Postfix protection against authenticated spam bots

TiNik · 12-02-2014, 04:13 AM

I run postfix as a mail server and once upon a time one of email accounts is "hacked" and spam bots can login through that account and send spams.

Permit_sasl_authenticated is the second rule of recipient restriction, so after SASL authentication the user is allowed to send mails everywhere.

Code:

smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, ....

Is there some way how to stop the bot from sending mails or at least limit it till I ask the mail owner to change his password ??

linosaurusroot · 12-02-2014, 01:04 PM

Spammers typically send to a lot of broken addresses - meaning they can be detected by the large number of bounces and delayed mails than are seen with normal users (aside from the volume which might be legitimately high for a mailing list).

I don't know the best way to act on that but a log reader that cancelled the authentication of the sender doesn't sound hard in principle.

Habitual · 12-02-2014, 01:34 PM

If it were me, I'd change that compromised mail account password in a heartbeat.
I wouldn't want my mail server to get blacklisted.