[postfix-users] Spam von local - schon wieder ...

classic Classic list List threaded Threaded
6 messages Options
Reply | Threaded
Open this post in threaded view
|

[postfix-users] Spam von local - schon wieder ...

Matthias Schmidt [c]
Hallo,
bei mir sind gestern wieder über rund 45 Minuten mails eingegangen und teilweise wegen Spam abgelehnt worden.
Als das das erste mal passiert ist, hab ich den Rat von Uwe befolgt und meine main.cf so geändert:

smtpd_sasl_auth_enable = yes
smtpd_helo_required = yes
smtpd_use_pw_server = yes
#mit Greylisting
#smtpd_recipient_restrictions = permit_sasl_authenticated permit_mynetworks reject_unauth_destination check_policy_service unix:private/policy permit
#ohne Greylisting
smtpd_recipient_restrictions =
                permit_sasl_authenticated
                permit_mynetworks
                permit_tls_clientcerts
                check_sender_access hash:/etc/postfix/whitelist
                reject_non_fqdn_hostname
                reject_unknown_reverse_client_hostname
                reject_unauth_destination
                reject_rbl_client cbl.abuseat.org
                reject_rbl_client zen.spamhaus.org
               
smtpd_pw_server_security_options = login,gssapi,cram-md5
data_directory = /var/lib/postfix
smtpd_client_restrictions =
smtpd_sender_restrictions =
        check_sender_access regexp:/etc/postfix/tag_as_originating.re
        permit_mynetworks
        permit_sasl_authenticated
        permit_tls_clientcerts
        check_sender_access regexp:/etc/postfix/tag_as_foreign.re

smtpd_data_restrictions = reject_unauth_pipelining
mydestination = $myhostname, localhost.$mydomain, localhost, mail.$mydomain, liste.$mydomain, $mydomain
virtual_transport = virtual


Die Mails kommen mit sasl_username=ftp hier an. Beim (Sytem-Benutzer) ftp ist Mail nicht aktiviert.


Das Mail sieht so aus:
Content type: Spam
Internal reference code for the message is 20536-07/3+yiMXOQhcE5

First upstream SMTP client IP address: [65.200.13.203]
According to a 'Received:' trace, the message apparently originated at:
 [17.45.146.70], nico-lae.qr.32.de [17.45.146.70]

Return-Path: <[hidden email]>
From:
 [hidden email]
Message-ID:
 <[hidden email].[hidden email]>
X-Mailer: Stylatule-decouvrez 6.4
Subject: IMPORTANT SECURITY ISSUES [INCIDENT 462376-xz-46 ]
Not quarantined.

The message WAS NOT relayed to:
<[hidden email]>:
  250 2.7.0 Ok, discarded, id=20536-07 - SPAM

SpamAssassin report:
Spam detection software, running on the system "mcgregor.admilon.net", has
identified this incoming email as possible spam.  The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email.  If you have any questions, see
[hidden email] for details.

Content preview:  ACCESS TO YOUR ACCOUNT HAS BEEN TEMPORARILY SUSPENDED. The
  reason for this issue: - UNUSUAL NUMBER OF INVALID LOGIN ATTEMPTS ON YOUR
  ACCOUNT To restore your account, please click below: [...]

Content analysis details:   (13.0 points, 25.0 required)

pts rule name              description
---- ---------------------- --------------------------------------------------
0.0 MSGID_MULTIPLE_AT      Message-ID contains multiple '@' characters
0.9 DKIM_ADSP_NXDOMAIN     No valid author signature and domain not in DNS
2.4 TVD_PH_BODY_ACCOUNTS_PRE BODY: TVD_PH_BODY_ACCOUNTS_PRE
-0.0 BAYES_40               BODY: Bayes spam probability is 20 to 40%
                           [score: 0.3950]
1.5 HTML_IMAGE_ONLY_20     BODY: HTML: images with 1600-2000 bytes of words
0.3 HTML_MESSAGE           BODY: HTML included in message
0.7 MIME_HTML_ONLY         BODY: Message only has text/html MIME parts
1.9 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
                           above 50%
                           [cf: 100]
0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
                           [cf: 100]
4.0 RAZOR2_CHECK           Listed in Razor2 (http://razor.sf.net/)
0.8 RDNS_NONE              Delivered to internal network by a host with no rDNS
0.0 TO_EQ_FM_HTML_ONLY     To == From and HTML only
0.0 TO_NO_BRKTS_NORDNS_HTML TO_NO_BRKTS_NORDNS_HTML
Return-Path: <[hidden email]>
Received: from [128.2.1.64] (unknown [65.200.13.203])
        by mcgregor.admilon.net (Postfix) with ESMTPA id 25AF01DBA536
        for <[hidden email]>; Mon, 17 Sep 2012 22:22:07 +0900 (JST)
X-TM-AS-Result: No--7.291-5.0-31-1
X-Recommended-Action: accept
X-IronPort-AV: E=Sophos;i="4.80,368,1344186000";
X-Envelope-From: [hidden email]
Content-type: text/html
X-Proofpoint-Spam-Details: rule=notspam policy=default score=11 spamscore=11 suspectscore=3
X-SpamExpertAristo-Outgoing-Evidence: Combined (0.24)
X-SpamExpertAristo-Username: 61.8.92.97
X-Mailer: Stylatule-decouvrez 6.4
To: [hidden email]
Date: Mon, 17 Sep 2012 13:22:08 GMT
X-Barracuda-Start-Time: 135755806806600
Subject: IMPORTANT SECURITY ISSUES [INCIDENT 462376-xz-46 ]
X-Copfilter-Virus-Scanned: ClamAV 0.684.2
Received: from nico-lae.qr.32.de ([17.45.146.70]) by ghs-fw (Copfilter 0.84beta4)
X-IronPort-Anti-Spam-Filtered: true
From: [hidden email]
X-Filter-ID: XtLePq6GTMn8G68F0comdleehesxkccwnpq66380849601991cmBIW/8OODKS1A/6t51a7Dur
X-Filtered-With: Copfilter Version 0.84beta4 (ProxSMTP 1.8)
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:5.7.7855,1.0.431,0.0.000
X-OriginalArrivalTime: 04 Sep 2012 16:53:23.0515 (UTC) FILETIME=[CBBBD8B0:01CD8ABD]
X-SpamExpertAristo-Domain: joomlabouwer.nl
Message-ID: <[hidden email].[hidden email]>
X-Originating-IP: 61.8.92.97
X-imss-scan-details: No--7.291-5.0-31-1
X-Copfilter-Originating-IP: 89.105.199.76
X-SpamExpertAristo-Outgoing-Class: ham
X-TM-IMSS-Message-ID: <[hidden email]>
X-IronPort-Anti-Spam-Result: tc597710475692009648zbf1847zhfdijebku$
X-TM-AS-Product-Ver: IMSS-7.0.0.6126-6.8.0.1017-19162.000
Authentication-Results: aristo-internet.nl;auth=pass () smtp.auth=61.8.92.97
Content-Transfer-Encoding: 7bit


Im Protokoll sieht das so aus:

