我最近在我的 postfix-log 中发现了这一点：
Aug 4 11:09:12 mail postfix/smtpd[71597]: connect from unknown[59.88.35.206]
Aug 4 11:09:14 mail postfix/smtpd[71597]: Anonymous TLS connection established from unknown[59.88.35.206]: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
Aug 4 11:09:17 mail postfix/smtpd[71597]: 1AE3B7EC3D: client=unknown[59.88.35.206], sasl_method=PLAIN, [email protected]
Aug 4 11:09:30 mail postfix/cleanup[71606]: 1AE3B7EC3D: message-id=<[email protected]>
Aug 4 11:09:30 mail opendkim[24666]: 1AE3B7EC3D: DKIM-Signature field added (s=mail, d=MYDOMAINCOM2012)
Aug 4 11:09:30 mail postfix/qmgr[27543]: 1AE3B7EC3D: from=<[email protected]>, size=2149, nrcpt=20 (queue active)
Aug 4 11:09:31 mail postfix/smtpd[71611]: connect from MAIL.example.com[172.16.0.3]
Aug 4 11:09:31 mail postfix/smtpd[71611]: 14C4C7EC57: client=MAIL.example.com[172.16.0.3]
Aug 4 11:09:31 mail postfix/cleanup[71606]: 14C4C7EC57: message-id=<[email protected]>
Aug 4 11:09:31 mail postfix/smtpd[71611]: disconnect from MAIL.example.com[172.16.0.3]
Aug 4 11:09:31 mail postfix/qmgr[27543]: 14C4C7EC57: from=<[email protected]>, size=2891, nrcpt=20 (queue active)
Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug 4 11:09:31 mail postfix/lmtp[71609]: 1AE3B7EC3D: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=15, delays=14/0.06/0.03/0.47, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as 14C4C7EC57)
Aug 4 11:09:31 mail postfix/qmgr[27543]: 1AE3B7EC3D: removed
Aug 4 11:09:31 mail postfix/smtpd[71597]: 968227EC58: client=unknown[59.88.35.206], sasl_method=PLAIN, [email protected]
Aug 4 11:09:31 mail postfix/smtp[71612]: 14C4C7EC57: to=<[email protected]>, relay=mx.bluebottle.com[136.243.21.189]:25, delay=0.61, delays=0.05/0.02/0.22/0.32, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as 37DBE9EC4)
Aug 4 11:09:32 mail postfix/smtp[71618]: 14C4C7EC57: to=<[email protected]>, relay=vfxplc.com.inbound10.mxlogic.net[208.65.144.3]:25, delay=1.6, delays=0.05/0.05/0.6/0.85, dsn=5.0.0, status=bounced (host vfxplc.com.inbound10.mxlogic.net[208.65.144.3] said: 554 Denied [CS] [b6d90c55.0.552923.00-2289.1107665.p02c11m005.mxlogic.net] (Mode: normal) (in reply to end of DATA command))
Aug 4 11:09:32 mail postfix/smtp[71616]: 14C4C7EC57: to=<[email protected]>, relay=mx4.hotmail.com[65.55.33.119]:25, delay=1.6, delays=0.05/0.04/0.49/1, dsn=2.0.0, status=sent (250 <[email protected]> Queued mail for delivery)
Aug 4 11:09:32 mail postfix/smtp[71614]: 14C4C7EC57: to=<[email protected]>, relay=equitydirect.co.ke.inbound10.mxlogicmx.net[208.65.145.3]:25, delay=1.6, delays=0.05/0.03/0.9/0.66, dsn=5.0.0, status=bounced (host equitydirect.co.ke.inbound10.mxlogicmx.net[208.65.145.3] said: 554 Denied [CS] [b6d90c55.0.778752.00-2304.1523550.s12p02m085.mxlogic.net] (Mode: normal) (in reply to end of DATA command))
Aug 4 11:09:32 mail postfix/smtp[71620]: 14C4C7EC57: to=<[email protected]>, relay=mx-eu.mail.am0.yahoodns.net[188.125.69.79]:25, delay=1.8, delays=0.05/0.07/0.08/1.6, dsn=2.0.0, status=sent (250 ok dirdel 4/2)
