1

Server: OpenBSD 6.6 GENERIC#3

I'm recently working on an OpenBSD mailserver, it daily gets hits to not existing accounts,

May 31 16:00:23 Makmx01 smtpd[57197]: 05844daf9b176227 smtp failed-command command="RCPT TO:<[email protected]>" result="524 5.2.4 Mailing list expansion problem: <[email protected]>"
May 31 16:00:23 Makmx01 smtpd[57197]: 05844daf9b176227 smtp failed-command command="RCPT TO:<[email protected]>" result="524 5.2.4 Mailing list expansion problem: <[email protected]>"

====================

I have replaced our original domain name with cat.domain.nz" in the above snippet from server.

The accounts [email protected], [email protected] etc etc doesn't exist, so when we receive these hits to the mail server there are 500's of logs like this with all different non existing users. Also in this mail server there are few different domains configured and we are getting hits like this to all of the domains.

Can someone explain how to identify where this is coming from and how to block this ? is this normal ? Do we need to implement anything to prevent this happening ?

2 Answers 2

1

Based on the current information we have, this may involve load of steps. So let's start with a few first:

Add -v parameter to make syslog more verbose for smtpd (see here):

/etc/postfix/master.cf:

smtp      inet  n       -       n       -       -       smtpd -v       

# postfix reload

At this point you should see more information about what is happening.

Optional:
If you want to see the whole packet flow and the content within, then run packet capture (see here).

tcpdump -w /file/name -s 0 host example.com and port 25  

Stop with Ctrl-C when it's done.

Once you done it, you should check the source IP and domain address of the packets in question to see where are those coming from and check against well known blacklisted spam addresses here: https://mxtoolbox.com/blacklists.aspx

Although you haven't mentioned whether you implemented anti spam mechanism or not, but If you haven't, but planning to, then here are some resources that might help you:

  1. https://www.linuxbabe.com/mail-server/block-email-spam-postfix
  2. https://mailmum.io/posts/blacklisting-single-hosts-ip-addresses-and-even-networks-in-postfix/
  3. https://mailmum.io/posts/whitelisting-hosts-ip-addresses-and-even-networks-in-postfix/

The desired mechanism should be based on your business needs eg.: if you receive e-mails from only known domains and/or from general e-mail providers (gmail, yahoo etc.), then you should whitelist only those and nothing else.
You can also use dynamic blacklisting mentioned here on linuxbabe.com site.

I suggest this to be done out of business hours if your business is sensitive to downtime, especially when it comes to those steps that involve postfix to be reload.

0

That is somewhat expected, for a publicly available mail domain. You can try to block a specific address or network, as @david_beszeda suggests, but not only it is likely that this is coming from several hosts, but it will surely happen multiple times, from different sources, over time. Therefore, I strongly advise you to setup some filtering mechanism, such as spamd, Rspamd, SpamAssassin, or Amavis. spamd is part of OpenBSD's base system, and the three others are available as packages.

spamd is pretty easy to setup, needing little more than adding a couple of lines to pf.conf. Check its man page for details, or check Peter Hansteen's blog for further details. It uses greylisting, purposely delaying and/or failing initial deliveries from unknown MTAs, forcing them to resend the messages, assuming that spammers won't bother to. Legit MTAs (those who retry) will be whitelisted. "Manual" whitelists, both private and public, can also be used, so that well known legit MTAs don't get tarpitted. Be aware that in some cases this means that there will be some delays in receiving mail. It will get better over time, as the legit MTAs get whitelisted, but expect it to happen a few times.

Rspamd is more complete, and uses greylisting along with a number of other mechanisms (full disclosure: this is what I use on my mail servers). It is immensely configurable, but most default settings are good enough. This blog post by the author of OpenSMTPd might help you with configuring it. It was written for OpenSMTPd, not Postfix, but the principle is the same, it is merely used as a filter. I haven't searched, but I'm sure setting up Rspamd with Postfix is well documented somewhere.

I have used Amavis in the past, with SpamAssassin alongside it, which also does some virus scanning, quarantining, etc, but I found it overkill for my needs, and harder to maintain than Rspamd. I don't discourage its usage, it just wasn't the best fit for my case.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .