0
My postfix is sending spam from a random-name@mydomain.com address. How is this possible and how do I allow only www-data@localhost to send and postfix to only deliver from myname@mydomain.com to myname@gmail.com (as in my aliases list)?
Here's my main.cf:
# See /usr/share/postfix/main.cf.dist for a commented, more complete version
# Debian specific: Specifying a file name will cause the first
# line of that file to be used as the name. The Debian default
# is /etc/mailname.
#myorigin = *** My main domain ***
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no
# appending .domain is the MUA's job.
append_dot_mydomain = no
# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h
readme_directory = no
# TLS parameters
smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.
myhostname = *** My hostname ***
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = $mydomain
mydestination = $myhostname, localhost.$mydomain, $mydomain, localhost
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous noplaintext
smtpd_recipient_restrictions = permit_mynetworks reject_unauth_destination permit_inet_interfaces
smtpd_tls_security_level = may
virtual_alias_domains = *** My aliases ***
virtual_alias_maps = hash:/etc/postfix/virtual
smtpd_tls_auth_only = yes
smtpd_client_restrictions = permit_mynetworks, reject
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, permit
smtpd_data_restrictions = reject_unauth_pipelining
smtpd_end_of_data_restrictions = check_policy_service unix:private/policy
smtp_sasl_auth_enable = no
smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_non_fqdn_sender, reject_unknown_sender_domain, hash:/etc/postfix/sender_access, permit
smtpd_delay_reject = yes
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks, check_helo_access hash:/etc/postfix/sender_access, reject_non_fqdn_hostname, reject_invalid_hostname, permit
smtpd_recipient_restrictions = reject_unauth_pipelining, reject_unauth_destination, reject_non_fqdn_recipient, permit_mynetworks, permit_sasl_authenticated, check_sender_access hash:/etc/postfix/sender_access, reject_rbl_client relays.ordb.org, reject_rbl_client list.dsbl.org, reject_rbl_client sbl-xbl.spamhaus.org, check_policy_service unix:private/spfpolicy, check_policy_service inet:127.0.0.1:10023, permit
transport_maps = hash:/etc/postfix/transport
2Are you sure it is your postfix that is actually sending the spam? Could it be someone spoofing your address? – Julian Knight – 2015-04-16T13:57:23.100
I see the spam messages in postfix mail queue. My service provider is blocking port 25 now, because of the spam. That's why the spams stay in queue. – lohis – 2015-04-17T01:27:00.757
Sorry, my postfix skills are rather too rusty! I had nightmares trying to get my server right and I tend not to touch it if I can help!! Though I know I need to rebuild the email part. Have you done the usual checks of logs, logins, IPTABLES, etc. to ensure you don't have an unwanted visitor? Also have you checked all clients that connect to make sure they aren't compromised? – Julian Knight – 2015-04-17T09:31:57.990
Did you check if is one user that is sending spams or there are more than one ? Did you check also if you have open relay ? – Ylli Frroku – 2017-06-02T12:51:16.733
try to remove permit from smtpd_client_restrictions – Ylli Frroku – 2017-06-02T13:00:41.880