Aug 4 11:09:32 mail postfix/smtp[71620]: 14C4C7EC57: to=<[email protected]>, relay=mx-eu.mail.am0.yahoodns.net[188.125.69.79]:25, delay=1.8, delays=0.05/0.07/0.08/1.6, dsn=2.0.0, status=sent (250 ok dirdel 4/2)
Aug 4 11:09:32 mail postfix/smtp[71620]: 14C4C7EC57: to=<[email protected]>, relay=mx-eu.mail.am0.yahoodns.net[188.125.69.79]:25, delay=1.8, delays=0.05/0.07/0.08/1.6, dsn=2.0.0, status=sent (250 ok dirdel 4/2)
Aug 4 11:09:32 mail postfix/smtp[71620]: 14C4C7EC57: to=<[email protected]>, relay=mx-eu.mail.am0.yahoodns.net[188.125.69.79]:25, delay=1.8, delays=0.05/0.07/0.08/1.6, dsn=2.0.0, status=sent (250 ok dirdel 4/2)
Aug 4 11:09:32 mail postfix/smtp[71620]: 14C4C7EC57: to=<[email protected]>, relay=mx-eu.mail.am0.yahoodns.net[188.125.69.79]:25, delay=1.8, delays=0.05/0.07/0.08/1.6, dsn=2.0.0, status=sent (250 ok dirdel 4/2)
Aug 4 11:09:32 mail postfix/smtp[71620]: 14C4C7EC57: to=<[email protected]>, relay=mx-eu.mail.am0.yahoodns.net[188.125.69.79]:25, delay=1.8, delays=0.05/0.07/0.08/1.6, dsn=2.0.0, status=sent (250 ok dirdel 4/2)
Aug 4 11:09:33 mail postfix/smtp[71613]: 14C4C7EC57: to=<[email protected]>, relay=mx.bt.lon5.cpcloud.co.uk[65.20.0.49]:25, delay=2.5, delays=0.05/0.02/0.08/2.4, dsn=2.0.0, status=sent (250 <55BF549902860DA2> Mail accepted)
Aug 4 11:09:35 mail postfix/smtp[71615]: 14C4C7EC57: to=<[email protected]>, relay=mx1.safaricombusiness.co.ke[41.203.208.3]:25, delay=4.2, delays=0.05/0.03/2.6/1.5, dsn=2.0.0, status=sent (250 ok: Message 1038363882 accepted)
Aug 4 11:09:35 mail postfix/smtp[71615]: 14C4C7EC57: to=<[email protected]>, relay=mx1.safaricombusiness.co.ke[41.203.208.3]:25, delay=4.2, delays=0.05/0.03/2.6/1.5, dsn=2.0.0, status=sent (250 ok: Message 1038363882 accepted)
Aug 4 11:09:35 mail postfix/smtp[71615]: 14C4C7EC57: to=<[email protected]>, relay=mx1.safaricombusiness.co.ke[41.203.208.3]:25, delay=4.2, delays=0.05/0.03/2.6/1.5, dsn=2.0.0, status=sent (250 ok: Message 1038363882 accepted)
Aug 4 11:09:36 mail postfix/smtp[71621]: 14C4C7EC57: to=<[email protected]>, relay=mta5.am0.yahoodns.net[98.138.112.32]:25, delay=5.7, delays=0.05/0.07/0.41/5.2, dsn=2.0.0, status=sent (250 ok dirdel 4/0)
Aug 4 11:09:36 mail postfix/smtp[71621]: 14C4C7EC57: to=<[email protected]>, relay=mta5.am0.yahoodns.net[98.138.112.32]:25, delay=5.7, delays=0.05/0.07/0.41/5.2, dsn=2.0.0, status=sent (250 ok dirdel 4/0)
Aug 4 11:09:36 mail postfix/smtp[71621]: 14C4C7EC57: to=<[email protected]>, relay=mta5.am0.yahoodns.net[98.138.112.32]:25, delay=5.7, delays=0.05/0.07/0.41/5.2, dsn=2.0.0, status=sent (250 ok dirdel 4/0)
Aug 4 11:09:36 mail postfix/smtp[71621]: 14C4C7EC57: to=<[email protected]>, relay=mta5.am0.yahoodns.net[98.138.112.32]:25, delay=5.7, delays=0.05/0.07/0.41/5.2, dsn=2.0.0, status=sent (250 ok dirdel 4/0)
Aug 4 11:09:43 mail postfix/cleanup[71606]: 968227EC58: message-id=<[email protected]>
Aug 4 11:09:43 mail opendkim[24666]: 968227EC58: DKIM-Signature field added (s=mail, d=MYDOMAINCOM2012)
Aug 4 11:09:43 mail postfix/qmgr[27543]: 968227EC58: from=<[email protected]>, size=2204, nrcpt=20 (queue active)
