[Debian/Postfix] Serveur sert de relaie au SPAM

[samad]

Bonjour,

J'ai un petit soucis avec mon serveur dedié.

Cet aprèm je vois une activité inhabituelle de mon serveur mail postfix, je m'explique j'ai reçu une centaine de messages de failure-message qui concernent tous des mails de spamm et le mail emetteur est l'un des mails que j'heberge sur mon serveur. En regardant de plus prés les logs, je vois que mon serveur rejette quand il connait pas le serveur ce qui est normal :

Apr 19 20:59:46 ks2300 postfix/smtpd[14156]: connect from unknown[209.159.32.210]
Apr 19 20:59:46 ks2300 postfix/smtpd[14156]: NOQUEUE: reject: RCPT from unknown[209.159.32.210]: 450 4.7.1 Client host rejected: cannot find your hostname, [209.159.32.210]; from=<> to=<webmaster@XXXXXXXX.com> proto=ESMTP helo=<mail.vitalinspection.com>
Apr 19 20:59:46 ks2300 postfix/smtpd[14156]: disconnect from unknown[209.159.32.210]

Mais je continue à recevoir des mails comme quoi mon serveur envoie des messages de spamm et les failures.

Comment s'assurer que les bots spammeurs passent bien par mon serveur ?

Quelques infos sur mon serveur :
J'ai désactivé le serveur apache pour s'assurer que ce n'est pas une faille dans un script php, Je continue à recevoir les messages.

voici ma config :
Distrib. Debian.
Serveur mail Postfix

Config du postfix :
main.cf

smtp_banner = $myhostname ESMTP (Debian / GNU)
biff = no
disable_vrfy_command = yes
smtpd_helo_required = yes

append_dot_mydomain = no

mydestination = XXXXXXXXXXX, localhost, localhost.localdomain

mydomain = XXXXXXXXXXXXX

myhostname = XXXXXXXXXXXXXX

relayhost =
mynetworks = 127.0.0.0/8 213.186.42.70
inet_interfaces = all

smtpd_sender_restrictions =
        permit_mynetworks,
        reject_unknown_sender_domain,
        warn_if_reject reject_unverified_sender

smtpd_recipient_restrictions =
        permit_mynetworks,
        reject_unauth_destination,
        reject_unknown_recipient_domain,
        reject_non_fqdn_recipient

smtpd_client_restrictions =
        reject_unknown_client,
        permit_mynetworks

virtual_alias_maps = mysql:/etc/postfix/mysql-virtual_aliases.cf, mysql:/etc/postfix/mysql-virtual_aliases_mailbox.cf
virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual_domains.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual_mailboxes.cf
virtual_mailbox_base = /var/spool/vmail/
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000

virtual_create_maildirsize = yes
virtual_mailbox_extended = yes
virtual_mailbox_limit_maps = mysql:/etc/postfix/mysql-virtual_mailbox_limit_maps.cf
irtual_mailbox_limit_override = yes
virtual_maildir_limit_message = "Desole, la boite email de l'utilisateur est pleine. Veuillez re-essayer plus tard !"
virtual_overquota_bounce = yes

