Через mail-server (postfix) почта пересылается с чужих адресов, на неизвестные!

[alarmus]

Доброго времени суток!
Через mail-server (postfix) почта пересылается с чужих адресов, на неизвестные!
Что за бред?( На релай тесты на сайтах он не проходит,пишет все ок.
mail.log

(Нажмите, чтобы показать/скрыть)

Oct 20 09:00:42 storage01 postfix/error[28640]: 164FA260D67: to=<corsicaltz@aol.com>, relay=none, delay=197775, delays=197775/0.02/0/0, dsn=4.7.1, status=sent
Oct 20 09:00:42 storage01 postfix/error[28645]: ABD80260D0B: to=<cordyglas@aol.com>, relay=none, delay=197825, delays=197825/0.02/0/0, dsn=4.7.1, status=deferred (deli$
Oct 20 09:00:42 storage01 postfix/error[28638]: 12330260BA8: to=<charlott76@comcast.net>, relay=none, delay=332242, delays=332242/0.02/0/0, dsn=4.0.0, status=sent
Oct 20 09:00:42 storage01 postfix/error[28635]: ABD80260D0B: to=<corey.eberhardt@comcast.net>, relay=none, delay=197825, delays=197825/0.02/0/0, dsn=4.0.0, status=sent
Oct 20 09:00:42 storage01 postfix/error[28640]: 164FA260D67: to=<corteserobinson@aol.com>, relay=none, delay=197775, delays=197775/0.02/0/0.01, dsn=4.7.1, status=sent
Oct 20 09:00:42 storage01 postfix/error[28645]: ABD80260D0B: to=<corebake@aol.com>, relay=none, delay=197825, delays=197825/0.02/0/0, dsn=4.7.1, status=sent (deliv$
Oct 20 09:00:42 storage01 postfix/qmgr[17069]: 2B71A260D5F: from=<lawyer_davidesq@outlook.com>, size=2528, nrcpt=50 (queue active)
Oct 20 09:00:42 storage01 postfix/error[28638]: 12330260BA8: to=<charlotte896@comcast.net>, relay=none, delay=332242, delays=332242/0.02/0/0.01, dsn=4.0.0, status=sent$
Oct 20 09:00:42 storage01 postfix/error[28635]: ABD80260D0B: to=<corey.green@comcast.net>, relay=none, delay=197825, delays=197825/0.02/0/0.01, dsn=4.0.0, status=sent$
Oct 20 09:00:42 storage01 postfix/error[28640]: 164FA260D67: to=<cortez0824@aol.com>, relay=none, delay=197775, delays=197775/0.02/0/0.01, dsn=4.7.1, status=sent($
Oct 20 09:00:42 storage01 postfix/error[28645]: ABD80260D0B: to=<corechoscott@aol.com>, relay=none, delay=197825, delays=197825/0.02/0/0, dsn=4.7.1, status=sent

/postfix/main.cf

(Нажмите, чтобы показать/скрыть)

command_directory = /usr/sbin
daemon_directory = /usr/lib/postfix
data_directory = /var/lib/postfix
mail_owner = postfix
myhostname = mail.kiev.ua
mydomain = kiev.ua
myorigin = $mydomain
inet_interfaces = 192.168.11.101, 192.168.12.101, 192.168.13.101, 10.0.1.103, 195.17.228.226
mydestination = $myhostname, localhost.$mydomain, localhost
local_recipient_maps = unix:passwd.byname $alias_maps
unknown_local_recipient_reject_code = 550
mynetworks = 127.0.0.0/8, 10.0.1.0/24, 192.168.11.0/24, 192.168.12.0/24, 192.168.13.0/24
relay_domains = $mydestination
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
recipient_delimiter = +
home_mailbox = Maildir/
header_checks = regexp:/etc/postfix/header_checks
body_checks = regexp:/etc/postfix/body_checks
smtpd_banner = $myhostname ESMTP $mail_name
debugger_command =
sendmail_path = /usr/sbin/postfix
newaliases_path = /usr/bin/newaliases
mailq_path = /usr/bin/mailq
setgid_group = postdrop
readme_directory = no
message_size_limit = 20480000
mailbox_size_limit = 1073741824
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $myhostname
smtpd_client_restrictions = permit_mynetworks,permit
smtpd_recipient_restrictions = permit_mynetworks,permit_auth_destination,permit_sasl_authenticated,reject
smtpd_use_tls = yes
smtpd_tls_cert_file = /etc/ssl/certs/server.crt
smtpd_tls_key_file = /etc/ssl/certs/server.key
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
content_filter = smtp-amavis:[127.0.0.1]:10024
virtual_mailbox_domains = mysql:/etc/postfix/virtual-mailbox-domains.cf
virtual_mailbox_maps = mysql:/etc/postfix/virtual-mailbox-maps.cf
virtual_alias_maps = mysql:/etc/postfix/virtual-alias-maps.cf
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000
virtual_transport = dovecot
dovecot_destination_recipient_limit = 1
biff = no
append_dot_mydomain = no
import_environment = RESOLV_MULTI=on

