The Server is Being Used to Send Spam
Check that the BM server is not an open relay
By default, Postfix is configured as an open mail server relay, which allows BlueMind services (webmail, EAS) to send emails. Through the admin console, you can add new trusted IPs which will be allowed to send emails through the BlueMind server, typically the internal IT server (holiday management software, monitoring, etc).
If one of these servers is compromised, a spammer can use the BM server to send spam.
Detect the problem by the presence of a large number of rows of the following type:
Jun 21 08:34:30 centos7 postfix/smtpd[16863]: connect from gateway[192.168.122.111]
Jun 21 08:34:48 centos7 postfix/smtpd[16863]: 1C205316C411: client=gateway[192.168.122.111]
Jun 21 08:34:58 centos7 postfix/cleanup[16869]: 1C205316C411: message-id=<>
Jun 21 08:34:58 centos7 postfix/qmgr[16801]: 1C205316C411: from=<user1@domain.com>, size=233, nrcpt=1 (queue active)
Jun 21 08:34:59 centos7 postfix/smtp[16821]: 1C205316C411: to=<user2@anotherdomain.net>, relay=smtp.anotherdomain.net[XX.XX.XX.XX]:25, delay=20, delays=20/0/0.35/0.09, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as 2F10238)
Jun 21 08:34:59 centos7 postfix/qmgr[16801]: 1C205316C411: removed
Jun 21 08:35:04 centos7 postfix/smtpd[16863]: disconnect from gateway[192.168.122.111]
The client line indicates the IP of the server that sent this e-mail, here 192.168.122.111. If it's not legitimate, this means that the server has been compromised and is being used to send spam
Action to be taken:
- delete the IP for the server involved in the BM admin console and save the configuration.
Identifying the user used to send Spam
Most of the time, the issue is that a spammer has found – often using brute-force – a user's password and uses their account to send Spam.
Identify SMTP connections containing a large number of rows of the following type:
May 5 00:08:55 hermes postfix/smtpd[27666]: 7E079B666CC: client=unknown[46.48.93.60], sasl_method=LOGIN, sasl_username=admin
Actions to be taken:
-
change the user's password: either in BM, or in the directory.
-
close all sessions for this user with the command :
bm-cli user logout --email=login@domain.com⚠️ SMTP connection
The commandbm-cli user logoutcloses a user’s BlueMind sessions (webmail, applications, API), but does not manage SMTP connections.
If an SMTP connection is already open, it remains active until it closes naturally, and the user can re-authenticate via SMTP using their password. To prevent a user from sending emails, their user account must be suspended. -
clean the postfix queue to remove e-mails waiting to be sent, to remove all e-mails queued by the user
login@domain.netpostqueue -p | tail -n +2 | awk 'BEGIN { RS = "" } /login@domain\.net/ { print $1 }' | tr -d '\*!' | postsuper -d -❗ This command will delete all mail in the user's queue, whether Spam or legitimate mail sent by the user.
Preventing spam attacks
Limiting brute-force attacks
To limit brute-force attempts, use the password-bruteforce plugin; this will block login attempts for 20 minutes after three failed authentication attempts.
Set up a password policy
If users are not managed via a directory, use the Password security add-on plugin password-sizestrength, which allows you to implement a policy to enforce password rules.
How to spot this early?
The Supervision application enables you to detect the problem quickly and take action before the server is blacklisted by the various anti-spam services.
Alerts based on a significant increase in the number of emails in the Postfix queue have been configured. An alert email is sent to admin@domain.net as soon as the Postfix queue reaches 100 emails.