Hi guys!

I am new to web hosting. I am running not so big hosting and do not have much customers. One of our customers have complied to me, that registration mails from his website goes to spam. I searched my IP and found it blacklisted in two databases.

I started to analyze logs, and noticed that from 25th of April something started to happen. Tons of mails are sent, but I do not have such many customers. My mail server is in .lv zone and I have customers witth .lv domains, but mostly some .es mail addresses are there in maillog.

Maillog is full of this kind of records:

and more:
I have tested my server for OPEN Relay on some site and got the answer:
>Unable to relay: Invalid response code received from server
> This server is NOT Open Relay


More info about my system:

CentOS 5.2
[root@s2 ~]# uname -r
2.6.18-92.1.22.el5
[root@s2 ~]# ps auxf

set-up your servers with some form of authentication for users to send email most likely if you do not get your users to login or authenticate then your server is open to relay. While your at it might as well implement encryption for email transfer at same time.

Do you need to have postfix listening on port 25 for SMTP connections from anywhere on the internet? because it looks like it is.

If you do need this, as namit says, have a look at setting up authentication:

http://www.google.com/search?hl=en&q=postfix+smtp+auth

You might also want to think about using a different port number rather than the standard 25 for SMTP (this is not much protection, but makes you a slightly less easy target).

Can you show

postconf -n

Thanks guys for so quick replies - I really appreciate your help!
Unfortunately I cannot provide postconf -n now, I will do it today later. But I can provide now my main.cf:

I have AUTH enabled. All my customers have own username and password for authentication on SMTP server. May be one of accounts is hacked? How do I check it?

Don't worry about postconf -n then, main.cf is OK. Doesn't look like an open relay.

I think you will need to trawl through the logs and work out what connection is sending those mails. I think your guess of a hacked customer is probably correct.

Is this correct that someone is using one of my customers username and password to send spam through my mail server? I did trawl through logs, but I can not understand, how to work out, what connection is sending those mails. Is there should be login attempts to SMTP?

I had this problem last year with a non-profit client. One of their 'volunteers' had answered a nigerian spam - their password was their first name and the nigerian took over thier email account and started sending spam off of our mail servers, which got our entire cluster blacklisted for a day.

I actually found out which email account was sending the offending spam from the blacklist provider themselves. The various ISP's (Verizon, Earthlink, etc) were all very helpful in helping us nail down the spammer as well, so don't be afraid to ask them for help on which account is sending the spam.

It took about 24 hours to resolve the issue and get removed from the blacklists, so keep at it and don't be afraid to ask the ISP or the blacklist moderator for info on the spam. They will gladly help you stem the tide of spam.

Thanks! I will do so!

If they are authenticating, the authentication is surely being recorded in the appropriate log, whichever that may be, and if it's spam, there will be plenty of them.

Try

grep auth /var/log/*

or similar to determine what and where.