LinuxQuestions.org - how to block spammer using my mailserver

I am assuming here that the log entries shown are all spam mail originating from your server and the username daniel is not a valid user. I also did a whois of 199.71.214.214 and got an organization in Utah named premierdebtalliance.com. If you try to go to their site, you get some varient of a domain not found that tries to search for the keyword alliance (e.g. gives links to Alliance, Ohio).

My initial guess is that you have something improperly configured in your SASL setup. Postfix supports Dovecot and Cyrus for SASL authentication, which are you using? The part that tells me that something is wrong is this: sasl_method=LOGIN, sasl_username=daniel as this doesn't look like a proper sasl authentication. For example, here are a couple of logins from my server:

Code:

Apr 16 05:02:06 server dovecot: imap-login: Login: user=<me@my.domain>, method=PLAIN, rip=a.b.c.d, lip=192.168.x.x, TLS

Apr 12 10:52:10 server dovecot: pop3-login: Login: user=<other@other.virtual.domain>, method=PLAIN, rip=a.b.c.d, lip=192.168.x.x, TLS

In each case, notice that Dovecot is being used as the authentication service, but this (or the corresponding Cyrus information) is lacking in your logs.

I thought that this link had a pretty good discussion of this subject, note that the method=LOGIN being implicated in a setup problem allowing a spammer to relay: http://www.zimbra.com/forums/adminis...ing-issue.html

To correct this first make sure that you have configured Postfix for the proper SASL authentication:
In all cases and if your using Cyrus see this: http://www.postfix.org/SASL_README.html
If you are using Dovecot1.x see this: http://wiki.dovecot.org/HowTo/PostfixAndDovecotSASL
If you are using Dovecot2.x see this: http://wiki2.dovecot.org/HowTo/PostfixAndDovecotSASL

Note that you need to tell Postfix in main.cf what you are using for authentication. You also need to setup the backend authentication database in whichever method you are using.

Second, make sure you have the permissions set correctly in main.cf for your smtpd_recipient_restrictions.
For example (the one in bold preventing you from being an open relay, but I don't think this is your problem, but See: http://www.postfix.org/postconf.5.ht..._destination):

Code:

smtpd_recipient_restrictions =

  reject_rbl_client zen.spamhaus.org

  reject_rbl_client bl.spamcop.net

  permit_mynetworks

  check_policy_service inet:127.0.0.1:60000

  permit_sasl_authenticated

  permit_mx_backup

  reject_unauth_destination

  reject_unknown_recipient_domain

  permit