Hi David, > -----Original Message----- > From: David
> The setup is pretty secure (I think) and and don't find any > evidence in my logs that I have an open relay. The problem is > that I got a LOT of connections from someone that tries to > send e-mail to fake users at my domain. The logfile grows at > rapid speed and I got 180 MB log just for the last 12 hours. > > The connections are from random IP-addresses. It's different > addresses and domains each time, but the pattern is the same. > > Example 1: > > Aug 27 17:54:44 www postfix/smtpd[10056]: 73D9110F26: reject: > RCPT from smtp.terra.es[213.4.129.129]: 550 > <[EMAIL PROTECTED]>: User unknown in virtual alias table; > from=<> proto=ESMTP helo=<tsmtp8.mail.isp> > > Example 2: > > Aug 27 17:54:42 www postfix/smtpd[10069]: E2D9910F2E: reject: > RCPT from host048021.arnet.net.ar[200.45.48.21]: 550 > <[EMAIL PROTECTED]>: User unknown in virtual alias table; > from=<> proto=ESMTP helo=<smtp-mx-02.ti.local> > > Any idea how to stop this. The server is behind a firewall, > so I guess itīs possible to block this bastard, but I don't > know how to nail him. >From your log, you are already rejecting the messages. I don't know of another way to reject any earlier. The firewall (assuming it is not a content filtering device) won't help much. I could be wrong, but it looks like you are getting bounces from external mail servers. Someone (spammer or other) may be using your domain with fake aliases. If that is the case, then there is not much that can be done. The only thing I can think of would be to capture some of the messages and see if you can find a pattern that might give a clue to the origin. I find that unlikely but you never know. Take a look at "What trouble to report to the postmaster" (http://www.postfix.org/basic.html) and the luser_relay (http://www.postfix.org/rewrite.html#luser_relay). Hope this helps. --Larry --Larry ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
