Hallo Leute,
ich habe seit kurzem das Problem dass meine Mailaccounts (welche auf meinem Server gehostet werden) für SPAM-Zwecke verwendet werden!
Jetzt zweifle ich ob das Problem bei den Benutzern oder an der Serverkonfiguration liegt!
Hier mal meine Konfiguration:
postfix Master.cf
smtp inet n - - - - smtpd -v
pickup fifo n - - 60 1 pickup
cleanup unix n - - - 0 cleanup
qmgr fifo n - n 300 1 qmgr
tlsmgr unix - - - 1000? 1 tlsmgr
rewrite unix - - - - - trivial-rewrite
bounce unix - - - - 0 bounce
defer unix - - - - 0 bounce
trace unix - - - - 0 bounce
verify unix - - - - 1 verify
flush unix n - - 1000? 0 flush
proxymap unix - - n - - proxymap
proxywrite unix - - n - 1 proxymap
smtp unix - - - - - smtp
relay unix - - - - - smtp
showq unix n - - - - showq
error unix - - - - - error
retry unix - - - - - error
discard unix - - - - - discard
local unix - n n - - local
virtual unix - n n - - virtual
lmtp unix - - - - - lmtp
anvil unix - - - - 1 anvil
scache unix - - - - 1 scache
maildrop unix - n n - - pipe flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
uucp unix - n n - - pipe flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
ifmail unix - n n - - pipe flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp unix - n n - - pipe flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
scalemail-backend unix - n n - 2 pipe flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
mailman unix - n n - - pipe flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py ${nexthop} ${user}
dovecot unix - n n - - pipe flags=DRhu user=vmail:vmail argv=/usr/lib/dovecot/deliver -d ${recipient}
amavis unix - - - - 2 smtp -o smtp_data_done_timeout=1200 -o smtp_send_xforward_command=yes
127.0.0.1:10025 inet n - - - - smtpd -o content_filter= -o local_recipient_maps= -o relay_recipient_maps= -o smtpd_restriction_classes= -o smtpd_client_restrictions= -o smtpd_helo_restrictions= -o smtpd_sender_restrictions= -o smtpd_recipient_restrictions=permit_mynetworks,reject -o mynetworks=127.0.0.0/8 -o strict_rfc821_envelopes=yes -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks -o smtpd_bind_address=127.0.0.1
587 inet n - - - - smtpd
main.cf
disable_vrfy_command = yes
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no
append_dot_mydomain = no
readme_directory = /usr/share/doc/postfix
smtpd_tls_cert_file = /etc/postfix/smtpd.cert
smtpd_tls_key_file = /etc/postfix/smtpd.key
smtpd_use_tls = yes
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
myhostname = example.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = unixmail01.example.com, DBLSR01.example.com, localhost, localhost.localdomain
relayhost =
mynetworks = 127.0.0.0/8
mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 0
recipient_delimiter = +
default_recipient_limit = 10000
default_destination_recipient_limit = 200
inet_interfaces = all
message_size_limit = 50240000
maximal_queue_lifetime = 1d
bounce_queue_lifetime = 1d
smtp_data_done_timeout = 1200s
smtpd_sasl_type=dovecot
smtpd_sasl_local_domain = $myhostname
smtpd_sasl_security_options = noanonymous
smtpd_sasl_path=private/auth_dovecot
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
broken_sasl_auth_clients = yes
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $smtpd_sender_login_maps
smtpd_sender_login_maps = proxy:mysql:/etc/postfix/mysql_sender_login_maps.cf
smtpd_sender_restrictions = check_sender_access hash:/etc/postfix/access, reject_unknown_address, reject_non_fqdn_sender
smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,check_recipient_access hash:/etc/postfix/access,reject_unauth_destination
