mail problem, spam outgoing :(

[maur]

I have two questions..

1. I can do:
m:~/$ telnet myhost.ltd 25
Trying 78.46.x.x...
Connected to myhost.
Escape character is '^]'.
220 myhost.ltd ESMTP ispCP 1.0.5 OMEGA Managed
ehlo myhost.ltd
250-myhost.ltd
250-PIPELINING
250-SIZE
250-VRFY
250-ETRN
250-STARTTLS
250-AUTH PLAIN LOGIN CRAM-MD5 NTLM DIGEST-MD5
250-AUTH=PLAIN LOGIN CRAM-MD5 NTLM DIGEST-MD5
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
mail from: <webmaster@myhost.ltd>
250 2.1.0 Ok
rcpt to: <webmaster@myhost.ltd>
250 2.1.5 Ok
data
354 End data with <CR><LF>.<CR><LF>
From: web <webmaster@myhost.ltd>
To: pc <my-email@on-another-box>
Subject: noway

Foo.

.
250 2.0.0 Ok: queued as 230E328E250
^C^]
telnet> Connection closed.

Why it's queued? Shoudn't ask for password?


2 question:

legend/actors:
myhost - my vps host with ispcp
admin.myhost.ltd - FQDN of myhost
some-domain-on-host.ltd - domain which are sending spam.


Aug 25 08:24:52 myhost postfix/cleanup[23113]: BA81E28E273: message-id=<20100825062452.BA81E28E273@admin.myhost.ltd>
Aug 25 08:24:52 myhost postfix/qmgr[5581]: BA81E28E273: from=<webmaster@some-domain-on-host.ltd>, size=2541, nrcpt=1 (queue active)
Aug 25 08:24:52 myhost postfix/pickup[23029]: C799428E274: uid=2036 from=<webmaster@some-domain-on-host.ltd>
Aug 25 08:24:52 myhost postfix/cleanup[23164]: C799428E274: message-id=<20100825062452.C799428E274@admin.myhost.ltd>
Aug 25 08:24:52 myhost postfix/qmgr[5581]: C799428E274: from=<webmaster@some-domain-on-host.ltd>, size=2538, nrcpt=1 (queue active)
Aug 25 08:24:52 myhost postfix/pickup[23029]: D3CE328E271: uid=2036 from=<webmaster@some-domain-on-host.ltd>
Aug 25 08:24:52 myhost postfix/cleanup[23113]: D3CE328E271: message-id=<20100825062452.D3CE328E271@admin.myhost.ltd>
Aug 25 08:24:52 myhost postfix/qmgr[5581]: D3CE328E271: from=<webmaster@some-domain-on-host.ltd>, size=2533, nrcpt=1 (queue active)
Aug 25 08:24:52 myhost postfix/smtp[23225]: C799428E274: to=<denipc@denipc.com.br>, relay=none, delay=0.07, delays=0.05/0.01/0.01/0, dsn=5.4.4, status=bounced (Host or domain name not found. Name service error for name=denipc.com.br type=A: Host not found)
Aug 25 08:24:52 myhost postfix/cleanup[23164]: DCEB428E277: message-id=<20100825062452.DCEB428E277@admin.myhost.ltd>
Aug 25 08:24:52 myhost postfix/bounce[23159]: C799428E274: sender non-delivery notification: DCEB428E277
Aug 25 08:24:52 myhost postfix/qmgr[5581]: DCEB428E277: from=<>, size=4403, nrcpt=1 (queue active)
Aug 25 08:24:52 myhost postfix/pickup[23029]: E2CCF28E278: uid=2036 from=<webmaster@some-domain-on-host.ltd>

So, let's check one of them, for example last one:
Aug 25 08:24:52 myhost postfix/pickup[23029]: E2CCF28E278: uid=2036 from=<webmaster@some-domain-on-host.ltd>
Aug 25 08:24:52 myhost postfix/cleanup[23113]: E2CCF28E278: message-id=<20100825062452.E2CCF28E278@admin.myhost.ltd>
Aug 25 08:24:52 myhost postfix/qmgr[5581]: E2CCF28E278: from=<webmaster@some-domain-on-host.ltd>, size=2542, nrcpt=1 (queue active)
Aug 25 08:24:55 myhost postfix/smtp[23231]: E2CCF28E278: to=<dchavesalmeida@oi.com.br>, relay=mx.oi.com.br[200.222.115.71]:25, delay=2.8, delays=0.07/0.01/1.7/1, dsn=4.7.1, status=deferred (host mx.oi.com.br[200.222.115.71] said: 450 4.7.1 <dchavesalmeida@oi.com.br>: Recipient address rejected: Temporary failure (in reply to RCPT TO command))
Aug 25 08:33:03 myhost postfix/qmgr[5581]: E2CCF28E278: from=<webmaster@some-domain-on-host.ltd>, size=2542, nrcpt=1 (queue active)
Aug 25 08:33:06 myhost postfix/smtp[27786]: E2CCF28E278: to=<dchavesalmeida@oi.com.br>, relay=mx.oi.com.br[200.222.115.71]:25, delay=493, delays=490/0.03/0.67/2.3, dsn=5.1.1, status=bounced (host mx.oi.com.br[200.222.115.71] said: 550 5.1.1 <dchavesalmeida@oi.com.br>: Recipient address rejected: User unknown (in reply to RCPT TO command))
Aug 25 08:33:06 myhost postfix/bounce[3417]: E2CCF28E278: sender non-delivery notification: 8A20F28E2AB
Aug 25 08:33:06 myhost postfix/qmgr[5581]: E2CCF28E278: removed

many thanks for help.

[kilburn]

maur Wrote:Why it's queued? Shoudn't ask for password?

No. Deliveries directed to local (virtual) domains don't need any password to succeed, or you wouldn't be able to receive mails. Think about it: when someone sends a mail to your domain, their server contacts yours and tries to deliver it. If this delivery was password-protected, then the mail servers of other people wouldn't be able to deliver mails to your domain because they don't have any kind of password to use.

Another issue are deliveries to external domains. These should only be accepted when comming from identified users, because otherwise anyone could use your server to send mails anywhere. Hence, if you repeat the procedure but with an external e-mail, your attempt will be correctly refused because you are not an authenticated user.

maur Wrote:2 question:

legend/actors:
myhost - my vps host with ispcp
admin.myhost.ltd - FQDN of myhost Wink
some-domain-on-host.ltd - domain which are sending spam.
...

I can't find any actual question in here. Nevertheless, the "domain sending spam" is generating the e-mails from inside the server through the "sendmail" command (probably from apache). Hence, there's no authentication going on over them. If you want to enforce people to authenticate, you must disable the sendmail utility and force users to deliver mail through smtp (even from the websites).