我的服务器发送了大量垃圾邮件，使用的是真实的电子邮件地址，我觉得这很奇怪，因为通常情况下，虚假地址是随机使用的。此外，我通常会在这些电子邮件中找到 X-PHP-Originating-Script 标头，但在这种情况下，没有。X-Mailer 值并不总是相同的。以下是我至今尝试过的方法：
- 我在整个系统上多次运行了 Linux Malware Detect、ClamScan 和 ISPP Scan、Rkhunter，结果都是阴性。
- 我更改了电子邮件的密码、数据库的根密码、ISPConfig 的管理员密码，但没有任何变化
- Fail2ban 也在运行，它似乎可以检测并禁止与这些电子邮件发送相关的 IP，但如果我查看日志，会发现有很多“已被禁止”的 IP 信息，因此我不能 100% 确定它是否正常工作。我有时会在运行“netstat”监视端口 25 时看到相同的 IP，因此我猜它们与此有关，但我不知道该怎么做。
有关我的系统的信息：Debian 6、ISPConfig 3、PHP/MySQL 托管服务器；Postfix + ClamAV + Amavis
垃圾邮件标题示例：
regular_text: Received: from MYHOST (localhost.localdomain [127.0.0.1])
regular_text: by MYHOST (Postfix) with ESMTP id 68BBA2016422;
regular_text: Thu, 23 Nov 2017 14:59:41 -0500 (EST)
regular_text: Received: from 62.112.5.169 (unknown [175.223.31.212])
regular_text: by MYHOST (Postfix) with ESMTP id 9F04D2016473;
regular_text: Thu, 23 Nov 2017 14:59:00 -0500 (EST)
regular_text: From: PayPal Update Center <[email protected]>
regular_text: Subject: Regarding your information
regular_text: MIME-Version: 1.0
regular_text: X-Priority: 3
regular_text: X-MSMail-Priority: Normal
regular_text: X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.6429
regular_text: X-Mailer: Microsoft Outlook Express 6.00.2600.6429
regular_text: Message-ID: <[email protected]>
regular_text: Content-Type: multipart/mixed; boundary="_NextPart_000_0077_87BE7816.3B325A4E"
regular_text: Date: Thu, 23 Nov 2017 14:59:00 -0500 (EST)
postconf-n：
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
always_add_missing_headers = yes
always_bcc = mailarchive@localhost
append_dot_mydomain = no
biff = no
body_checks = regexp:/etc/postfix/body_checks
broken_sasl_auth_clients = yes
config_directory = /etc/postfix
content_filter = scan:[127.0.0.1]:10025
disable_vrfy_command = yes
dovecot_destination_recipient_limit = 1
header_checks = regexp:/etc/postfix/header_checks
html_directory = /usr/share/doc/postfix/html
inet_interfaces = all
mailbox_size_limit = 0
maildrop_destination_concurrency_limit = 1
maildrop_destination_recipient_limit = 1
message_size_limit = 0
mime_header_checks = regexp:/etc/postfix/mime_header_checks
mydestination = ks4000003.ip-198-245-60.net, localhost, localhost.localdomain
myhostname = ks4000003.ip-198-245-60.net
mynetworks = 127.0.0.0/8 [::1]/128
myorigin = /etc/mailname
nested_header_checks = regexp:/etc/postfix/nested_header_checks
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $virtual_mailbox_limit_maps
readme_directory = /usr/share/doc/postfix
receive_override_options = no_address_mappings
recipient_delimiter = +
relay_domains = mysql:/etc/postfix/mysql-virtual_relaydomains.cf
relay_recipient_maps = mysql:/etc/postfix/mysql-virtual_relayrecipientmaps.cf
relayhost =
smtp_destination_concurrency_limit = 5
smtp_destination_rate_delay = 1s
smtp_extra_recipient_limit = 20
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, check_client_access mysql:/etc/postfix/mysql-virtual_client.cf
smtpd_data_restrictions = reject_unauth_pipelining
smtpd_delay_reject = no
smtpd_error_sleep_time = 0
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, check_client_access hash:/etc/postfix/rbl_whitelist, check_recipient_access mysql:/etc/postfix/mysql-virtual_recipient.cf, check_sender_access regexp:/etc/postfix/sender_access.regexp hash:/etc/postfix/sender_access mysql:/etc/postfix/mysql-virtual_sender.cf, reject_unknown_recipient_domain, reject_unauth_destination, reject_unauth_destination, reject_unlisted_recipient, reject_invalid_hostname, reject_non_fqdn_sender, reject_rbl_client cbl.abuseat.org, reject_rbl_client bl.spamcop.net, reject_rbl_client sbl.spamhaus.org, reject_rbl_client truncate.gbudb.net, permit
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_sender_restrictions = check_client_access cidr:/etc/postfix/internal_clients_filter, permit_sasl_authenticated, permit_mynetworks, reject_non_fqdn_sender, reject_unknown_sender_domain, reject_unauth_destination
smtpd_tls_cert_file = /etc/postfix/smtpd.cert
smtpd_tls_key_file = /etc/postfix/smtpd.key
