Всем доброго времени суток. Неделю назад началась массовая рассылка спам писем с одного конкретного адреса. fail2ban настроен, вроде заносит в черный список адреса, но что-то проходит. В итоге дошло до того, что репутация почтового сервера упала из-за одного конкретного адреса. Open relay точно закрыт. Centos 7+dovecot+postfix. Компьютер пользователя уже перерыли, там ничего такого нет. Даже с outlook решили пересадить на веб. В какую сторону копнуть?
Пример maillog с письмом:
Nov 8 10:55:43 mail postfix/pickup[21530]: BB424226220B: uid=1025 from=<info@mydomain.ru>
Nov 8 10:55:43 mail postfix/cleanup[22916]: BB424226220B: message-id=<20221108075543.BB424226220B@mail.mydomain.ru>
Nov 8 10:55:43 mail opendkim[1621]: BB424226220B: no signing table match for 'info@mydomain.ru'
Nov 8 10:55:43 mail opendkim[1621]: BB424226220B: no signature data
Nov 8 10:55:43 mail postfix/qmgr[4930]: BB424226220B: from=<info@mydomain.ru>, size=5499, nrcpt=1 (queue active)
Nov 8 10:55:44 mail postfix/cleanup[20715]: ECE1D2262207: message-id=<20221108075543.BB424226220B@mail.mydomain.ru>
Nov 8 10:55:44 mail postfix/smtp[3066]: BB424226220B: to=<lewisoski22@wp.pl>, relay=127.0.0.1[127.0.0.1]:10025, delay=0.35, delays=0.12/0.03/0.06/0.14, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as ECE1D2262207)
Nov 8 10:55:44 mail postfix/qmgr[4930]: BB424226220B: removed
postconf:
address_verify_sender = postmaster@mydomain.ru
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
anvil_rate_time_unit = 60s
black_client = check_sender_access hash:/etc/postfix/lists/black_client
black_client_ip = check_client_access hash:/etc/postfix/lists/black_client_ip
block_dsl = check_client_access regexp:/etc/postfix/lists/block_dsl
bounce_template_file = /etc/postfix/bounce.cf
broken_sasl_auth_clients = yes
command_directory = /usr/sbin
config_directory = /etc/postfix
content_filter = scan:[127.0.0.1]:10025
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5
dovecot_destination_recipient_limit = 1
html_directory = no
inet_interfaces = all
inet_protocols = ipv4
local_recipient_maps = unix:passwd.byname $alias_maps
mail_owner = postfix
mailbox_size_limit = 4098000000
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
maximal_backoff_time = 15m
maximal_queue_lifetime = 5h
message_size_limit = 4096000000
milter_default_action = accept
milter_protocol = 2
mime_header_checks = pcre:/etc/postfix/pcre_mime_header_checks
minimal_backoff_time = 5m
mx_access = check_sender_mx_access cidr:/etc/postfix/lists/mx_access
mydestination = localhost.$mydomain, localhost, $mydomain
myhostname = mail.mydomain.ru
mynetworks = 127.0.0.0/8
myorigin = $mydomain
newaliases_path = /usr/bin/newaliases.postfix
non_smtpd_milters = $smtpd_milters
queue_directory = /var/spool/postfix
queue_run_delay = 5m
readme_directory = /usr/share/doc/postfix-2.10.1/README_FILES
receive_override_options = no_address_mappings
sample_directory = /usr/share/doc/postfix-2.10.1/samples
sender_bcc_maps = hash:/etc/postfix/sender_bcc
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtp_destination_recipient_limit = 1024
smtpd_client_connection_rate_limit = 20
smtpd_client_message_rate_limit = 100
smtpd_client_recipient_rate_limit = 30
smtpd_client_restrictions = permit_mynetworks white_client white_client_ip black_client black_client_ip permit_sasl_authenticated reject_unauth_pipelining permit
smtpd_data_restrictions = permit
smtpd_end_of_data_restrictions = permit
smtpd_helo_required = no
smtpd_helo_restrictions = permit_mynetworks white_client_ip white_helo black_client_ip block_dsl
smtpd_milters = inet:127.0.0.1:8891
smtpd_recipient_restrictions = permit_mynetworks white_client white_client_ip black_client black_client_ip reject_unlisted_recipient permit_sasl_authenticated reject_non_fqdn_recipient reject_unauth_destination reject_unknown_recipient_domain reject_unverified_recipient reject_unknown_reverse_client_hostname reject_unknown_client_hostname reject_rbl_client bl.spamcop.net reject_rbl_client cbl.abuseat.org reject_rbl_client dul.ru reject_rbl_client dnsbl.abuse.ch reject_rbl_client zen.spamhaus.org=127.0.0.[2..11] reject_rbl_client zen.spamhaus.org reject_rbl_client psbl.surriel.com reject_rbl_client b.barracudacentral.org permit
smtpd_relay_restrictions = permit_mynetworks black_client black_client_ip
smtpd_restriction_classes = white_client_ip black_client_ip block_dsl white_client white_helo black_client mx_access
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_path = /var/spool/postfix/private/auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_tls_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_sender_restrictions = permit_mynetworks white_client black_client white_client_ip black_client_ip permit_sasl_authenticated reject_non_fqdn_sender reject_unknown_sender_domain mx_access reject_authenticated_sender_login_mismatch reject_unauthenticated_sender_login_mismatch reject_sender_login_mismatch reject_unlisted_sender reject_unauth_destination check_sender_access hash:/etc/postfix/sender_access permit
smtpd_tls_cert_file = /etc/ssl/mail/public.crt
smtpd_tls_key_file = /etc/ssl/mail/private.key
smtpd_tls_received_header = yes
smtpd_use_tls = yes
soft_bounce = no
transport_maps = hash:/etc/postfix/transport_maps
unknown_local_recipient_reject_code = 550
virtual_alias_maps = proxy:mysql:/etc/postfix/mysql_virtual_alias_maps.cf
virtual_gid_maps = static:1024
virtual_mailbox_base = /home/mail
virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql_virtual_domains_maps.cf
virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql_virtual_mailbox_maps.cf
virtual_minimum_uid = 1024
virtual_transport = dovecot
virtual_uid_maps = static:1024
white_client = check_sender_access hash:/etc/postfix/lists/white_client
white_client_ip = check_client_access hash:/etc/postfix/lists/white_client_ip
white_helo = check_sender_access hash:/etc/postfix/lists/white_helo