Aug 4 11:09:43 mail postfix/smtpd[71611]: connect from MAIL.example.com[172.16.0.3]
Aug 4 11:09:43 mail postfix/smtpd[71611]: B0D2D7EC70: client=MAIL.example.com[172.16.0.3]
Aug 4 11:09:43 mail postfix/cleanup[71606]: B0D2D7EC70: message-id=<[email protected]>
Aug 4 11:09:43 mail postfix/smtpd[71611]: disconnect from MAIL.example.com[172.16.0.3]
Aug 4 11:09:43 mail postfix/qmgr[27543]: B0D2D7EC70: from=<[email protected]>, size=2946, nrcpt=20 (queue active)
Aug 4 11:09:43 mail amavis[24687]: (24687-07) Passed CLEAN {RelayedOpenRelay}, [59.88.35.206]:4678 [59.88.35.206] <[email protected]> -> <[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>, Queue-ID: 968227EC58, Message-ID: <[email protected]>, mail_id: JR1l308kvN-H, Hits: -, size: 2531, queued_as: B0D2D7EC70, 378 ms
Aug 4 11:09:43 mail postfix/lmtp[71609]: 968227EC58: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=13, delays=12/0/0.01/0.38, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as B0D2D7EC70)
Aug 4 11:09:43 mail postfix/lmtp[71609]: 968227EC58: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=13, delays=12/0/0.01/0.38, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as B0D2D7EC70)
Aug 4 11:09:43 mail postfix/lmtp[71609]: 968227EC58: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=13, delays=12/0/0.01/0.38, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as B0D2D7EC70)
Aug 4 11:09:43 mail postfix/lmtp[71609]: 968227EC58: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=13, delays=12/0/0.01/0.38, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as B0D2D7EC70)
Aug 4 11:09:43 mail postfix/lmtp[71609]: 968227EC58: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=13, delays=12/0/0.01/0.38, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as B0D2D7EC70)
Aug 4 11:09:43 mail postfix/lmtp[71609]: 968227EC58: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=13, delays=12/0/0.01/0.38, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as B0D2D7EC70)
Aug 4 11:09:43 mail postfix/lmtp[71609]: 968227EC58: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=13, delays=12/0/0.01/0.38, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as B0D2D7EC70)
Aug 4 11:09:43 mail postfix/lmtp[71609]: 968227EC58: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=13, delays=12/0/0.01/0.38, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as B0D2D7EC70)
Aug 4 11:09:43 mail postfix/lmtp[71609]: 968227EC58: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=13, delays=12/0/0.01/0.38, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as B0D2D7EC70)
Aug 4 11:09:43 mail postfix/lmtp[71609]: 968227EC58: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=13, delays=12/0/0.01/0.38, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as B0D2D7EC70)
Aug 4 11:09:43 mail postfix/lmtp[71609]: 968227EC58: to=<[email protected]>, relay=172.16.0.3[172.16.0.3]:10024, delay=13, delays=12/0/0.01/0.38, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[172.16.0.3]:10025): 250 2.0.0 Ok: queued as B0D2D7EC70)
172.16.0.3 是我的邮件服务器监狱的内部 IP。