Sep 17 22:22:05 mcgregor postfix/smtpd[20603]: connect from unknown[65.200.13.203]
Sep 17 22:22:08 mcgregor postfix/smtpd[20603]: NOQUEUE: filter: RCPT from unknown[65.200.13.203]: <[hidden email]>: Sender address triggers FILTER smtp-amavis:[127.0.0.1]:10026; from=<[hidden email]> to=<[hidden email]> proto=ESMTP helo=<[128.2.1.64]>
Sep 17 22:22:08 mcgregor postfix/smtpd[20603]: 25AF01DBA536: client=unknown[65.200.13.203], sasl_method=CRAM-MD5, sasl_username=ftp
Sep 17 22:22:17 mcgregor postfix/cleanup[20650]: 25AF01DBA536: message-id=<[hidden email].[hidden email]>
Sep 17 22:22:17 mcgregor postfix/qmgr[505]: 25AF01DBA536: from=<[hidden email]>, size=3817, nrcpt=1 (queue active)
Sep 17 22:22:17 mcgregor amavis[20536]: (20536-06) loaded policy bank "ORIGINATING"
Sep 17 22:22:17 mcgregor amavis[20536]: (20536-06) process_request: fileno sock=12, STDIN=0, STDOUT=1
Sep 17 22:22:17 mcgregor amavis[20536]: (20536-07) ESMTP::10026 /var/amavis/tmp/amavis-20120917T221431-20536: <[hidden email]> -> <[hidden email]> Received: from mcgregor.admilon.net ([127.0.0.1]) by localhost (mcgregor.admilon.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP for <[hidden email]>; Mon, 17 Sep 2012 22:22:17 +0900 (JST)
Sep 17 22:22:17 mcgregor amavis[20536]: (20536-07) smtp connection cache, dt: 85.1, state: 0
Sep 17 22:22:17 mcgregor amavis[20536]: (20536-07) body hash: b55bb74e4d5c950db7ed42aa282aa202
Sep 17 22:22:17 mcgregor amavis[20536]: (20536-07) Checking: 3+yiMXOQhcE5 ORIGINATING [65.200.13.203] <[hidden email]> -> <[hidden email]>
Sep 17 22:22:17 mcgregor amavis[20536]: (20536-07) 2822.From: <[hidden email]>, 2821.Mail_From: <[hidden email]>
Sep 17 22:22:17 mcgregor amavis[20536]: (20536-07) p001 1 Content-Type: text/html, size: 1755 B, name:
Sep 17 22:22:17 mcgregor amavis[20536]: (20536-07) Checking for banned types and filenames
Sep 17 22:22:17 mcgregor amavis[20536]: (20536-07) INFO: unknown banned table name ALT-RULES, recip=[hidden email]
Sep 17 22:22:17 mcgregor amavis[20536]: (20536-07) collect banned table[0]: [hidden email], tables:
Sep 17 22:22:17 mcgregor amavis[20536]: (20536-07) p.path [hidden email]: "P=p001,L=1,M=text/html,T=html"
Sep 17 22:22:17 mcgregor amavis[20536]: (20536-07) ask_av Using (ClamAV-clamd): CONTSCAN /var/amavis/tmp/amavis-20120917T221431-20536/parts\n
Sep 17 22:22:17 mcgregor amavis[20536]: (20536-07) ClamAV-clamd: Connecting to socket  /var/amavis/clamd
Sep 17 22:22:17 mcgregor amavis[20536]: (20536-07) ClamAV-clamd: Sending CONTSCAN /var/amavis/tmp/amavis-20120917T221431-20536/parts\n to UNIX socket /var/amavis/clamd
Sep 17 22:22:17 mcgregor amavis[20536]: (20536-07) run_av (ClamAV-clamd): CLEAN
Sep 17 22:22:17 mcgregor amavis[20536]: (20536-07) run_av (ClamAV-clamd) result: clean
Sep 17 22:22:18 mcgregor postfix/smtpd[20603]: disconnect from unknown[65.200.13.203]
Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) spam_scan: score=13.043 autolearn=no tests=[BAYES_40=-0.001,DKIM_ADSP_NXDOMAIN=0.9,HTML_IMAGE_ONLY_20=1.546,HTML_MESSAGE=0.3,MIME_HTML_ONLY=0.723,MSGID_MULTIPLE_AT=0.001,RAZOR2_CF_RANGE_51_100=0.5,RAZOR2_CF_RANGE_E8_51_100=1.886,RAZOR2_CHECK=4,RDNS_NONE=0.793,TO_EQ_FM_HTML_ONLY=0.001,TO_NO_BRKTS_NORDNS_HTML=0.001,TVD_PH_BODY_ACCOUNTS_PRE=2.393]
Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) blocking contents category is (6) for [hidden email]
Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) do_notify_and_quar: ccat=Spam (6,0) ("6":Spam, "5":Spammy, "1,1":CleanTag, "1":Clean, "0":CatchAll) ccat_block=(6), qar_mth=
Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) skip local delivery(3): <> -> <spam-quarantine>
Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) SPAM, <[hidden email]> -> <[hidden email]>, Yes, score=13.043 tag=-999 tag2=7 kill=12 tests=[BAYES_40=-0.001, DKIM_ADSP_NXDOMAIN=0.9, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.3, MIME_HTML_ONLY=0.723, MSGID_MULTIPLE_AT=0.001, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.886, RAZOR2_CHECK=4, RDNS_NONE=0.793, TO_EQ_FM_HTML_ONLY=0.001, TO_NO_BRKTS_NORDNS_HTML=0.001, TVD_PH_BODY_ACCOUNTS_PRE=2.393] autolearn=no, quarantine 3+yiMXOQhcE5 (spam-quarantine)
Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) dkim: candidate originators: 2822.From:<[hidden email]>, 2821.mail_from:<[hidden email]>
Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) dkim: signing (author), From: <[hidden email]>, KEY.key_ind=>0, a=>rsa-sha256, c=>relaxed/simple, d=>admilon.net, s=>default, ttl=>1814400, x=>1349702537.86839
Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) smtp session: setting up a new session
Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) smtp creating socket by IO::Socket::INET to [127.0.0.1]:10027
Sep 17 22:22:23 mcgregor postfix/smtpd[20578]: connect from localhost[127.0.0.1]
Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) smtp resp to greeting: 220 mcgregor.admilon.net ESMTP Postfix
Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) smtp cmd> EHLO localhost
Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) smtp resp to EHLO: 250 mcgregor.admilon.net\nPIPELINING\nSIZE 41943040\nVRFY\nETRN\nAUTH LOGIN CRAM-MD5 GSSAPI\nSTARTTLS\nENHANCEDSTATUSCODES\n8BITMIME\nDSN
Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) AUTH not needed, user='', MTA offers 'LOGIN CRAM-MD5 GSSAPI'
Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) smtp cmd> MAIL FROM:<[hidden email]> ENVID=[hidden email]
Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) smtp cmd> RCPT TO:<[hidden email]>
Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) smtp cmd> DATA
Sep 17 22:22:23 mcgregor postfix/smtpd[20578]: E8B861DBA541: client=localhost[127.0.0.1]
Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) smtp resp to MAIL (pip): 250 2.1.0 Ok
Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) smtp resp to RCPT (pip) (<[hidden email]>): 250 2.1.5 Ok
Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) smtp resp to DATA: 354 End data with <CR><LF>.<CR><LF>
Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) smtp cmd> QUIT

irgendwo ist da also noch ein Loch, an welche Schraube muss ich denn drehen um dem einen Riegel vorzuschieben?
Danke und Gruss
Matthias
_______________________________________________
postfix-users mailing list
[hidden email]
http://de.postfix.org/cgi-bin/mailman/listinfo/postfix-users
Reply | Threaded
Open this post in threaded view
|

Re: [postfix-users] Spam von local - schon wieder ...

Uwe Drießen
> Auftrag von Matthias Schmidt
>
> Hallo,
> bei mir sind gestern wieder über rund 45 Minuten mails eingegangen und
> teilweise wegen Spam abgelehnt worden.
> Als das das erste mal passiert ist, hab ich den Rat von Uwe befolgt und
meine
> main.cf so geändert:

Ich hatte dir empfohlen alle Restrictionen unter
smtpd_recipient_restrictions =
Zusammenzufassen.
Du fragst immer noch smtpd_sender_restrictions = extra ab

>
> smtpd_sasl_auth_enable = yes
> smtpd_helo_required = yes
> smtpd_use_pw_server = yes
> #mit Greylisting
> #smtpd_recipient_restrictions = permit_sasl_authenticated
> permit_mynetworks reject_unauth_destination check_policy_service
> unix:private/policy permit
> #ohne Greylisting
> smtpd_recipient_restrictions =
> permit_sasl_authenticated
> permit_mynetworks
> permit_tls_clientcerts
> check_sender_access hash:/etc/postfix/whitelist
> reject_non_fqdn_hostname
> reject_unknown_reverse_client_hostname
> reject_unauth_destination
> reject_rbl_client cbl.abuseat.org
> reject_rbl_client zen.spamhaus.org
>
> smtpd_pw_server_security_options = login,gssapi,cram-md5
> data_directory = /var/lib/postfix
> smtpd_client_restrictions =
> smtpd_sender_restrictions =
> check_sender_access regexp:/etc/postfix/tag_as_originating.re
> permit_mynetworks
> permit_sasl_authenticated
> permit_tls_clientcerts
> check_sender_access regexp:/etc/postfix/tag_as_foreign.re
>
> smtpd_data_restrictions = reject_unauth_pipelining
> mydestination = $myhostname, localhost.$mydomain, localhost,
> mail.$mydomain, liste.$mydomain, $mydomain
> virtual_transport = virtual
>
>
> Die Mails kommen mit sasl_username=ftp hier an. Beim (Sytem-Benutzer)
> ftp ist Mail nicht aktiviert.