/postfix/main.cf

(Нажмите, чтобы показать/скрыть)

smtp      inet  n       -       -       -       -       smtpd
smtps     inet  n       -       n       -       -       smtpd
pickup    fifo  n       -       -       60      1       pickup
cleanup   unix  n       -       -       -       0       cleanup
qmgr      fifo  n       -       n       300     1       qmgr
tlsmgr    unix  -       -       -       1000?   1       tlsmgr
rewrite   unix  -       -       -       -       -       trivial-rewrite
bounce    unix  -       -       -       -       0       bounce
defer     unix  -       -       -       -       0       bounce
trace     unix  -       -       -       -       0       bounce
verify    unix  -       -       -       -       1       verify
flush     unix  n       -       -       1000?   0       flush
proxymap  unix  -       -       n       -       -       proxymap
proxywrite unix -       -       n       -       1       proxymap
smtp      unix  -       -       -       -       -       smtp
relay     unix  -       -       -       -       -       smtp
showq     unix  n       -       -       -       -       showq
error     unix  -       -       -       -       -       error
retry     unix  -       -       -       -       -       error
discard   unix  -       -       -       -       -       discard
local     unix  -       n       n       -       -       local
virtual   unix  -       n       n       -       -       virtual
lmtp      unix  -       -       -       -       -       lmtp
anvil     unix  -       -       -       -       1       anvil
scache    unix  -       -       -       -       1       scache
maildrop  unix  -       n       n       -       -       pipe
uucp      unix  -       n       n       -       -       pipe
ifmail    unix  -       n       n       -       -       pipe
bsmtp     unix  -       n       n       -       -       pipe
scalemail-backend unix  -       n       n       -       2       pipe
mailman   unix  -       n       n       -       -       pipe
smtp-amavis unix -       -       n      -     2 smtp
127.0.0.1:10025 inet n     -     n     -     - smtpd
dovecot   unix  -       n       n       -       -       pipe

[alarmus]

Разобрались с ситуации, будете смеятся,кому интересно) Но как спамер это сделал, может кто подскажет???

В общем забанили наш ip сервера на yahoo. B некоторые спамерские письма From: "Barr.David" <barrister_david1@aol.com> к сотням ящиков @yahoo остались в очереди мейл-сервера. Испольозовав команду просмотра очередей, и открыв письма увидел такое сообщение,что ниже (которое отослалось на 400 тыс.адресов!!!) Судя из лога,кто-то заходил через web-client (squirrelmal) узнав пароли к трем ящикам, у которых логин и пароль был одним словом. Но вот как он умудрился изменить mail from? и скрыть настоящего юзера??