我对这个日志的解释有点困惑。这是否意味着有人在使用我的用户名（[电子邮件保护]) 发送垃圾邮件？如果是，那么这怎么可能，我该如何解决？
这是我的 Postfix main.cf：
### GENERAL
smtpd_banner = $myhostname ESMTP $mail_name
biff = no
append_dot_mydomain = no
daemon_directory = /usr/local/libexec/postfix
command_directory = /usr/local/sbin
myhostname = MAIL.example.com
myorigin = example.com
mydestination = 172.16.0.3
#relayhost =
mynetworks = 172.16.0.0/12 127.0.0.0/8
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
alias_database = hash:/etc/aliases
alias_maps = $alias_database
message_size_limit = 50000000
smtpd_helo_required = yes
### VIRTUAL
virtual_mailbox_domains = pgsql:/usr/local/etc/postfix/postgres-virtual-mailbox-domains.cf
virtual_mailbox_base = /var/vmail
virtual_mailbox_maps = pgsql:/usr/local/etc/postfix/postgres-virtual-mailbox-maps.cf
virtual_alias_maps = pgsql:/usr/local/etc/postfix/postgres-virtual-alias-maps.cf
virtual_minimum_uid = 150
virtual_uid_maps = static:150
virtual_gid_maps = static:6
virtual_transport = dovecot
dovecot_destination_recipient_limit = 1
### SASL Authentication
smtpd_sasl_auth_enable = yes
smtpd_sasl_exceptions_networks = $mynetworks
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_tls_cert_file = /usr/local/etc/ssl/MAIL.example.com/private.crt
smtpd_tls_key_file = /usr/local/etc/ssl/MAIL.example.com/private.key
smtpd_tls_CAfile = /usr/local/etc/ssl/MAIL.example.com/cacert.pem
smtpd_tls_security_level = may
smtpd_tls_received_header = no
smtpd_tls_loglevel = 1
smtpd_use_tls = yes
smtpd_tls_auth_only = yes
tls_random_source = dev:/dev/urandom
debug_peer_level = 2
debugger_command =
show_user_unknown_table_name = no
### LIMITATIONS
smtpd_client_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_rbl_client ix.dnsbl.manitu.net,
reject_rbl_client dnsbl.sorbs.net,
reject_rbl_client sbl-xbl.spamhaus.org,
reject_rbl_client zen.spamhaus.org,
reject_rbl_client blackholes.easynet.nl,
reject_rbl_client dialup.blacklist.jippg.org,
reject_rbl_client cbl.abuseat.org,
reject_rbl_client bl.spamcop.net,
reject_rbl_client sbl.spamhaus.org,
reject_rbl_client t1.dnsbl.net.au,
reject_rhsbl_client block.rhs.mailpolice.com,
reject_rhsbl_client dynamic.rhs.mailpolice.com,
reject_rhsbl_client rhsbl.sorbs.net,
reject_rhsbl_client bogusmx.rfc-ignorant.org
smtpd_sender_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_unknown_sender_domain,
reject_sender_login_mismatch,
reject_rhsbl_sender rhsbl.sorbs.net,
reject_rhsbl_sender rddb.dnsbl.net.au,
reject_rhsbl_sender endn.dnsbl.net.au,
reject_rhsbl_sender rhsbl.sorbs.net,
reject_rhsbl_sender block.rhs.mailpolice.com,
reject_rhsbl_sender dynamic.rhs.mailpolice.com
smtpd_recipient_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_unauth_destination,
reject_unknown_recipient_domain,
reject_rbl_client ix.dnsbl.manitu.net,
reject_rbl_client dnsbl.sorbs.net,
reject_rbl_client bl.spamcop.net,
reject_rbl_client zen.spamhaus.org,
reject_rbl_client dnsbl-1.uceprotect.net
readme_directory = /usr/local/share/doc/postfix
sample_directory = /usr/local/etc/postfix
sendmail_path = /usr/local/sbin/sendmail
html_directory = /usr/local/share/doc/postfix
