Monitor all outgoing email

DNS doesn't seem to be operational on your server. Pursue that avenue. (man dig).

Xserve G5 2.0 GHz 2 GB RAM Mac OS X (10.4.8) Apple Hardware RAID, ATTO UL4D, Exabyte VXA-2 1x10 1u

DNS doesn't seem to be operational on your server.

I don't think it is DNS related. The first log posting looks like typical backscatter mail (mail being returned to non-existant spam sender). These have all been sitting in the queue for a while (see 'delay' field). However, you say you do not have spam filtering on?

We will need output from Terminal command 'postconf -n'

-david

Warning: 17.250.248.184: hostname smtpout.mac.com
verification failed: host not found

This, however, may be a DNS issue...

This is a "Warning" that your dns cannot find a straight match between a PTR lookup on the IP address and an A record for the hostname. Although .Mac does have a string of A records for the same hostname, I do not get these warnings on my server, so a bit strange.

However, this should not prevent your server from accepting mail from .mac unless you have explicitly added a postfix restriction for same. The default server will just log the 'warning' and continue with accepting the connection. This will show up on postconf -n output.

Re blacklisting, being on a blacklist would not prevent you from receiving mail.

As rhwalker first suggested, probably worth checking that your dns is working (just open a browser on the server and see if you can browse internet).

-david

smtpd clientrestrictions = permit_mynetworks
permit saslauthenticated reject unauthdestination
reject unauthpipelining reject invalidhostname
permit
smtpd enforcetls = no
smtpd helorequired = yes
smtpd recipientrestrictions =
permit sasl_authenticated,permit_mynetworks,rejectuna
uth_destination,permit

Quick comment, unrelated to your 'problems'...

reject unauthpipelining is not recommended for use outside of an smtpd datarestriction.

I cannot really tell anything without the whole output from postconf -n. But if you do not have spam filtering turned on, don't have an RBL blacklist lookup and have only got those basic restrictions to stop spammers sending you stuff, then you will be accepting a lot more spam than you need to. I'm still puzzled as to you "not having spam filters" and yet your previous log output showing typical backscatter caused by spam being rejected by same filters. Maybe you just recently turned them off? But without more info being offered by yourself, theres nothing really to suggest. Did you check your DNS, for example?

-david

If you need to, just change your external IPs to 1.2.3.4 (although your external IP should not need to be in that output anyway). Your internal IPs are not a security risk since these are just from the private ranges anyway (we all have variations of these and they do not give away your location). Change your domain name too if you want to - just ensure that you are doing this very consistently (just change main domain name part, not sub domains or host part - e.g. change mail.secretDomain.org to mail.domain.org )

-david

I had a read of your previous post about the hacking, etc so aware of the background now.

There are some bits of your config which are totally alien to me (I had to look them up 🙂 so presume those bits got copied in from the other system (maybe linux box?) before you took over. As purely an OS X Server postfix person, I may therefore have missed something relevant that someone else may notice. Also, you appear to be running mailman which is something else I do not have experience of (I don't know how it might change the postfix main.cf file). Otherwise there was nothing that really jumped out. My comments for what they are worth...

mydestination = $myhostname, localhost.$mydomain, mydomain.tv, mail.mydomain.tv, @mydomain.tv, localhost

I'm not sure what the "@mydomain.tv" is for?

myhostname = ns2.mydomain.tv

This will be the HELO name which your mail server uses to identify it to other mail servers. Ideally it should be the same as your MX record (and PTR record for your WAN IP). Possibly this should be "mail.mydomain.tv"? Mail Services uses the 'hostname' as set in Mail Services settings, not the 'real' dns hostname for the server - they don't really have to match.

mynetworks = lots of them...

Are these really all needed? In particular the 68.x.x.x IPs. Any mail coming from these IPs will be relayed by your server without any authentication due to the permit_mynetworks restriction so I presume that they are your remote offices and therefore very trusted. Even so, usually authentication is enforced instead of just trusting. Not sure what the two 127.x.x.x IPs are, presumably one is 127.0.0.1 (which always resolves to 'localhost'). The 192.168.1.159 is actually included within the 192.168.1.0/24 range.

smtpd pw_server_securityoptions = plain,login

This allows external users (not otherwise in your 'mynetworks') to authenticate for relay. Generally, this should be set to at least CRAM-MD5 - plain & login are sent 'in the clear' and so are not really secure.

All in all, nothing really hit me (although there are several options there I have never seen before). From your earlier posts I doubt though whether you really want to start editing things, especially if other people are quite happy with what they have (no point in putting yourself up as a target).

So... back to your original question... "how can I tell if I have a spammer using me?". Since you have already checked your IP out with the spam blacklist sites and it is not there then that would suggest your are not getting used as a spam outlet - these sites are pretty quick to catch on. Only other way is to filter the mail.log for "status=sent" or "to=" and you will see all the incoming/outgoing mail. Depending on how busy your server is you should see a 'lot' of mail going out to different addresses within minutes of each other. If you are being used as a spam outlet then I would expect them to make hay while the sun shines and not just trickle it out a few at a time. In Console menu: File->Save A Copy, you can save a text copy of a log and either open it in a text editor or pipe it through grep for further filtering.

You also seem to have a 'catchall' account in use (luser_relay) which gets copies of all incoming/outgoing mail - this should also be getting copies of the spammers mail so check that for outgoing spam.

-david