Dann Prüfe deine adressmaps ob da evtl. doch ein ftp@ drin steht.
Deine Userüberprüfung ist scheinbar nicht korrekt.
Wenn da jemand sowas über deinen Server wegschickt und sich angemeldet hat
dann ist das ein eigener User dem es erlaubt ist unter falscher Mailadresse
zu senden.

Ich hatte dir eine Beispielreihenfolge und einiges mehr an Restriktionen
gezeigt. Da waren auch welche darunter die verhindern das da jemand unter
einer anderen Mailadresse sendet wie er angemeldet ist

Es reicht die normale Ausgabe des Logfiles (kein -v -vv usw in der
Master.cf)

Postconf -n ist eigentlich Pflicht mitzuschicken wenn dir da jemand in die
Konfig schauen soll.


>
>
> Das Mail sieht so aus:
> Content type: Spam
> Internal reference code for the message is 20536-07/3+yiMXOQhcE5
>
> First upstream SMTP client IP address: [65.200.13.203]
> According to a 'Received:' trace, the message apparently originated at:
>  [17.45.146.70], nico-lae.qr.32.de [17.45.146.70]
>
> Return-Path: <[hidden email]>
> From:
>  [hidden email]-24-hrs-
> cooperative-online.co.uk
> Message-ID:
>  <[hidden email].363@e-mail-alert-
> id.9656.review-24-hrs-cooperative-online.co.uk.aristo-internet.nl>
> X-Mailer: Stylatule-decouvrez 6.4
> Subject: IMPORTANT SECURITY ISSUES [INCIDENT 462376-xz-46 ]
> Not quarantined.
>
> The message WAS NOT relayed to:
> <[hidden email]>:
>   250 2.7.0 Ok, discarded, id=20536-07 - SPAM
>
> SpamAssassin report:
> Spam detection software, running on the system "mcgregor.admilon.net",
> has
> identified this incoming email as possible spam.  The original message
> has been attached to this so you can view it (if it isn't spam) or label
> similar future email.  If you have any questions, see
> [hidden email] for details.
>
> Content preview:  ACCESS TO YOUR ACCOUNT HAS BEEN TEMPORARILY
> SUSPENDED. The
>   reason for this issue: - UNUSUAL NUMBER OF INVALID LOGIN ATTEMPTS
> ON YOUR
>   ACCOUNT To restore your account, please click below: [...]
>
> Content analysis details:   (13.0 points, 25.0 required)
>
> pts rule name              description
> ---- ----------------------
--------------------------------------------------

> 0.0 MSGID_MULTIPLE_AT      Message-ID contains multiple '@' characters
> 0.9 DKIM_ADSP_NXDOMAIN     No valid author signature and domain not in
> DNS
> 2.4 TVD_PH_BODY_ACCOUNTS_PRE BODY: TVD_PH_BODY_ACCOUNTS_PRE
> -0.0 BAYES_40               BODY: Bayes spam probability is 20 to 40%
>                            [score: 0.3950]
> 1.5 HTML_IMAGE_ONLY_20     BODY: HTML: images with 1600-2000 bytes of
> words
> 0.3 HTML_MESSAGE           BODY: HTML included in message
> 0.7 MIME_HTML_ONLY         BODY: Message only has text/html MIME parts
> 1.9 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
>                            above 50%
>                            [cf: 100]
> 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
>                            [cf: 100]
> 4.0 RAZOR2_CHECK           Listed in Razor2 (http://razor.sf.net/)
> 0.8 RDNS_NONE              Delivered to internal network by a host with no
rDNS

> 0.0 TO_EQ_FM_HTML_ONLY     To == From and HTML only
> 0.0 TO_NO_BRKTS_NORDNS_HTML TO_NO_BRKTS_NORDNS_HTML
> Return-Path: <[hidden email]>
> Received: from [128.2.1.64] (unknown [65.200.13.203])
> by mcgregor.admilon.net (Postfix) with ESMTPA id 25AF01DBA536
> for <[hidden email]>; Mon, 17 Sep 2012 22:22:07 +0900 (JST)
> X-TM-AS-Result: No--7.291-5.0-31-1
> X-Recommended-Action: accept
> X-IronPort-AV: E=Sophos;i="4.80,368,1344186000";
> X-Envelope-From: hsbc-uk-mintea-nji-iasti-ebay-de.fr-dultzii@nico-
> lae.qr.32.de
> Content-type: text/html
> X-Proofpoint-Spam-Details: rule=notspam policy=default score=11
> spamscore=11 suspectscore=3
> X-SpamExpertAristo-Outgoing-Evidence: Combined (0.24)
> X-SpamExpertAristo-Username: 61.8.92.97
> X-Mailer: Stylatule-decouvrez 6.4
> To: [hidden email]
> Date: Mon, 17 Sep 2012 13:22:08 GMT
> X-Barracuda-Start-Time: 135755806806600
> Subject: IMPORTANT SECURITY ISSUES [INCIDENT 462376-xz-46 ]
> X-Copfilter-Virus-Scanned: ClamAV 0.684.2
> Received: from nico-lae.qr.32.de ([17.45.146.70]) by ghs-fw (Copfilter
> 0.84beta4)
> X-IronPort-Anti-Spam-Filtered: true
> From: [hidden email]-24-hrs-
> cooperative-online.co.uk
> X-Filter-ID:
> XtLePq6GTMn8G68F0comdleehesxkccwnpq66380849601991cmBIW/8OODKS
> 1A/6t51a7Dur
> X-Filtered-With: Copfilter Version 0.84beta4 (ProxSMTP 1.8)
> X-Proofpoint-Virus-Version: vendor=fsecure
> engine=2.50.10432:5.7.7855,1.0.431,0.0.000
> X-OriginalArrivalTime: 04 Sep 2012 16:53:23.0515 (UTC)
> FILETIME=[CBBBD8B0:01CD8ABD]
> X-SpamExpertAristo-Domain: joomlabouwer.nl
> Message-ID: <[hidden email].363@e-mail-
> alert-id.9656.review-24-hrs-cooperative-online.co.uk.aristo-internet.nl>
> X-Originating-IP: 61.8.92.97
> X-imss-scan-details: No--7.291-5.0-31-1
> X-Copfilter-Originating-IP: 89.105.199.76
> X-SpamExpertAristo-Outgoing-Class: ham
> X-TM-IMSS-Message-ID: <[hidden email]>
> X-IronPort-Anti-Spam-Result: tc597710475692009648zbf1847zhfdijebku$
> X-TM-AS-Product-Ver: IMSS-7.0.0.6126-6.8.0.1017-19162.000
> Authentication-Results: aristo-internet.nl;auth=pass ()
smtp.auth=61.8.92.97