smtpd_client_restrictions =
check_client_access hash:/etc/postfix/access
permit_mynetworks
permit_sasl_authenticated
reject_unauth_pipelining
reject_rbl_client bl.spamcop.net
reject_rbl_client dnsbl.dronebl.org
reject_rbl_client cbl.abuseat.org
reject_rbl_client ix.dnsbl.manitu.net
reject_rbl_client combined.njabl.org
reject_rbl_client zen.spamhaus.org
reject_rbl_client t1.dnsbl.net.au
/mysql_virtual_alias_maps.cf,proxy:mysql:/etc/postfix/mysql_virtual_email2email.cf
virtual_alias_maps = mysql:/etc/postfix/mysql_virtual_alias_maps.cf,mysql:/etc/postfix/mysql_virtual_email2email.cf
virtual_mailbox_base = /home/vmail/
virtual_mailbox_domains = mysql:/etc/postfix/mysql_virtual_domains_maps.cf
virtual_mailbox_limit = 112400000
virtual_mailbox_maps = mysql:/etc/postfix/mysql_virtual_mailbox_maps.cf
virtual_minimum_uid = 104
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000
virtual_transport = dovecot
dovecot_destination_recipient_limit = 1
smtpd_sasl_tls_security_options = noanonymous
header_checks = regexp:/etc/postfix/header_checks
Der Header einer so einer Mail sieht folgendermassen aus:
root@MailServer:/etc/dovecot# postcat /var/spool/postfix/deferred/4/406BDE88D01
*** ENVELOPE RECORDS /var/spool/postfix/deferred/4/406BDE88D01 ***
message_size: 8166 849 1 0 7899
message_arrival_time: Wed Jun 4 15:28:41 2014
sender: noreply@mail.telekom.de
create_time: Wed Jun 4 15:28:41 2014
named_attribute: log_ident=40711E88CA5
named_attribute: rewrite_context=remote
named_attribute: sasl_method=PLAIN
named_attribute: sasl_username=benutzer@example.com
named_attribute: log_client_name=XX-XXX-XX-XX.teleworker-single-ip.xdsl-line.example.com
named_attribute: log_client_address=XX.XXX.XX.XX
named_attribute: log_client_port=57522
named_attribute: log_message_origin=XX-XxX-XX-XX.teleworker-single-ip.xdsl-line.exmple.com[XX.XXX.XX.XXX]
named_attribute: log_helo_name=knaexi-pc
named_attribute: log_protocol_name=ESMTP
named_attribute: client_name=XX-XXX-XX-XX.teleworker-single-ip.xdsl-line.example.com
named_attribute: reverse_client_name=XX-XXX-XX-XX.teleworker-single-ip.xdsl-line.example.com
named_attribute: client_address=XX.XXX.XX.XX
named_attribute: client_port=57522
named_attribute: helo_name=knaexi-pc
named_attribute: protocol_name=ESMTP
named_attribute: client_address_type=2
named_attribute: dsn_orig_rcpt=rfc822;rlinter@vdn.ca
original_recipient: rlinter@vdn.ca
recipient: rlinter@vdn.ca
*** MESSAGE CONTENTS /var/spool/postfix/deferred/4/406BDE88D01 ***
Received: from knaexi-pc (XX-XX-XXX-XX.teleworker-single-ip.xdsl-line.example.com [XX.XXX.XX.XX])
(Authenticated sender: benutzer@example.com)
by example.com (Postfix) with ESMTPA id 40711E88CA5
for <rlinter@vdn.ca>; Wed, 4 Jun 2014 15:28:41 +0200 (CEST)
Date: Wed, 04 Jun 2014 15:28:41 +0200
From: noreply@mail.telekom.de
<benutzer@example.com>
To: rlinter@vdn.ca
X-MSMail-Priority: High
X-Priority: 1
Priority: urgent
Importance: high
X-MimeOLE: Produced by Blat v3.1.1
X-Mailer: Blat v3.1.1, a Win32 SMTP/NNTP mailer happy mailing : Blat online
Message-ID: <01cf7ff8$Blat.v3.1.1$e82effb9$1178fe09fd66@example.com>
Subject: RechnungOnline Monat Mai 2014 (Buchungskonto: 1064333438)
Content-Transfer-Encoding: 8BIT
Content-Type: text/html;
charset="ISO-8859-1"
X-MailScanner-Information: Please contact the ISP for more information
X-MailScanner-ID: 40711E88CA5.AFE0A
X-MailScanner: Found to be clean
X-MailScanner-From: noreply@mail.telekom.de
X-Spam-Status: No
Wie kann ich die Sicherheit erhöhen damit solche SPAM-Attacken nicht passieren?
Kann mir hier wer weiter helfen ?
Falls ihr noch mehr infos braucht, bitte bescheid geben!