smtpd_tls_loglevel = 1
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes
transport_maps = proxy:mysql:/etc/postfix/mysql-virtual_transports.cf, hash:/etc/postfix/transport
unknown_local_recipient_reject_code = 550
virtual_alias_domains =
virtual_alias_maps = proxy:mysql:/etc/postfix/mysql-virtual_forwardings.cf, mysql:/etc/postfix/mysql-virtual_email2email.cf
virtual_gid_maps = static:5000
virtual_mailbox_base = /var/vmail
virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql-virtual_domains.cf
virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql-virtual_mailboxes.cf
virtual_transport = dovecot
virtual_uid_maps = static:5000
如果我关闭 Postfix 并查看 apache 日志，我可以看到类似这样的内容：
[Tue Nov 28 08:06:23 2017] [error] [client 168.1.128.35] Directory index forbidden by Options directive: /var/www/apps/
[Tue Nov 28 08:56:30 2017] [error] [client 66.249.64.210] File does not exist: /var/www/robots.txt
[Tue Nov 28 09:06:10 2017] [error] [client 169.53.184.5] Directory index forbidden by Options directive: /var/www/apps/
[Tue Nov 28 09:11:25 2017] [error] [client 66.249.64.31] File does not exist: /var/www/robots.txt
[Tue Nov 28 09:11:25 2017] [error] [client 66.249.64.4] File does not exist: /var/www/.well-known
[Tue Nov 28 09:44:14 2017] [error] [client 66.249.64.26] File does not exist: /var/www/robots.txt
[Tue Nov 28 09:44:14 2017] [error] [client 66.249.64.26] File does not exist: /var/www/.well-known
[Tue Nov 28 09:45:13 2017] [error] [client 66.249.64.26] File does not exist: /var/www/.well-known
[Tue Nov 28 09:52:50 2017] [error] [client 172.104.115.143] File does not exist: /var/www/favicon.ico
[Tue Nov 28 10:00:13 2017] [error] [client 212.83.150.38] File does not exist: /var/www/a2billing
[Tue Nov 28 10:01:25 2017] [error] [client 212.83.150.38] File does not exist: /var/www/a2billing
[Tue Nov 28 10:07:28 2017] [error] [client 139.162.87.250] Directory index forbidden by Options directive: /var/www/apps/
我发现随机 IP 尝试访问 /var/www/apps 等很奇怪，因为这些不是通常可以访问的目录。
以下是可疑脚本发送垃圾邮件的途径示例：
Nov 30 09:44:10 ks4000003 postfix/smtpd[5035]: warning: hostname 201-46-61-66.wireless.dynamic.sbr1.ce.faster.net.br does not resolve to address 201.46.61.66: Name or service not known
Nov 30 09:44:10 ks4000003 postfix/smtpd[5035]: connect from unknown[201.46.61.66]
Nov 30 09:44:14 ks4000003 postfix/smtpd[5035]: Anonymous TLS connection established from unknown[201.46.61.66]: TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)
Nov 30 09:44:18 ks4000003 postfix/smtpd[5035]: warning: unknown[201.46.61.66]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Nov 30 09:44:20 ks4000003 postfix/smtpd[5035]: warning: unknown[201.46.61.66]: SASL PLAIN authentication failed:
Nov 30 09:44:21 ks4000003 postfix/smtpd[5035]: NOQUEUE: reject: RCPT from unknown[201.46.61.66]: 554 5.7.1 <[email protected]>: Recipient address rejected: Access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[201.46.61.66]>
Nov 30 09:44:21 ks4000003 postfix/smtpd[5035]: disconnect from unknown[201.46.61.66]
任何帮助我都会感激不尽，因为我对此非常绝望。一定有一个简单的方法可以解决这个问题。
答案1
我通常会在这些电子邮件中找到 X-PHP-Originating-Script 标头
如果邮件是从一个易受攻击的 PHP 脚本发送的，就会发生这种情况，以前可能就是这样。但是，这封邮件似乎不是从您的服务器发出的，而是使用您的服务器作为中继。
Received: from 62.112.5.169 (unknown [175.223.31.212]) by MYHOST (Postfix) with ESMTP id 9F04D2016473; Thu, 23 Nov 2017 14:59:00 -0500 (EST)
这里的主机名62.112.5.169经过了混淆HELO，邮件实际上是从175.223.28.0/22韩国电信发送的。
从您的配置来看，很难说您实际上有什么样的限制，因为例如，您check_client_access从多个来源和格式（正则表达式、BerkeleyDB 甚至 MySQL）收集数据。例如，您可以有一个松散的正则表达式，实际上允许来自这些客户端的邮件，有效地使您的邮件服务器成为开放中继。
我会先从您的配置中删除最复杂的源。然后我会分别测试它们，postmap -q以确保它们确实按照您的预期运行。
答案2
smtpd_client_restrictions 的默认值是允许
http://www.postfix.org/postconf.5.html#smtpd_client_restrictions
reject在 smtpd_client_restrictions 行末尾添加以下内容以使您的策略明确：
smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, check_client_access mysql:/etc/postfix/mysql-virtual_client.cf, reject
@Esa Jokinen 正确指出，那里的 MySQL 配置可能允许访问，如果您没有将未经 SASL 身份验证且不在 mynetworks 中的客户端列入白名单，您可能只想删除该check_client_access参数。