> Content-Transfer-Encoding: 7bit
>
>
> Im Protokoll sieht das so aus:
>
> Sep 17 22:22:05 mcgregor postfix/smtpd[20603]: connect from
> unknown[65.200.13.203]
> Sep 17 22:22:08 mcgregor postfix/smtpd[20603]: NOQUEUE: filter: RCPT from
> unknown[65.200.13.203]: <[hidden email]>: Sender address
> triggers FILTER smtp-amavis:[127.0.0.1]:10026; from=<dagata@ma-
> pu.plm.com> to=<[hidden email]> proto=ESMTP
> helo=<[128.2.1.64]>
> Sep 17 22:22:08 mcgregor postfix/smtpd[20603]: 25AF01DBA536:
> client=unknown[65.200.13.203], sasl_method=CRAM-MD5,
> sasl_username=ftp
> Sep 17 22:22:17 mcgregor postfix/cleanup[20650]: 25AF01DBA536: message-
> id=<[hidden email].363@e-mail-alert-
> id.9656.review-24-hrs-cooperative-online.co.uk.aristo-internet.nl>
> Sep 17 22:22:17 mcgregor postfix/qmgr[505]: 25AF01DBA536:
> from=<[hidden email]>, size=3817, nrcpt=1 (queue active)
> Sep 17 22:22:17 mcgregor amavis[20536]: (20536-06) loaded policy bank
> "ORIGINATING"
> Sep 17 22:22:17 mcgregor amavis[20536]: (20536-06) process_request: fileno
> sock=12, STDIN=0, STDOUT=1
> Sep 17 22:22:17 mcgregor amavis[20536]: (20536-07) ESMTP::10026
> /var/amavis/tmp/amavis-20120917T221431-20536: <dagata@ma-
> pu.plm.com> -> <[hidden email]> Received: from
> mcgregor.admilon.net ([127.0.0.1]) by localhost (mcgregor.admilon.net
> [127.0.0.1]) (amavisd-new, port 10026) with ESMTP for
> <[hidden email]>; Mon, 17 Sep 2012 22:22:17 +0900 (JST)
> Sep 17 22:22:17 mcgregor amavis[20536]: (20536-07) smtp connection cache,
> dt: 85.1, state: 0
> Sep 17 22:22:17 mcgregor amavis[20536]: (20536-07) body hash:
> b55bb74e4d5c950db7ed42aa282aa202
> Sep 17 22:22:17 mcgregor amavis[20536]: (20536-07) Checking:
> 3+yiMXOQhcE5 ORIGINATING [65.200.13.203] <[hidden email]> ->
> <[hidden email]>
> Sep 17 22:22:17 mcgregor amavis[20536]: (20536-07) 2822.From: <Co-
> [hidden email]-24-hrs-
> cooperative-online.co.uk>, 2821.Mail_From: <[hidden email]>
> Sep 17 22:22:17 mcgregor amavis[20536]: (20536-07) p001 1 Content-Type:
> text/html, size: 1755 B, name:
> Sep 17 22:22:17 mcgregor amavis[20536]: (20536-07) Checking for banned
> types and filenames
> Sep 17 22:22:17 mcgregor amavis[20536]: (20536-07) INFO: unknown banned
> table name ALT-RULES, recip=[hidden email]
> Sep 17 22:22:17 mcgregor amavis[20536]: (20536-07) collect banned
table[0]:

> [hidden email], tables:
> Sep 17 22:22:17 mcgregor amavis[20536]: (20536-07) p.path
> [hidden email]: "P=p001,L=1,M=text/html,T=html"
> Sep 17 22:22:17 mcgregor amavis[20536]: (20536-07) ask_av Using (ClamAV-
> clamd): CONTSCAN /var/amavis/tmp/amavis-20120917T221431-
> 20536/parts\n
> Sep 17 22:22:17 mcgregor amavis[20536]: (20536-07) ClamAV-clamd:
> Connecting to socket  /var/amavis/clamd
> Sep 17 22:22:17 mcgregor amavis[20536]: (20536-07) ClamAV-clamd: Sending
> CONTSCAN /var/amavis/tmp/amavis-20120917T221431-20536/parts\n to
> UNIX socket /var/amavis/clamd
> Sep 17 22:22:17 mcgregor amavis[20536]: (20536-07) run_av (ClamAV-clamd):
> CLEAN
> Sep 17 22:22:17 mcgregor amavis[20536]: (20536-07) run_av (ClamAV-clamd)
> result: clean
> Sep 17 22:22:18 mcgregor postfix/smtpd[20603]: disconnect from
> unknown[65.200.13.203]
> Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) spam_scan:
> score=13.043 autolearn=no tests=[BAYES_40=-
> 0.001,DKIM_ADSP_NXDOMAIN=0.9,HTML_IMAGE_ONLY_20=1.546,HTML_
> MESSAGE=0.3,MIME_HTML_ONLY=0.723,MSGID_MULTIPLE_AT=0.001,RAZO
> R2_CF_RANGE_51_100=0.5,RAZOR2_CF_RANGE_E8_51_100=1.886,RAZOR2_
> CHECK=4,RDNS_NONE=0.793,TO_EQ_FM_HTML_ONLY=0.001,TO_NO_BRKT
> S_NORDNS_HTML=0.001,TVD_PH_BODY_ACCOUNTS_PRE=2.393]
> Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) blocking contents
> category is (6) for [hidden email]
> Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) do_notify_and_quar:
> ccat=Spam (6,0) ("6":Spam, "5":Spammy, "1,1":CleanTag, "1":Clean,
> "0":CatchAll) ccat_block=(6), qar_mth=
> Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) skip local delivery(3):
<>

> -> <spam-quarantine>
> Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) SPAM, <dagata@ma-
> pu.plm.com> -> <[hidden email]>, Yes, score=13.043 tag=-999
> tag2=7 kill=12 tests=[BAYES_40=-0.001, DKIM_ADSP_NXDOMAIN=0.9,
> HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.3,
> MIME_HTML_ONLY=0.723, MSGID_MULTIPLE_AT=0.001,
> RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.886,
> RAZOR2_CHECK=4, RDNS_NONE=0.793, TO_EQ_FM_HTML_ONLY=0.001,
> TO_NO_BRKTS_NORDNS_HTML=0.001,
> TVD_PH_BODY_ACCOUNTS_PRE=2.393] autolearn=no, quarantine
> 3+yiMXOQhcE5 (spam-quarantine)
> Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) dkim: candidate
> originators: 2822.From:<[hidden email]>,
> 2821.mail_from:<[hidden email]>
> Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) dkim: signing (author),
> From: <[hidden email]>, KEY.key_ind=>0, a=>rsa-sha256,
> c=>relaxed/simple, d=>admilon.net, s=>default, ttl=>1814400,
> x=>1349702537.86839
> Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) smtp session: setting
up

> a new session
> Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) smtp creating socket by
> IO::Socket::INET to [127.0.0.1]:10027
> Sep 17 22:22:23 mcgregor postfix/smtpd[20578]: connect from
> localhost[127.0.0.1]
> Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) smtp resp to greeting:
> 220 mcgregor.admilon.net ESMTP Postfix
> Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) smtp cmd> EHLO
> localhost
> Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) smtp resp to EHLO: 250
> mcgregor.admilon.net\nPIPELINING\nSIZE 41943040\nVRFY\nETRN\nAUTH
> LOGIN CRAM-MD5
> GSSAPI\nSTARTTLS\nENHANCEDSTATUSCODES\n8BITMIME\nDSN
> Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) AUTH not needed,
> user='', MTA offers 'LOGIN CRAM-MD5 GSSAPI'
> Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) smtp cmd> MAIL
> FROM:<[hidden email]>
> ENVID=[hidden email]
> Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) smtp cmd> RCPT
> TO:<[hidden email]>
> Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) smtp cmd> DATA
> Sep 17 22:22:23 mcgregor postfix/smtpd[20578]: E8B861DBA541:
> client=localhost[127.0.0.1]
> Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) smtp resp to MAIL
(pip):

> 250 2.1.0 Ok
> Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) smtp resp to RCPT (pip)
> (<[hidden email]>): 250 2.1.5 Ok
> Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) smtp resp to DATA: 354
> End data with <CR><LF>.<CR><LF>
> Sep 17 22:22:23 mcgregor amavis[20536]: (20536-07) smtp cmd> QUIT
>
> irgendwo ist da also noch ein Loch, an welche Schraube muss ich denn
> drehen um dem einen Riegel vorzuschieben?
> Danke und Gruss
> Matthias


Mit freundlichen Grüßen

Uwe Drießen
--
Software & Computer
Uwe Drießen
Lembergstraße 33
67824 Feilbingert

Tel.: 06708660045


_______________________________________________
postfix-users mailing list
[hidden email]
http://de.postfix.org/cgi-bin/mailman/listinfo/postfix-users
Reply | Threaded
Open this post in threaded view
|

Re: [postfix-users] Spam von local - schon wieder ...

Matthias Schmidt [c]

Hallo Uwe,
erstmal Danke für die prompte Antwort :-)

Am 18.09.2012 um 16:05 schrieb Uwe Drießen:

>>
>> bei mir sind gestern wieder über rund 45 Minuten mails eingegangen und
>> teilweise wegen Spam abgelehnt worden.
>> Als das das erste mal passiert ist, hab ich den Rat von Uwe befolgt und
> meine
>> main.cf so geändert:
>
> Ich hatte dir empfohlen alle Restrictionen unter
> smtpd_recipient_restrictions =
> Zusammenzufassen.
> Du fragst immer noch smtpd_sender_restrictions = extra ab


argh .. hatte ich übersehen, sorry ...
Das sieht also jetzt so aus:
smtpd_delay_reject = no
smtpd_recipient_restrictions =
                permit_sasl_authenticated
                permit_mynetworks
                permit_tls_clientcerts
                check_sender_access hash:/etc/postfix/whitelist
                check_sender_access regexp:/etc/postfix/tag_as_originating.re
                check_sender_access regexp:/etc/postfix/tag_as_foreign.re
                reject_non_fqdn_hostname
                reject_unknown_reverse_client_hostname
                reject_unauth_destination
                reject_rbl_client cbl.abuseat.org
                reject_rbl_client zen.spamhaus.org
smtpd_sender_restrictions =

(...)

