Re: Spammer succeeded in relaying through my server

[Samer Afach]

Dear Peter: Thank you. In fact, it's a coincidence I have it enabled like this because back then, I had finished the configuration and left it like this for some time. Unfortunately, I can't change it now because the happen happened, and now I can't turn my email server back on unless I figure out the cause, or at least I reliably have an explanation that I can test against. Here's the output of postconf -Mf: ``` submission inet  n       -       n       -       -       smtpd     -o smtpd_tls_security_level=encrypt     -o smtpd_enforce_tls=yes     -o smtpd_sasl_auth_enable=yes     -o smtpd_client_restrictions=permit_mynetworks,permit_sasl_authenticated,reject smtp       inet  n       -       n       -       -       smtpd     -o content_filter=spamassassin smtps      inet  n       -       n       -       -       smtpd     -o smtpd_tls_wrappermode=yes pickup     fifo  n       -       n       60      1       pickup cleanup    unix  n       -       n       -       0       cleanup qmgr       fifo  n       -       n       300     1       qmgr tlsmgr     unix  -       -       n       1000?   1       tlsmgr rewrite    unix  -       -       n       -       -       trivial-rewrite bounce     unix  -       -       n       -       0       bounce defer      unix  -       -       n       -       0       bounce trace      unix  -       -       n       -       0       bounce verify     unix  -       -       n       -       1       verify flush      unix  n       -       n       1000?   0       flush proxymap   unix  -       -       n       -       -       proxymap proxywrite unix  -       -       n       -       1       proxymap smtp       unix  -       -       n       -       -       smtp relay      unix  -       -       n       -       -       smtp showq      unix  n       -       n       -       -       showq error      unix  -       -       n       -       -       error retry      unix  -       -       n       -       -       error discard    unix  -       -       n       -       -       discard local      unix  -       n       n       -       -       local virtual    unix  -       n       n       -       -       virtual lmtp       unix  -       -       n       -       -       lmtp anvil      unix  -       -       n       -       1       anvil postlog    unix-dgram n  -       n       -       1       postlogd scache     unix  -       -       n       -       1       scache maildrop   unix  -       n       n       -       -       pipe flags=DRhu     user=vmail argv=/usr/bin/maildrop -d ${recipient} uucp       unix  -       n       n       -       -       pipe flags=Fqhu     user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient) ifmail     unix  -       n       n       -       -       pipe flags=F user=ftn     argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient) bsmtp      unix  -       n       n       -       -       pipe flags=Fq.     user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient scalemail-backend unix - n       n       -       2       pipe flags=R     user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop}     ${user} ${extension} mailman    unix  -       n       n       -       -       pipe flags=FR     user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py ${nexthop}     ${user} spamassassin unix -      n       n       -       -       pipe flags=R     user=debian-spamd argv=/usr/bin/spamc -e /usr/sbin/sendmail -oi -f     ${sender} ${recipient} ``` Best regards, Sam On 21/12/2022 11:52 AM, Peter wrote: On 21/12/22 20:35, Samer Afach wrote: Dear Pat: Thank you for throwing this idea, because I really thought it wasn't possible to retrieve docker logs without setup, but I dug and found the logs. I have them all. Unfortunately, I can't share them all because they're like GBs in size. Just the grep on that email address is like 750 MB in size. I cut a snippet of the relevant part (where I see the spam address), and put it in pastebin. I hope that's allowed in the rules of the list. https://pastebin.com/PEir7mDc You have verbose logging enabled.  This makes it much more difficult to troubleshoot because the relevant info is lost in all the noise created by the additional logs.  It will be way easier if you can generate some logs without verbose enabled. Also you've shared your postconf -n output, can you also please share postconf -Mf Peter