[Solved] [Postfix] SASL authentication with bogus username

[mariourk]

Today I recieved an abuse notice from my ISP. Apparently, spam was send from my IP-address. I asked for some extra info and started digging through the logfiles. And to my astonishment, someone was connection to my mailserver, authenticating with a bogus username agains SASL and sending emails through my server.

How is this even possible?

Here is a snippet from the logs

[mariourk]

I figured it out, I hope. this thread explained what was going on. After checking again, it turned out the user fax did in fact exist. Somehow I missed that. I think the account didn't have a password, thus allowing easy acces. Since I didn't use it anymore, I deleted it.

Anyway, a lesson learned. In a few weeks we get a new mailserver. I already decided I was going to use virtual users this time. This experience only confirmed that is probably the best way to deal with email-accounts.
_________________
If there is one thing to learn from history, it's that we usualy don't learn anything from it, at all.

[eccerr0r]

I fear this greatly... Glad you got this worked out.

Linux is not necessarily secure by default, simple mistakes can wreak havoc.

Personally I finally got mail forwarding working, it was very annoying an still not exactly the way I want it to work but think it's acceptable and hacks everywhere. I'm using sendmail. For default SMTP connections to or from my local network will get forwarded. But if the user connects via SSL and authenticates by SASL then you can relay, which is very similar. I still worry about holes, the only way I can tell if a hole was made is monitoring the logfiles... Ugh.

I suspect most people use different servers for relaying and mail reception, but I was short on IP addresses.

Just feels a little safer when I see a lot of "Relaying Denied" in my logfiles.
_________________
Intel Core i7 2700K/Radeon R7 250/24GB DDR3/256GB SSD
What am I supposed watching?