>>
>> Die Mails kommen mit sasl_username=ftp hier an. Beim (Sytem-Benutzer)
>> ftp ist Mail nicht aktiviert.
>
> Dann Prüfe deine adressmaps ob da evtl. doch ein ftp@ drin steht.
> Deine Userüberprüfung ist scheinbar nicht korrekt.
> Wenn da jemand sowas über deinen Server wegschickt und sich angemeldet hat
> dann ist das ein eigener User dem es erlaubt ist unter falscher Mailadresse
> zu senden.

da find ich eben nix .... und ich versteh es nicht, wie der Spammer das macht.

allerdings hab ich das hier drin:
virtual_mailbox_domains = hash:/etc/postfix/virtual_domains_dummy
und da steht:
dummy.local allow
drin
das war wegen einem bug in der MacOS implementierng, kann mich aber nicht mehr erinnern, was das genau war.

>
> Ich hatte dir eine Beispielreihenfolge und einiges mehr an Restriktionen
> gezeigt. Da waren auch welche darunter die verhindern das da jemand unter
> einer anderen Mailadresse sendet wie er angemeldet ist

ich kann mich nur an das hier erinnern:
smtpd_delay_reject = no
das hab ich eingefügt.

wie kann ich das mit der Mailadresse verhindern?

>
> Es reicht die normale Ausgabe des Logfiles (kein -v -vv usw in der
> Master.cf)
>
> Postconf -n ist eigentlich Pflicht mitzuschicken wenn dir da jemand in die
> Konfig schauen soll.
>
2bounce_notice_recipient = postmaster
access_map_reject_code = 554
address_verify_default_transport = $default_transport
address_verify_local_transport = $local_transport
address_verify_map =
address_verify_negative_cache = yes
address_verify_negative_expire_time = 3d
address_verify_negative_refresh_time = 3h
address_verify_poll_count = 3
address_verify_poll_delay = 3s
address_verify_positive_expire_time = 31d
address_verify_positive_refresh_time = 7d
address_verify_relay_transport = $relay_transport
address_verify_relayhost = $relayhost
address_verify_sender = $double_bounce_sender
address_verify_sender_dependent_relayhost_maps = $sender_dependent_relayhost_maps
address_verify_service_name = verify
address_verify_transport_maps = $transport_maps
address_verify_virtual_transport = $virtual_transport
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases,hash:/var/mailman/data/aliases
allow_mail_to_commands = alias, forward
allow_mail_to_files = alias, forward
always_bcc =
anvil_rate_time_unit = 60s
anvil_status_update_time = 600s
application_event_drain_time = 100s
authorized_flush_users = static:anyone
authorized_mailq_users = static:anyone
authorized_submit_users = static:anyone
backwards_bounce_logfile_compatibility = yes
berkeley_db_create_buffer_size = 16777216
berkeley_db_read_buffer_size = 131072
best_mx_transport =
body_checks_size_limit = 51200
bounce_notice_recipient = postmaster
bounce_queue_lifetime = 5d
bounce_service_name = bounce
bounce_size_limit = 50000
bounce_template_file =
canonical_classes = envelope_sender, envelope_recipient, header_sender, header_recipient
check_for_od_forward = yes
cleanup_service_name = cleanup
command_directory = /usr/sbin
command_execution_directory =
command_expansion_filter = 1234567890!@%-_=+:,./abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
command_time_limit = 1000s
config_directory = /etc/postfix
connection_cache_protocol_timeout = 5s
connection_cache_service_name = scache
connection_cache_status_update_time = 600s
connection_cache_ttl_limit = 2s
content_filter = smtp-amavis:[127.0.0.1]:10024
cyrus_sasl_config_path =
daemon_directory = /usr/libexec/postfix
daemon_timeout = 18000s
data_directory = /var/lib/postfix
debug_peer_level = 5
debug_peer_list =
default_database_type = hash
default_delivery_slot_cost = 5
default_delivery_slot_discount = 50
default_delivery_slot_loan = 3
default_destination_concurrency_failed_cohort_limit = 1
default_destination_concurrency_limit = 20
default_destination_concurrency_negative_feedback = 1
default_destination_concurrency_positive_feedback = 1
default_destination_rate_delay = 0s
default_destination_recipient_limit = 50
default_extra_recipient_limit = 1000
default_minimum_delivery_slots = 3
default_privs = nobody
default_process_limit = 100
default_rbl_reply = $rbl_code Service unavailable; $rbl_class [$rbl_what] blocked using $rbl_domain${rbl_reason?; $rbl_reason}
default_recipient_limit = 20000
default_recipient_refill_delay = 5s
default_recipient_refill_limit = 100
default_transport = smtp
default_verp_delimiters = +=
defer_code = 450
defer_service_name = defer
defer_transports =
delay_logging_resolution_limit = 2
delay_notice_recipient = postmaster
delay_warning_time = 0h
deliver_lock_attempts = 20
deliver_lock_delay = 1s
destination_concurrency_feedback_debug = no
detect_8bit_encoding_header = yes
dont_remove = 0
double_bounce_sender = double-bounce
duplicate_filter_limit = 1000
empty_address_recipient = MAILER-DAEMON
empty_address_relayhost_maps_lookup_key = <>
enable_original_recipient = yes
enable_server_options = yes
error_notice_recipient = postmaster
error_service_name = error
execution_directory_expansion_filter = 1234567890!@%-_=+:,./abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
export_environment = TZ MAIL_CONFIG LANG
fallback_transport =
fallback_transport_maps =
fast_flush_domains = $relay_domains
fast_flush_purge_time = 7d
fast_flush_refresh_time = 12h
fault_injection_code = 0
flush_service_name = flush
fork_attempts = 5
fork_delay = 1s
forward_expansion_filter = 1234567890!@%-_=+:,./abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
forward_path = $home/.forward${recipient_delimiter}${extension}, $home/.forward
frozen_delivered_to = yes
hash_queue_depth = 1
hash_queue_names = deferred,defer
header_address_token_limit = 10240
header_checks = pcre:/etc/postfix/custom_header_checks
header_size_limit = 102400
hopcount_limit = 50
html_directory = no
import_environment = MAIL_CONFIG MAIL_DEBUG MAIL_LOGTAG TZ XAUTHORITY DISPLAY LANG=C
in_flow_delay = 1s
inet_interfaces = all
inet_protocols = ipv4
initial_destination_concurrency = 5
internal_mail_filter_classes =
invalid_hostname_reject_code = 501
ipc_idle = 5s
ipc_timeout = 3600s
ipc_ttl = 1000s
line_length_limit = 2048
lmtp_bind_address =
lmtp_bind_address6 =
lmtp_body_checks =
lmtp_cname_overrides_servername = no
lmtp_connect_timeout = 0s
lmtp_connection_cache_destinations =
lmtp_connection_cache_on_demand = yes
lmtp_connection_cache_time_limit = 2s
lmtp_connection_reuse_time_limit = 300s
lmtp_data_done_timeout = 600s
lmtp_data_init_timeout = 120s
lmtp_data_xfer_timeout = 180s
lmtp_defer_if_no_mx_address_found = no
lmtp_destination_concurrency_failed_cohort_limit = $default_destination_concurrency_failed_cohort_limit
lmtp_destination_concurrency_limit = $default_destination_concurrency_limit
lmtp_destination_concurrency_negative_feedback = $default_destination_concurrency_negative_feedback
lmtp_destination_concurrency_positive_feedback = $default_destination_concurrency_positive_feedback
lmtp_destination_rate_delay = $default_destination_rate_delay
lmtp_destination_recipient_limit = $default_destination_recipient_limit
lmtp_discard_lhlo_keyword_address_maps =
lmtp_discard_lhlo_keywords =
lmtp_enforce_tls = no
lmtp_generic_maps =
lmtp_header_checks =
lmtp_host_lookup = dns
lmtp_initial_destination_concurrency = $initial_destination_concurrency
lmtp_lhlo_name = $myhostname
lmtp_lhlo_timeout = 300s
lmtp_line_length_limit = 990
lmtp_mail_timeout = 300s
lmtp_mime_header_checks =
lmtp_mx_address_limit = 5
lmtp_mx_session_limit = 2
lmtp_nested_header_checks =
lmtp_pix_workaround_delay_time = 10s
lmtp_pix_workaround_maps =
lmtp_pix_workaround_threshold_time = 500s