(Нажмите, чтобы показать/скрыть)

root@storage01:~# postcat -q 38F9D2601BA
*** ENVELOPE RECORDS deferred/3/38F9D2601BA ***
message_size:            2598             631               1               0            2598
message_arrival_time: Mon Oct 28 12:45:25 2013
create_time: Mon Oct 28 12:45:25 2013
named_attribute: rewrite_context=remote
sender: barrister_david1@aol.com
named_attribute: encoding=7bit
named_attribute: log_client_name=localhost
named_attribute: log_client_address=127.0.0.1
named_attribute: log_client_port=34531
named_attribute: log_message_origin=localhost[127.0.0.1]
named_attribute: log_helo_name=localhost
named_attribute: log_protocol_name=ESMTP
named_attribute: client_name=localhost
named_attribute: reverse_client_name=localhost
named_attribute: client_address=127.0.0.1
named_attribute: client_port=34531
named_attribute: helo_name=localhost
named_attribute: protocol_name=ESMTP
named_attribute: client_address_type=2
named_attribute: dsn_orig_rcpt=rfc822;cheerfulericlots@yahoo.com
original_recipient: cheerfulericlots@yahoo.com
recipient: cheerfulericlots@yahoo.com
*** MESSAGE CONTENTS deferred/3/38F9D2601BA ***
Received: from localhost (localhost [127.0.0.1])
        by mail.isp.kiev.ua (Postfix) with ESMTP id 38F9D2601BA
        for <cheerfulericlots@yahoo.com>; Mon, 28 Oct 2013 12:45:25 +0200 (EET)
X-Virus-Scanned: Debian amavisd-new at mail.isp.kiev.ua
Received: from mail.isp.kiev.ua ([127.0.0.1])
        by localhost (mail.isp.kiev.ua [127.0.0.1]) (amavisd-new, port 10024)
        with ESMTP id Fojf0F0EbSg5 for <cheerfulericlots@yahoo.com>;
        Mon, 28 Oct 2013 12:45:25 +0200 (EET)
Received: from mail.kiev.ua (kiev.ua [192.168.11.101])
        by mail.isp.kiev.ua (Postfix) with ESMTPA id 1B26A2601AF
        for <cheerfulericlots@yahoo.com>; Mon, 28 Oct 2013 12:45:25 +0200 (EET)
Received: from 41.138.184.224
        (SquirrelMail authenticated user shwarts)
        by mail.isp.kiev.ua with HTTP;
        Mon, 28 Oct 2013 12:45:25 +0200
Message-ID: <5f0f8ef967f18ee826eefee1b7caa209.squirrel@mail.isp.kiev.ua>
Date: Mon, 28 Oct 2013 12:45:25 +0200
Subject:
From: "Barr.David" <barrister_david1@aol.com>
Reply-To: barrister_david1@aol.com
User-Agent: SquirrelMail/1.4.23 [SVN]
MIME-Version: 1.0
Content-Type: text/plain;charset=utf-8
Content-Transfer-Encoding: 8bit
X-Priority: 3 (Normal)
Importance: Normal
To: undisclosed-recipients:;




The Barristers' Chambers:
barrister David Smith & Associates
Email:barrister_david1@aol.com


On behalf of the Trustees and Executor of the estate of Late Eng. Jurgen
Krugger, I once again try to notify you as my earlier letter was returned
undelivered. I hereby attempt to reach you again by this same email
address on the WILL. I wish to notify you that late Jurgen Krugger made
you a beneficiary in his WILL.

He left the sum of Thirty Million, One Hundred Thousand Dollars(US$30,
100,000.00) to you in the Codicil and last testament to his WILL.This may
sound strange and unbelievable to you,but it is real and true.Being a
widely traveled man, he said he met you sometime in the past or simply you
were nominated to him by one of his numerous friends abroad who must have
wished you good(I am not too sure).
According to him, this money is to support your humanitarian/medical
activities and to help the poor and the needy in our society.Please if I
reach you as I am hopeful, endeavor to get back to me as
soon as possible to enable me conclude my job. I hope to hear from you in
no distant time.

I am sincerely sorry if you feel bothered or embarrassed by this message.
Please do contact me on my  personal email address
below:barrister_david1@aol.com
I await your prompt response.
Yours in Service,
Barr David Smith.

*** HEADER EXTRACTED deferred/3/38F9D2601BA ***
named_attribute: encoding=8bit
*** MESSAGE FILE END deferred/3/38F9D2601BA ***