master.cf

#
# Postfix master process configuration file.  For details on the format
# of the file, see the master(5) manual page (command: "man 5 master").
#
# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (yes)   (never) (100)
# ==========================================================================
smtp      inet  n       -       -       -       -       smtpd
#submission inet n       -       -       -       -       smtpd
#  -o smtpd_enforce_tls=yes
#  -o smtpd_sasl_auth_enable=yes
#  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
#smtps     inet  n       -       -       -       -       smtpd
#  -o smtpd_tls_wrappermode=yes
#  -o smtpd_sasl_auth_enable=yes
#  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
#628      inet  n       -       -       -       -       qmqpd
pickup    fifo  n       -       -       60      1       pickup
cleanup   unix  n       -       -       -       0       cleanup
qmgr      fifo  n       -       n       300     1       qmgr
#qmgr     fifo  n       -       -       300     1       oqmgr
tlsmgr    unix  -       -       -       1000?   1       tlsmgr
rewrite   unix  -       -       -       -       -       trivial-rewrite
bounce    unix  -       -       -       -       0       bounce
defer     unix  -       -       -       -       0       bounce
trace     unix  -       -       -       -       0       bounce
verify    unix  -       -       -       -       1       verify
flush     unix  n       -       -       1000?   0       flush
proxymap  unix  -       -       n       -       -       proxymap
smtp      unix  -       -       -       -       -       smtp
# When relaying mail as backup MX, disable fallback_relay to avoid MX loops
relay     unix  -       -       -       -       -       smtp
        -o fallback_relay=
#       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq     unix  n       -       -       -       -       showq
error     unix  -       -       -       -       -       error
discard   unix  -       -       -       -       -       discard
local     unix  -       n       n       -       -       local
virtual   unix  -       n       n       -       -       virtual
lmtp      unix  -       -       -       -       -       lmtp
anvil     unix  -       -       -       -       1       anvil
scache    unix  -       -       -       -       1       scache
#
# ====================================================================
# Interfaces to non-Postfix software. Be sure to examine the manual
# pages of the non-Postfix software to find out what options it wants.
#
# Many of the following services use the Postfix pipe(8) delivery
# agent.  See the pipe(8) man page for information about ${recipient}
# and other message envelope options.
# ====================================================================
#
# maildrop. See the Postfix MAILDROP_README file for details.
# Also specify in main.cf: maildrop_destination_recipient_limit=1
#
maildrop  unix  -       n       n       -       -       pipe
  flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
# 
# See the Postfix UUCP_README file for configuration details.
#
uucp      unix  -       n       n       -       -       pipe
  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
#
# Other external delivery methods.
#
ifmail    unix  -       n       n       -       -       pipe
  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp     unix  -       n       n       -       -       pipe
  flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
scalemail-backend unix  -       n       n       -       2       pipe
  flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
mailman   unix  -       n       n       -       -       pipe
  flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
  ${nexthop} ${user}

D'où ca peut venir ??

[samad]

Petite précision :
Je viens de recevoir un nouveau mail de failur :

A message from <XXXXXXXXXXXXXXXXX> to:
-> pmhaa@bch.hu

was considered unsolicited bulk e-mail (UBE).

Our internal reference code for your message is 00689-10/uGJZwuTWijJj

The message carried your return address, so it was either a genuine mail
from you, or a sender address was faked and your e-mail address abused
by third party, in which case we apologize for undesired notification.

We do try to minimize backscatter for more prominent cases of UBE and
for infected mail, but for less obvious cases of UBE some balance
between losing genuine mail and sending undesired backscatter is sought,
and there can be some collateral damage on both sides.

According to a 'Received:' trace, the message originated at: [85.112.51.183],
 [85.112.51.183]  (port=55805 helo=85.112.51.183)

Return-Path: <XXXXXXXXXXXXXX>
Message-ID: <000901c8a252$0167a4dd$d1662d86@jvvhil>
Subject: =?koi8-r?B?88vP0s/T1NggySDLwd7F09TXzyDEz9PUwdfLyQ==?=

Delivery of the email was stopped!

Final-Recipient: rfc822;pmhaa@bch.hu
Action: failed
Status: 5.7.1
Diagnostic-Code: smtp; 554 5.7.1 Rejected, id=00689-10 - SPAM
Last-Attempt-Date: Sat, 19 Apr 2008 21:24:54 +0200 (CEST)

En regardant le texte en gras, l'adresse IP indiqué n'est pas celle de mon serveur, ca veut dire qu'ils utilisent mon adresse XXXXXXXXX juste pour le champs Reply-to etc et passe pas vraiment par mon serveur.

Comment peut-on en être sur ?

[sircus]

C'est bien toi qui vient de kimsufi ou c'est ceux que tu cherches ?

[mrtonio]

http://www.postfix.org/BACKSCATTER_README.html

[samad]

Envoyé par sircus

C'est bien toi qui vient de kimsufi ou c'est ceux que tu cherches ?

non c'est bien moi