lmtp_pix_workarounds = disable_esmtp,delay_dotcrlf
lmtp_quit_timeout = 300s
lmtp_quote_rfc821_envelope = yes
lmtp_randomize_addresses = yes
lmtp_rcpt_timeout = 300s
lmtp_rset_timeout = 20s
lmtp_sasl_auth_cache_name =
lmtp_sasl_auth_cache_time = 90d
lmtp_sasl_auth_soft_bounce = yes
lmtp_sasl_mechanism_filter =
lmtp_sasl_path =
lmtp_sasl_security_options = noplaintext, noanonymous
lmtp_sasl_tls_security_options = $lmtp_sasl_security_options
lmtp_sasl_tls_verified_security_options = $lmtp_sasl_tls_security_options
lmtp_sasl_type = cyrus
lmtp_send_xforward_command = no
lmtp_sender_dependent_authentication = no
lmtp_skip_5xx_greeting = yes
lmtp_starttls_timeout = 300s
lmtp_tcp_port = 24
lmtp_tls_CAfile =
lmtp_tls_CApath =
lmtp_tls_cert_file =
lmtp_tls_dcert_file =
lmtp_tls_dkey_file = $lmtp_tls_dcert_file
lmtp_tls_enforce_peername = yes
lmtp_tls_exclude_ciphers =
lmtp_tls_fingerprint_cert_match =
lmtp_tls_fingerprint_digest = md5
lmtp_tls_key_file = $lmtp_tls_cert_file
lmtp_tls_loglevel = 0
lmtp_tls_mandatory_ciphers = medium
lmtp_tls_mandatory_exclude_ciphers =
lmtp_tls_mandatory_protocols = SSLv3, TLSv1
lmtp_tls_note_starttls_offer = no
lmtp_tls_per_site =
lmtp_tls_policy_maps =
lmtp_tls_scert_verifydepth = 9
lmtp_tls_secure_cert_match = nexthop
lmtp_tls_security_level =
lmtp_tls_session_cache_database =
lmtp_tls_session_cache_timeout = 3600s
lmtp_tls_verify_cert_match = hostname
lmtp_use_tls = no
lmtp_xforward_timeout = 300s
local_command_shell =
local_destination_concurrency_failed_cohort_limit = $default_destination_concurrency_failed_cohort_limit
local_destination_concurrency_limit = 2
local_destination_concurrency_negative_feedback = $default_destination_concurrency_negative_feedback
local_destination_concurrency_positive_feedback = $default_destination_concurrency_positive_feedback
local_destination_rate_delay = $default_destination_rate_delay
local_destination_recipient_limit = 1
local_header_rewrite_clients = permit_inet_interfaces
local_initial_destination_concurrency = $initial_destination_concurrency
local_recipient_maps = proxy:unix:passwd.byname $alias_maps
local_transport = local:$myhostname
luser_relay =
mail_name = Postfix
mail_owner = _postfix
mail_release_date = 20080902
mail_spool_directory = /var/mail
mail_version = 2.5.5
mailbox_command =
mailbox_command_maps =
mailbox_delivery_lock = flock, dotlock
mailbox_size_limit = 0
mailbox_transport = dovecot
mailbox_transport_maps =
mailq_path = /usr/bin/mailq
manpage_directory = /usr/share/man
maps_rbl_domains =
maps_rbl_reject_code = 554
masquerade_classes = envelope_sender, header_sender, header_recipient
masquerade_domains =
masquerade_exceptions =
max_idle = 100s
max_use = 100
maximal_backoff_time = 4000s
maximal_queue_lifetime = 5d
message_reject_characters =
message_size_limit = 41943040
message_strip_characters =
milter_command_timeout = 30s
milter_connect_macros = j {daemon_name} v
milter_connect_timeout = 30s
milter_content_timeout = 300s
milter_data_macros = i
milter_default_action = tempfail
milter_end_of_data_macros = i
milter_end_of_header_macros = i
milter_helo_macros = {tls_version} {cipher} {cipher_bits} {cert_subject} {cert_issuer}
milter_macro_daemon_name = $myhostname
milter_macro_v = $mail_name $mail_version
milter_mail_macros = i {auth_type} {auth_authen} {auth_author} {mail_addr}
milter_protocol = 2
milter_rcpt_macros = i {rcpt_addr}
milter_unknown_command_macros =
mime_boundary_length_limit = 2048
mime_header_checks = $header_checks
mime_nesting_limit = 100
minimal_backoff_time = 300s
multi_recipient_bounce_reject_code = 550
mydestination = $myhostname, localhost.$mydomain, localhost, mail.$mydomain, liste.$mydomain, $mydomain
mydomain = admilon.net
mydomain_fallback = localhost
myhostname = mcgregor.admilon.net
mynetworks = 127.0.0.0/8,192.168.2.0/24,192.168.1.0/24
mynetworks_style = host
myorigin = $myhostname
nested_header_checks = $header_checks
newaliases_path = /usr/bin/newaliases
non_fqdn_reject_code = 504
non_smtpd_milters =
notify_classes = resource, software
owner_request_special = no
parent_domain_matches_subdomains = debug_peer_list,fast_flush_domains,mynetworks,permit_mx_backup_networks,qmqpd_authorized_clients,relay_domains,smtpd_access_maps
permit_mx_backup_networks =
pickup_service_name = pickup
plaintext_reject_code = 450
prepend_delivered_header = command, file, forward
process_id_directory = pid
propagate_unmatched_extensions = canonical, virtual
proxy_interfaces =
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $sender_bcc_maps $recipient_bcc_maps $smtp_generic_maps $lmtp_generic_maps
proxy_write_maps = $smtp_sasl_auth_cache_name $lmtp_sasl_auth_cache_name
qmgr_clog_warn_time = 300s
qmgr_fudge_factor = 100
qmgr_message_active_limit = 20000
qmgr_message_recipient_limit = 20000
qmgr_message_recipient_minimum = 10
qmqpd_authorized_clients =
qmqpd_client_port_logging = no
qmqpd_error_delay = 1s
qmqpd_timeout = 300s
queue_directory = /private/var/spool/postfix
queue_file_attribute_count_limit = 100
queue_minfree = 0
queue_run_delay = 300s
queue_service_name = qmgr
rbl_reply_maps =
readme_directory = /usr/share/doc/postfix
receive_override_options =
recipient_bcc_maps =
recipient_canonical_classes = envelope_recipient, header_recipient
recipient_delimiter = +
reject_code = 554
relay_clientcerts =
relay_destination_concurrency_failed_cohort_limit = $default_destination_concurrency_failed_cohort_limit
relay_destination_concurrency_limit = $default_destination_concurrency_limit
relay_destination_concurrency_negative_feedback = $default_destination_concurrency_negative_feedback
relay_destination_concurrency_positive_feedback = $default_destination_concurrency_positive_feedback
relay_destination_rate_delay = $default_destination_rate_delay
relay_destination_recipient_limit = $default_destination_recipient_limit
relay_domains = $mydestination
relay_domains_reject_code = 554
relay_initial_destination_concurrency = $initial_destination_concurrency
relay_recipient_maps =
relay_transport = relay
relayhost =
relocated_maps =
remote_header_rewrite_domain =
resolve_null_domain = no
resolve_numeric_domain = no
rewrite_service_name = rewrite
sample_directory = /usr/share/doc/postfix/examples
send_cyrus_sasl_authzid = no
sender_bcc_maps =
sender_canonical_classes = envelope_sender, header_sender
sender_canonical_maps =
sender_dependent_relayhost_maps =
sendmail_path = /usr/sbin/sendmail
service_throttle_time = 60s
setgid_group = _postdrop
showq_service_name = showq
smtp_bind_address6 =
smtp_body_checks =
smtp_cname_overrides_servername = no
smtp_connect_timeout = 30s
smtp_connection_cache_destinations =
smtp_connection_cache_on_demand = yes
smtp_connection_cache_time_limit = 2s
smtp_connection_reuse_time_limit = 300s
smtp_data_done_timeout = 600s
smtp_data_init_timeout = 120s
smtp_data_xfer_timeout = 180s
smtp_defer_if_no_mx_address_found = no
smtp_destination_concurrency_failed_cohort_limit = $default_destination_concurrency_failed_cohort_limit
smtp_destination_concurrency_limit = $default_destination_concurrency_limit
smtp_destination_concurrency_negative_feedback = $default_destination_concurrency_negative_feedback
smtp_destination_concurrency_positive_feedback = $default_destination_concurrency_positive_feedback
smtp_destination_rate_delay = $default_destination_rate_delay
smtp_destination_recipient_limit = $default_destination_recipient_limit
smtp_discard_ehlo_keyword_address_maps =
smtp_discard_ehlo_keywords =
smtp_fallback_relay = $fallback_relay
smtp_generic_maps =
smtp_header_checks =
