Hi, Here is a log :
Oct 13 19:41:28 mail postfix/qmgr[15506]: 8F189379357: removed Oct 13 19:41:28 mail postfix/smtps/smtpd[25100]: warning: hostname server-185-153-197-48.cloudedic.net does not resolve to address 185.153.197.48 Oct 13 19:41:28 mail postfix/smtps/smtpd[25100]: connect from unknown[185.153.197.48] Oct 13 19:41:28 mail postfix/smtps/smtpd[25100]: Anonymous TLS connection established from unknown[185.153.197.48]: TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits) Oct 13 19:41:29 mail postfix/smtps/smtpd[25100]: 5A064379357: client=unknown[185.153.197.48], sasl_method=LOGIN, sasl_username= [email protected] Oct 13 19:41:32 mail postfix/cleanup[25103]: 5A064379357: message-id=<> Oct 13 19:41:32 mail postfix/qmgr[15506]: 5A064379357: from=< [email protected]>, size=727, nrcpt=50 (queue active) Oct 13 19:41:32 mail postfix/smtps/smtpd[25100]: disconnect from unknown[185.153.197.48] Oct 13 19:41:33 mail postfix/smtpd[25140]: connect from unknown[127.0.0.1] Oct 13 19:41:33 mail postfix/smtpd[25140]: 215EB37B4A0: client=unknown[127.0.0.1] Oct 13 19:41:33 mail postfix/cleanup[25103]: 215EB37B4A0: message-id=< [email protected]> Oct 13 19:41:33 mail postfix/smtpd[25140]: disconnect from unknown[127.0.0.1] Oct 13 19:41:33 mail postfix/qmgr[15506]: 215EB37B4A0: from=< [email protected]>, size=1151, nrcpt=50 (queue active) Oct 13 19:41:33 mail amavis[10290]: (10290-20) Passed SPAM {RelayedOpenRelay,Quarantined}, [185.153.197.48]:58902 [185.153.197.48] < [email protected]> -> <[email protected]>,<[email protected]>,< [email protected]>,<[email protected]>,<[email protected]>,< [email protected]>,<[email protected]>,<[email protected]>,< [email protected]>,<[email protected]>,<[email protected]>,< [email protected]>,<[email protected]>,<[email protected]>,< [email protected]>,<[email protected]>,<[email protected]>,< [email protected]>,<[email protected]>,<[email protected]>,< [email protected]>,<[email protected]>,<[email protected]>,< [email protected]>,<[email protected]>,<[email protected]>,< [email protected]>,<[email protected]>,<[email protected]>,< [email protected]>,<[email protected]>,<[email protected]>,< [email protected]>,<[email protected]>,<frankbot184... Oct 13 19:41:33 mail amavis[10290]: (10290-20) [email protected]>,< [email protected]>,<[email protected]>,<[email protected]>,< [email protected]>,<[email protected]>,<[email protected]>,< [email protected]>,<[email protected]>,<[email protected]>,< [email protected]>,<[email protected]>,<[email protected]>,< [email protected]>,<[email protected]>,<[email protected]>, Queue-ID: 5A064379357, mail_id: 1Gke7LvbPH2x, Hits: 22.384, size: 727, queued_as: 215EB37B4A0, 695 ms Yes, I did put cyrus in my sender_access : #cat sender_access cyrus REJECT [email protected] REJECT Michaux Julien Courriel : [email protected] Le mar. 15 oct. 2019 à 15:30, Allen Coates <[email protected]> a écrit : > > > On 15/10/2019 08:27, Julien Michaux wrote: > > Time to time, my server is attack and he sends spam. All spam are from a > > specific address "[email protected]" I tried many things but nothing > works> I have to stop postfix for some hours and attack ends until next > time. > > > > Have you tried putting "[email protected] reject" into your > sender_access file? > > It is a crude quick-fix, and would also put a marker in your log-file. > > hope this helps > > allen C >