Danke im Voraus!
lg Sigi
ich habe seit kurzem das Problem dass meine Mailaccounts (welche auf meinem Server gehostet werden) für SPAM-Zwecke verwendet werden!
Jetzt zweifle ich ob das Problem bei den Benutzern oder an der Serverkonfiguration liegt!
Hier mal meine Konfiguration:
postfix Master.cf
smtp inet n - - - - smtpd -v
pickup fifo n - - 60 1 pickup
cleanup unix n - - - 0 cleanup
qmgr fifo n - n 300 1 qmgr
tlsmgr unix - - - 1000? 1 tlsmgr
rewrite unix - - - - - trivial-rewrite
bounce unix - - - - 0 bounce
defer unix - - - - 0 bounce
trace unix - - - - 0 bounce
verify unix - - - - 1 verify
flush unix n - - 1000? 0 flush
proxymap unix - - n - - proxymap
proxywrite unix - - n - 1 proxymap
smtp unix - - - - - smtp
relay unix - - - - - smtp
showq unix n - - - - showq
error unix - - - - - error
retry unix - - - - - error
discard unix - - - - - discard
local unix - n n - - local
virtual unix - n n - - virtual
lmtp unix - - - - - lmtp
anvil unix - - - - 1 anvil
scache unix - - - - 1 scache
maildrop unix - n n - - pipe flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
uucp unix - n n - - pipe flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
ifmail unix - n n - - pipe flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp unix - n n - - pipe flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
scalemail-backend unix - n n - 2 pipe flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
mailman unix - n n - - pipe flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py ${nexthop} ${user}
dovecot unix - n n - - pipe flags=DRhu user=vmail:vmail argv=/usr/lib/dovecot/deliver -d ${recipient}
amavis unix - - - - 2 smtp -o smtp_data_done_timeout=1200 -o smtp_send_xforward_command=yes
127.0.0.1:10025 inet n - - - - smtpd -o content_filter= -o local_recipient_maps= -o relay_recipient_maps= -o smtpd_restriction_classes= -o smtpd_client_restrictions= -o smtpd_helo_restrictions= -o smtpd_sender_restrictions= -o smtpd_recipient_restrictions=permit_mynetworks,reject -o mynetworks=127.0.0.0/8 -o strict_rfc821_envelopes=yes -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks -o smtpd_bind_address=127.0.0.1
587 inet n - - - - smtpd
main.cf
disable_vrfy_command = yes
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no
append_dot_mydomain = no
readme_directory = /usr/share/doc/postfix
smtpd_tls_cert_file = /etc/postfix/smtpd.cert
smtpd_tls_key_file = /etc/postfix/smtpd.key
smtpd_use_tls = yes
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
myhostname = example.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = unixmail01.example.com, DBLSR01.example.com, localhost, localhost.localdomain
relayhost =
mynetworks = 127.0.0.0/8
mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 0
recipient_delimiter = +
default_recipient_limit = 10000
default_destination_recipient_limit = 200
inet_interfaces = all
message_size_limit = 50240000
maximal_queue_lifetime = 1d
bounce_queue_lifetime = 1d
smtp_data_done_timeout = 1200s
smtpd_sasl_type=dovecot
smtpd_sasl_local_domain = $myhostname
smtpd_sasl_security_options = noanonymous
smtpd_sasl_path=private/auth_dovecot
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
broken_sasl_auth_clients = yes
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $smtpd_sender_login_maps
smtpd_sender_login_maps = proxy:mysql:/etc/postfix/mysql_sender_login_maps.cf
smtpd_sender_restrictions = check_sender_access hash:/etc/postfix/access, reject_unknown_address, reject_non_fqdn_sender
smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,check_recipient_access hash:/etc/postfix/access,reject_unauth_destination
smtpd_client_restrictions =