smtp_helo_name = $myhostname
smtp_helo_timeout = 300s
smtp_host_lookup = dns
smtp_initial_destination_concurrency = $initial_destination_concurrency
smtp_line_length_limit = 990
smtp_mail_timeout = 300s
smtp_mime_header_checks =
smtp_mx_address_limit = 5
smtp_mx_session_limit = 2
smtp_nested_header_checks =
smtp_pix_workaround_delay_time = 10s
smtp_pix_workaround_maps =
smtp_pix_workaround_threshold_time = 500s
smtp_pix_workarounds = disable_esmtp,delay_dotcrlf
smtp_quit_timeout = 300s
smtp_quote_rfc821_envelope = yes
smtp_rcpt_timeout = 300s
smtp_rset_timeout = 20s
smtp_sasl_auth_cache_name =
smtp_sasl_auth_cache_time = 90d
smtp_sasl_auth_soft_bounce = yes
smtp_sasl_mechanism_filter =
smtp_sasl_password_maps =
smtp_sasl_path =
smtp_sasl_security_options = noplaintext, noanonymous
smtp_sasl_tls_security_options = $smtp_sasl_security_options
smtp_sasl_tls_verified_security_options = $smtp_sasl_tls_security_options
smtp_sasl_type = cyrus
smtp_send_xforward_command = no
smtp_sender_dependent_authentication = no
smtp_starttls_timeout = 300s
smtp_tls_CAfile =
smtp_tls_CApath =
smtp_tls_dcert_file =
smtp_tls_dkey_file = $smtp_tls_dcert_file
smtp_tls_enforce_peername = yes
smtp_tls_exclude_ciphers =
smtp_tls_fingerprint_cert_match =
smtp_tls_fingerprint_digest = md5
smtp_tls_key_file = $smtp_tls_cert_file
smtp_tls_loglevel = 0
smtp_tls_mandatory_ciphers = medium
smtp_tls_mandatory_exclude_ciphers =
smtp_tls_mandatory_protocols = SSLv3, TLSv1
smtp_tls_note_starttls_offer = yes
smtp_tls_per_site =
smtp_tls_policy_maps =
smtp_tls_scert_verifydepth = 9
smtp_tls_secure_cert_match = nexthop, dot-nexthop
smtp_tls_session_cache_database =
smtp_tls_session_cache_timeout = 3600s
smtp_tls_verify_cert_match = hostname
smtp_use_tls = no
smtp_xforward_timeout = 300s
smtpd_authorized_verp_clients = $authorized_verp_clients
smtpd_authorized_xclient_hosts =
smtpd_authorized_xforward_hosts =
smtpd_banner = $myhostname ESMTP $mail_name
smtpd_client_connection_count_limit = 50
smtpd_client_connection_rate_limit = 0
smtpd_client_event_limit_exceptions = ${smtpd_client_connection_limit_exceptions:$mynetworks}
smtpd_client_message_rate_limit = 0
smtpd_client_new_tls_session_rate_limit = 10
smtpd_client_port_logging = no
smtpd_client_recipient_rate_limit = 0
smtpd_client_restrictions =
smtpd_data_restrictions = reject_unauth_pipelining
smtpd_delay_open_until_valid_rcpt = yes
smtpd_delay_reject = no
smtpd_discard_ehlo_keyword_address_maps =
smtpd_discard_ehlo_keywords =
smtpd_end_of_data_restrictions =
smtpd_enforce_tls = no
smtpd_error_sleep_time = 1s
smtpd_etrn_restrictions =
smtpd_expansion_filter = \t\40!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~
smtpd_forbidden_commands = CONNECT GET POST
smtpd_hard_error_limit = 20
smtpd_helo_required = yes
smtpd_helo_restrictions = reject_invalid_helo_hostname reject_non_fqdn_helo_hostname
smtpd_history_flush_threshold = 100
smtpd_junk_command_limit = 100
smtpd_milters =
smtpd_noop_commands =
smtpd_null_access_lookup_key = <>
smtpd_peername_lookup = yes
smtpd_policy_service_max_idle = 300s
smtpd_policy_service_max_ttl = 1000s
smtpd_policy_service_timeout = 100s
smtpd_proxy_ehlo = $myhostname
smtpd_proxy_filter =
smtpd_proxy_timeout = 100s
smtpd_pw_server_security_options = login,gssapi,cram-md5
smtpd_recipient_limit = 1000
smtpd_recipient_overshoot_limit = 1000
smtpd_recipient_restrictions = permit_sasl_authenticated permit_mynetworks permit_tls_clientcerts check_sender_access hash:/etc/postfix/whitelist check_sender_access regexp:/etc/postfix/tag_as_originating.re check_sender_access regexp:/etc/postfix/tag_as_foreign.re reject_non_fqdn_hostname reject_unknown_reverse_client_hostname reject_unauth_destination reject_rbl_client cbl.abuseat.org reject_rbl_client zen.spamhaus.org
smtpd_reject_unlisted_recipient = yes
smtpd_reject_unlisted_sender = no
smtpd_restriction_classes =
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = no
smtpd_sasl_exceptions_networks =
smtpd_sasl_path = smtpd
smtpd_sasl_security_options = noanonymous
smtpd_sasl_tls_security_options = $smtpd_sasl_security_options
smtpd_sasl_type = cyrus
smtpd_sender_login_maps =
smtpd_sender_restrictions =
smtpd_soft_error_limit = 10
smtpd_starttls_timeout = 300s
smtpd_timeout = 300s
smtpd_tls_CAfile = /etc/certificates/mcgregor.admilon.net.476EFD153EAF1C131C9885854A44E5635D465588.chain.pem
smtpd_tls_CApath =
smtpd_tls_always_issue_session_ids = yes
smtpd_tls_ask_ccert = no
smtpd_tls_auth_only = no
smtpd_tls_ccert_verifydepth = 9
smtpd_tls_cert_file = /etc/certificates/mcgregor.admilon.net.476EFD153EAF1C131C9885854A44E5635D465588.cert.pem
smtpd_tls_dcert_file =
smtpd_tls_dh1024_param_file =
smtpd_tls_dh512_param_file =
smtpd_tls_dkey_file = $smtpd_tls_dcert_file
smtpd_tls_exclude_ciphers =
smtpd_tls_fingerprint_digest = md5
smtpd_tls_key_file = /etc/certificates/mcgregor.admilon.net.476EFD153EAF1C131C9885854A44E5635D465588.key.pem
smtpd_tls_loglevel = 0
smtpd_tls_mandatory_ciphers = medium
smtpd_tls_mandatory_exclude_ciphers =
smtpd_tls_mandatory_protocols = SSLv3, TLSv1
smtpd_tls_received_header = no
smtpd_tls_req_ccert = no
smtpd_tls_security_level = may
smtpd_tls_session_cache_database =
smtpd_tls_session_cache_timeout = 3600s
smtpd_tls_wrappermode = no
smtpd_use_pw_server = yes
stale_lock_time = 500s
stress =
strict_mailbox_ownership = yes
syslog_facility = mail
syslog_name = postfix
tls_daemon_random_bytes = 32
tls_export_cipherlist = ALL:+RC4:@STRENGTH
tls_high_cipherlist = ALL:!EXPORT:!LOW:!MEDIUM:+RC4:@STRENGTH
tls_low_cipherlist = ALL:!EXPORT:+RC4:@STRENGTH
tls_medium_cipherlist = ALL:!EXPORT:!LOW:+RC4:@STRENGTH
tls_null_cipherlist = eNULL:!aNULL
tls_random_bytes = 32
tls_random_exchange_name = ${data_directory}/prng_exch
tls_random_prng_update_period = 3600s
tls_random_reseed_period = 3600s
tls_random_source = dev:/dev/urandom
trace_service_name = trace
transport_maps =
transport_retry_time = 60s
trigger_timeout = 10s
undisclosed_recipients_header = To: undisclosed-recipients:;
unknown_address_reject_code = 450
unknown_client_reject_code = 450
unknown_hostname_reject_code = 450
unknown_local_recipient_reject_code = 550
unknown_relay_recipient_reject_code = 550
unknown_virtual_alias_reject_code = 550
unknown_virtual_mailbox_reject_code = 550
unverified_recipient_reject_code = 450
unverified_sender_reject_code = 450
use_getpwnam_ext = yes
use_od_delivery_path = no
verp_delimiter_filter = -=+
virtual_alias_domains = hash:/etc/postfix/virtual_domains
virtual_alias_expansion_limit = 1000
virtual_alias_maps = hash:/etc/postfix/virtual hash:/private/var/mailman/data/virtual-mailman
virtual_alias_recursion_limit = 1000
virtual_destination_concurrency_failed_cohort_limit = $default_destination_concurrency_failed_cohort_limit
virtual_destination_concurrency_limit = $default_destination_concurrency_limit
virtual_destination_concurrency_negative_feedback = $default_destination_concurrency_negative_feedback
virtual_destination_concurrency_positive_feedback = $default_destination_concurrency_positive_feedback
virtual_destination_rate_delay = $default_destination_rate_delay
virtual_destination_recipient_limit = $default_destination_recipient_limit
virtual_gid_maps =
virtual_initial_destination_concurrency = $initial_destination_concurrency
virtual_mailbox_base =
virtual_mailbox_domains = hash:/etc/postfix/virtual_domains_dummy
virtual_mailbox_limit = 51200000
virtual_mailbox_lock = fcntl, dotlock
virtual_mailbox_maps =
virtual_minimum_uid = 100
virtual_transport = virtual
virtual_uid_maps =

