127.0.0.1 Mask:255.0.0.0 <BR> UP LOOPBACK RUNNING MTU:16436 Metric:1 <BR> RX packets:20200422 errors:0 dropped:0 overruns:0 frame:0
<BR> TX packets:3438831 errors:0 dropped:0 overruns:0 carrier:0 <BR> collisions:0 txqueuelen:0 <BR> RX bytes:2334475480 (2226.3 Mb) TX bytes:1480411708 (1411.8 Mb) <BR><BR>venet0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 <BR> inet addr:127.0.0.1 P-t-P:127.0.0.1 Bcast:0.0.0.0 Mask:255.255.255.255 <BR> UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1 <BR> RX packets:3707143 errors:0 dropped:0 overruns:0 frame:0 <BR> TX packets:4003471 errors:0 dropped:0 overruns:0 carrier:0
<BR> collisions:0 txqueuelen:0 <BR> RX bytes:556695194 (530.9 Mb) TX bytes:619693220 (590.9 Mb) <BR><BR>venet0:0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 <BR> inet addr:012.345.678.891 P-t-P:012.345.678.891 Bcast:0.0.0.0 Mask:255.255.255.255 <BR> UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1 <BR><BR>-------------------------------------------- <BR><BR>Now I solved the problem using a "quick fix", by eliminating "permit_mynetworks" from <BR>smtpd_recipient_restrictions in main.cf of postfix. <BR><BR>Excerpt from my actual main.cf (no more spams): <BR>--------- <BR>smtpd_recipient_restrictions = <BR>
reject_invalid_hostname, <BR> reject_unknown_recipient_domain, <BR> reject_unauth_pipelining, <BR># permit_mynetworks, <BR> permit_sasl_authenticated, <BR> check_sender_access hash:/etc/postfix/access <BR> reject_unauth_destination, <BR> reject_unknown_recipient_domain, <BR> reject_rbl_client zen.spamhaus.org, <BR> reject_rbl_client zen.spamhaus.org, <BR> reject_rbl_client bl.spamcop.net, <BR> reject_rbl_client dnsbl.sorbs.net, <BR> reject_rbl_client cbl.abuseat.org,
<BR> reject_rbl_client ix.dnsbl.manitu.net, <BR> reject_rbl_client ob.surbl.org, <BR> reject_non_fqdn_sender, <BR> reject_non_fqdn_hostname, <BR> check_policy_service inet:127.0.0.1:10023 <BR>---------------------------------------- <BR><BR>Another vulnerability, which helped the spammers, was the fact, they used malformed destinations, having "0.0.0.0" in the MX-record. <BR>Excerpt from my actual logs: <BR>-------------------------------------- <BR><BR>Feb 14 06:28:22 h123456 postfix/smtpd[1463]: warning: numeric domain name in resource data of MX record for seed.net: 0.0.0.0 <BR>Feb 14 06:28:22 h123456 postfix/smtpd[1463]: NOQUEUE: reject: RCPT from h123456.stratoserver.net[127.0.0.1]: 554 5.7.1 <A class=moz-txt-link-rfc2396E
href="mailto:dpggy1@seed.net"><dpggy1@seed.net></A>: Relay access denied; from=<A class=moz-txt-link-rfc2396E href="mailto:jennifer_joan@msn.com"><jennifer_joan@msn.com></A> to=<A class=moz-txt-link-rfc2396E href="mailto:dpggy1@seed.net"><dpggy1@seed.net></A> proto=SMTP helo=<ppp-217-77-221-14.wildpark.net> <BR>Feb 14 06:28:23 h123456 postfix/smtpd[1463]: warning: numeric domain name in resource data of MX record for seed.net: 0.0.0.0 <BR><BR>---------------------------------- <BR><BR>In case, "permit_mynetworks" would still be allowed in smtpd_recipient_restrictions, <BR>now my server would have sent spam. <BR><BR><BR>So, now my question is, how to reject mail with destination "0.0.0.0" because of invalid MX record ? That should be a better solution compared to commenting permit_mynetworks. <BR><BR><BR>Or any other comments ? <BR><BR><BR><BR>Regards, <BR><BR>Dipl. Ing. Reiner Karlsberg <BR></td></tr></table><br>