setgid_group = maildrop
manpage_directory = /usr/local/man
newaliases_path = /usr/local/bin/newaliases
mailq_path = /usr/local/bin/mailq
queue_directory = /var/spool/postfix
mail_owner = postfix
data_directory = /var/db/postfix
disable_vrfy_command = yes
smtpd_delay_reject = yes
content_filter = amavisfeed:[172.16.0.3]:10024
#receive_override_options = no_address_mappings
smtpd_milters = inet:172.16.0.3:54321
non_smtpd_milters = inet:172.16.0.3:54321
milter_default_action = accept
inet_protocols = ipv4
172.16.0.3:54321 是 OpenDKIM。
这是我的master.cf：
smtp inet n - n - - smtpd
pickup unix n - n 60 1 pickup
cleanup unix n - n - 0 cleanup
qmgr unix n - n 300 1 qmgr
tlsmgr unix - - n 1000? 1 tlsmgr
rewrite unix - - n - - trivial-rewrite
bounce unix - - n - 0 bounce
defer unix - - n - 0 bounce
trace unix - - n - 0 bounce
verify unix - - n - 1 verify
flush unix n - n 1000? 0 flush
proxymap unix - - n - - proxymap
proxywrite unix - - n - 1 proxymap
smtp unix - - n - - smtp
relay unix - - n - - smtp
showq unix n - n - - showq
error unix - - n - - error
retry unix - - n - - error
discard unix - - n - - discard
local unix - n n - - local
virtual unix - n n - - virtual
lmtp unix - - n - - lmtp
anvil unix - - n - 1 anvil
scache unix - - n - 1 scache
dovecot unix - n n - - pipe
flags=DRhu user=vmail:mail argv=/usr/local/libexec/dovecot/deliver -f ${sender} -d ${user}@${nexthop}
amavisfeed unix - - n - 2 lmtp
-o lmtp_data_done_timeout=1200
-o lmtp_send_xforward_command=yes
172.16.0.3:10025 inet n - n - - smtpd
-o content_filter=
-o smtpd_delay_reject=no
-o smtpd_client_restrictions=permit_mynetworks,reject
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o smtpd_data_restrictions=reject_unauth_pipelining
-o smtpd_end_of_data_restrictions=
-o smtpd_restriction_classes=
-o mynetworks=172.16.0.0/12
-o smtpd_error_sleep_time=0
-o smtpd_soft_error_limit=1001
-o smtpd_hard_error_limit=1000
-o smtpd_client_connection_count_limit=0
-o smtpd_client_connection_rate_limit=0
-o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters,no_address_mappings
-o local_header_rewrite_clients=
-o smtpd_milters=
-o local_recipient_maps=
-o relay_recipient_maps=
答案1
这是否意味着有人正在使用我的用户名（[电子邮件保护]) 发送垃圾邮件？
是的
这条日志行就是证明。
Aug 4 11:09:17 mail postfix/smtpd[71597]: 1AE3B7EC3D: client=unknown[59.88.35.206], sasl_method=PLAIN, [email protected]
正如您permit_sasl_authenticated在 中所做的那样main.cf，您授权任何知道您的凭证的人通过您的服务器发送电子邮件。
如果是这样，那怎么可能呢？
有很多方法可以泄露您的凭证。
- 在你的计算机中植入键盘记录器
- 蠕虫发送敏感信息（包括您的凭证）
- 通过暴力破解或猜测获取了弱密码
- 网络钓鱼电子邮件
- 还有许多其他...
我该如何修复它？
首先禁用该帐户，要么在 postgre 数据库中更改其状态，要么将密码更改为随机密码。确定您的凭据是如何泄露的，并修复该漏洞。
补充笔记：
您的 postfix 配置很好。尽管由于您在每个阶段重复一些限制，因此它们之间有一点重叠。您还应该验证每个 rhsbl/rbl 提供商是否仍然活跃并维护黑名单以避免误报。
答案2
日志显示有人获取了邮件账户的密码[电子邮件保护]并使用它通过服务器发送垃圾邮件。
- 时间 11:09:17 的条目表明，IP 地址为 59.88.35.206 的用户名的 SASL 身份验证成功[电子邮件保护]。
- 11:09:30 处的条目显示接收并排队带有发件人地址的消息[电子邮件保护]通过该连接有 20 名声明的接收者。
- 时间戳为 11:09:31 的条目显示，这二十份副本首先在 Postfix 内部转发，然后发送给收件人。
此类事件最常见的原因是用户受到网络钓鱼邮件的欺骗，该邮件要求用户在某些凭证收集网络表单上输入其邮件地址和密码。
修理：
- 立即更改该帐户的密码。
- 选择一个（更）合理的密码，特别是一个在其他地方没有使用过的密码。
- 要（更加）小心，不要向任何人透露密码，特别是不要在任何网站上输入密码。