Dank und Gruss
Matthias
_______________________________________________
postfix-users mailing list
[hidden email]
http://de.postfix.org/cgi-bin/mailman/listinfo/postfix-users
Reply | Threaded
Open this post in threaded view
|

Re: [postfix-users] Spam von local - schon wieder ...

Ralf Hildebrandt
* Matthias Schmidt <[hidden email]>:

> argh .. hatte ich übersehen, sorry ...
> Das sieht also jetzt so aus:
> smtpd_delay_reject = no
> smtpd_recipient_restrictions =
> permit_sasl_authenticated
> permit_mynetworks
> permit_tls_clientcerts
> check_sender_access hash:/etc/postfix/whitelist
> check_sender_access regexp:/etc/postfix/tag_as_originating.re
> check_sender_access regexp:/etc/postfix/tag_as_foreign.re
> reject_non_fqdn_hostname
> reject_unknown_reverse_client_hostname
> reject_unauth_destination
> reject_rbl_client cbl.abuseat.org
> reject_rbl_client zen.spamhaus.org
> smtpd_sender_restrictions =
>
> (...)
>
> >>
> >> Die Mails kommen mit sasl_username=ftp hier an. Beim (Sytem-Benutzer)
> >> ftp ist Mail nicht aktiviert.

Wie nicht aktiviert? Ich sehe nichts in deiner Konfig das Mail für ftp
dekativiert.

Verstehe ich das richtig: Der User ftp sendet von deinem Rechner mail
ab?

--
Ralf Hildebrandt
  Geschäftsbereich IT | Abteilung Netzwerk
  Charité - Universitätsmedizin Berlin
  Campus Benjamin Franklin
  Hindenburgdamm 30 | D-12203 Berlin
  Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962
  [hidden email] | http://www.charite.de
           
_______________________________________________
postfix-users mailing list
[hidden email]
http://de.postfix.org/cgi-bin/mailman/listinfo/postfix-users
Reply | Threaded
Open this post in threaded view
|

Re: [postfix-users] Spam von local - schon wieder ...

Matthias Schmidt [c]

Am 18.09.2012 um 17:50 schrieb Ralf Hildebrandt:

> * Matthias Schmidt <[hidden email]>:
>
>> argh .. hatte ich übersehen, sorry ...
>> Das sieht also jetzt so aus:
>> smtpd_delay_reject = no
>> smtpd_recipient_restrictions =
>> permit_sasl_authenticated
>> permit_mynetworks
>> permit_tls_clientcerts
>> check_sender_access hash:/etc/postfix/whitelist
>> check_sender_access regexp:/etc/postfix/tag_as_originating.re
>> check_sender_access regexp:/etc/postfix/tag_as_foreign.re
>> reject_non_fqdn_hostname
>> reject_unknown_reverse_client_hostname
>> reject_unauth_destination
>> reject_rbl_client cbl.abuseat.org
>> reject_rbl_client zen.spamhaus.org
>> smtpd_sender_restrictions =
>>
>> (...)
>>
>>>>
>>>> Die Mails kommen mit sasl_username=ftp hier an. Beim (Sytem-Benutzer)
>>>> ftp ist Mail nicht aktiviert.
>
> Wie nicht aktiviert? Ich sehe nichts in deiner Konfig das Mail für ftp
> dekativiert.

in der OpenDirectory Datenbank von MacOS gibt's freilich nen Benutzer ftp, bei dem ist Mail nicht aktiviert.
Muss ich das nochmal extra machen?
Es sollen eigentlich nur Benutzer mails schicken können, die in der Datenbank aktiviert sind.
Das hat bis vor kurzem auch funktioniert.
Nur scheint der Spammer hier irgendeinen "uncoolen" Trick drauf zu haben, dass zu umgehen.

>
> Verstehe ich das richtig: Der User ftp sendet von deinem Rechner mail
> ab?

er loggt sich als ftp ein und braucht über diesen Weg kein Passwort.
Ich hab den Zugriff jetzt komplett deaktiviert.

Sep 17 22:22:27 mcgregor postfix/smtpd[20572]: connect from unknown[49.236.198.230]
Sep 17 22:22:28 mcgregor postfix/smtpd[20572]: NOQUEUE: filter: RCPT from unknown[49.236.198.230]: <[hidden email]>: Sender address triggers FILTER smtp-amavis:[127.0.0.1]:10026; from=<[hidden email]> to=<[hidden email]> proto=ESMTP helo=<[10.10.10.51]>
Sep 17 22:22:28 mcgregor postfix/smtpd[20572]: 69DAE1DBA544: client=unknown[49.236.198.230], sasl_method=CRAM-MD5, sasl_username=ftp

Gruss
Matthias
_______________________________________________
postfix-users mailing list
[hidden email]
http://de.postfix.org/cgi-bin/mailman/listinfo/postfix-users
Reply | Threaded
Open this post in threaded view
|

Re: [postfix-users] Spam von local - schon wieder ...

Ralf Hildebrandt
* Matthias Schmidt <[hidden email]>:

> > Wie nicht aktiviert? Ich sehe nichts in deiner Konfig das Mail für ftp
> > dekativiert.
>
> in der OpenDirectory Datenbank von MacOS gibt's freilich nen Benutzer ftp, bei dem ist Mail nicht aktiviert.
> Muss ich das nochmal extra machen?

> Es sollen eigentlich nur Benutzer mails schicken können, die in der Datenbank aktiviert sind.
> Das hat bis vor kurzem auch funktioniert.
> Nur scheint der Spammer hier irgendeinen "uncoolen" Trick drauf zu haben, dass zu umgehen.

Sieht wohl so aus ob der sich authorisiert und dann Mail verschickt.
Einfach mal das Passwort des Users ftp ändern.

> er loggt sich als ftp ein und braucht über diesen Weg kein Passwort.
> Ich hab den Zugriff jetzt komplett deaktiviert.
>

OK.

--
Ralf Hildebrandt
  Geschäftsbereich IT | Abteilung Netzwerk
  Charité - Universitätsmedizin Berlin
  Campus Benjamin Franklin
  Hindenburgdamm 30 | D-12203 Berlin
  Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962
  [hidden email] | http://www.charite.de
           
_______________________________________________
postfix-users mailing list
[hidden email]
http://de.postfix.org/cgi-bin/mailman/listinfo/postfix-users