check_client_access hash:/etc/postfix/access
permit_mynetworks
permit_sasl_authenticated
reject_unauth_pipelining
reject_rbl_client bl.spamcop.net
reject_rbl_client dnsbl.dronebl.org
reject_rbl_client cbl.abuseat.org
reject_rbl_client ix.dnsbl.manitu.net
reject_rbl_client combined.njabl.org
reject_rbl_client zen.spamhaus.org
reject_rbl_client t1.dnsbl.net.au
/mysql_virtual_alias_maps.cf,proxy:mysql:/etc/postfix/mysql_virtual_email2email.cf
virtual_alias_maps = mysql:/etc/postfix/mysql_virtual_alias_maps.cf,mysql:/etc/postfix/mysql_virtual_email2email.cf
virtual_mailbox_base = /home/vmail/
virtual_mailbox_domains = mysql:/etc/postfix/mysql_virtual_domains_maps.cf
virtual_mailbox_limit = 112400000
virtual_mailbox_maps = mysql:/etc/postfix/mysql_virtual_mailbox_maps.cf
virtual_minimum_uid = 104
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000
virtual_transport = dovecot
dovecot_destination_recipient_limit = 1
smtpd_sasl_tls_security_options = noanonymous
header_checks = regexp:/etc/postfix/header_checks
Der Header einer so einer Mail sieht folgendermassen aus:
root@MailServer:/etc/dovecot# postcat /var/spool/postfix/deferred/4/406BDE88D01
*** ENVELOPE RECORDS /var/spool/postfix/deferred/4/406BDE88D01 ***
message_size: 8166 849 1 0 7899
message_arrival_time: Wed Jun 4 15:28:41 2014
sender: noreply@mail.telekom.de
create_time: Wed Jun 4 15:28:41 2014
named_attribute: log_ident=40711E88CA5
named_attribute: rewrite_context=remote
named_attribute: sasl_method=PLAIN
named_attribute: sasl_username=benutzer@example.com
named_attribute: log_client_name=XX-XXX-XX-XX.teleworker-single-ip.xdsl-line.example.com
named_attribute: log_client_address=XX.XXX.XX.XX
named_attribute: log_client_port=57522
named_attribute: log_message_origin=XX-XxX-XX-XX.teleworker-single-ip.xdsl-line.exmple.com[XX.XXX.XX.XXX]
named_attribute: log_helo_name=knaexi-pc
named_attribute: log_protocol_name=ESMTP
named_attribute: client_name=XX-XXX-XX-XX.teleworker-single-ip.xdsl-line.example.com
named_attribute: reverse_client_name=XX-XXX-XX-XX.teleworker-single-ip.xdsl-line.example.com
named_attribute: client_address=XX.XXX.XX.XX
named_attribute: client_port=57522
named_attribute: helo_name=knaexi-pc
named_attribute: protocol_name=ESMTP
named_attribute: client_address_type=2
named_attribute: dsn_orig_rcpt=rfc822;rlinter@vdn.ca
original_recipient: rlinter@vdn.ca
recipient: rlinter@vdn.ca
*** MESSAGE CONTENTS /var/spool/postfix/deferred/4/406BDE88D01 ***
Received: from knaexi-pc (XX-XX-XXX-XX.teleworker-single-ip.xdsl-line.example.com [XX.XXX.XX.XX])
(Authenticated sender: benutzer@example.com)
by example.com (Postfix) with ESMTPA id 40711E88CA5
for <rlinter@vdn.ca>; Wed, 4 Jun 2014 15:28:41 +0200 (CEST)
Date: Wed, 04 Jun 2014 15:28:41 +0200
From: noreply@mail.telekom.de
<benutzer@example.com>
To: rlinter@vdn.ca
X-MSMail-Priority: High
X-Priority: 1
Priority: urgent
Importance: high
X-MimeOLE: Produced by Blat v3.1.1
X-Mailer: Blat v3.1.1, a Win32 SMTP/NNTP mailer happy mailing : Blat online
Message-ID: <01cf7ff8$Blat.v3.1.1$e82effb9$1178fe09fd66@example.com>
Subject: RechnungOnline Monat Mai 2014 (Buchungskonto: 1064333438)
Content-Transfer-Encoding: 8BIT
Content-Type: text/html;
charset="ISO-8859-1"
X-MailScanner-Information: Please contact the ISP for more information
X-MailScanner-ID: 40711E88CA5.AFE0A
X-MailScanner: Found to be clean
X-MailScanner-From: noreply@mail.telekom.de
X-Spam-Status: No
Wie kann ich die Sicherheit erhöhen damit solche SPAM-Attacken nicht passieren?
Kann mir hier wer weiter helfen ?
Falls ihr noch mehr infos braucht, bitte bescheid geben!
Danke im Voraus!
lg Sigi
