<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>Short of this person hacking my password (as may be indicated by the second line in the log below and which has since been changed), how did the email below get through my system? I’ve searched my logs and only found this one instance, so I know it’s not happening regularly.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I saw a bounce notification from my ISP in my inbox that a message was identified as spam (rightfully so). Here’s the whole exchange from my logs:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Mar 26 08:18:16 mail postfix/submission/smtpd[25019]: connect from unknown[85.26.199.161]<o:p></o:p></p><p class=MsoNormal>Mar 26 08:18:19 mail postfix/submission/smtpd[25019]: 52AD338A1: client=unknown[85.26.199.161], sasl_method=PLAIN, <a href="mailto:sasl_username=troy@carpenter.cx">sasl_username=troy@carpenter.cx</a><o:p></o:p></p><p class=MsoNormal>Mar 26 08:18:20 mail postfix/cleanup[25025]: 52AD338A1: message-id=<><o:p></o:p></p><p class=MsoNormal>Mar 26 08:18:20 mail postfix/qmgr[1873]: 52AD338A1: from=<<a href="mailto:troy@carpenter.cx">troy@carpenter.cx</a>>, size=1144, nrcpt=1 (queue active)<o:p></o:p></p><p class=MsoNormal>Mar 26 08:18:20 mail postfix/submission/smtpd[25019]: disconnect from unknown[85.26.199.161]<o:p></o:p></p><p class=MsoNormal>Mar 26 08:18:26 mail postfix/smtpd[25029]: connect from localhost.localdomain[127.0.0.1]<o:p></o:p></p><p class=MsoNormal>Mar 26 08:18:26 mail postfix/smtpd[25029]: 187D91264: client=unknown[85.26.199.161]<o:p></o:p></p><p class=MsoNormal>Mar 26 08:18:26 mail postfix/cleanup[25031]: 187D91264: message-id=<><o:p></o:p></p><p class=MsoNormal>Mar 26 08:18:26 mail postfix/smtpd[25029]: disconnect from localhost.localdomain[127.0.0.1]<o:p></o:p></p><p class=MsoNormal>Mar 26 08:18:26 mail postfix/qmgr[1873]: 187D91264: from=<<a href="mailto:troy@carpenter.cx">troy@carpenter.cx</a>>, size=1190, nrcpt=1 (queue active)<o:p></o:p></p><p class=MsoNormal>Mar 26 08:18:26 mail amavis[21033]: (21033-09) Passed CLEAN {RelayedOpenRelay}, [85.26.199.161]:41996 <<a href="mailto:troy@carpenter.cx">troy@carpenter.cx</a>> -> <<a href="mailto:sryqv@drdrb.com">sryqv@drdrb.com</a>>, mail_id: i0nq-5nrG_n6, Hits: 2.221, size: 1144, queued_as: 187D91264, 5814 ms<o:p></o:p></p><p class=MsoNormal>Mar 26 08:18:26 mail postfix/smtp[25026]: 52AD338A1: to=<<a href="mailto:sryqv@drdrb.com">sryqv@drdrb.com</a>>, relay=127.0.0.1[127.0.0.1]:10024, delay=7.3, delays=1.4/0.01/0/5.8, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 187D91264)<o:p></o:p></p><p class=MsoNormal>Mar 26 08:18:26 mail postfix/qmgr[1873]: 52AD338A1: removed<o:p></o:p></p><p class=MsoNormal>Mar 26 08:18:36 mail postfix/smtp[25032]: 187D91264: to=<<a href="mailto:sryqv@drdrb.com">sryqv@drdrb.com</a>>, relay=smtp.charter.net[209.225.8.224]:25, delay=11, delays=0.03/0.01/0.16/11, dsn=5.2.0, status=bounced (host smtp.charter.net[209.225.8.224] said: 550 5.2.0 iCJT1n00J2CZidC05CJTc4 Message identified as SPAM - Please visit <a href="http://www.charter.com/postmaster">http://www.charter.com/postmaster</a> E5110 (in reply to end of DATA command))<o:p></o:p></p><p class=MsoNormal>Mar 26 08:18:36 mail postfix/cleanup[25036]: E5D5838B3: message-id=<<a href="mailto:20140326121836.E5D5838B3@mail.carpenter.cx">20140326121836.E5D5838B3@mail.carpenter.cx</a>><o:p></o:p></p><p class=MsoNormal>Mar 26 08:18:36 mail postfix/bounce[25035]: 187D91264: sender non-delivery notification: E5D5838B3<o:p></o:p></p><p class=MsoNormal>Mar 26 08:18:36 mail postfix/qmgr[1873]: E5D5838B3: from=<>, size=3318, nrcpt=1 (queue active)<o:p></o:p></p><p class=MsoNormal>Mar 26 08:18:36 mail postfix/qmgr[1873]: 187D91264: removed<o:p></o:p></p><p class=MsoNormal>Mar 26 08:18:37 mail lmtpunix[24907]: Delivered: <<a href="mailto:20140326121836.E5D5838B3@mail.carpenter.cx">20140326121836.E5D5838B3@mail.carpenter.cx</a>> to mailbox: carpenter.cx!user.troy<o:p></o:p></p><p class=MsoNormal>Mar 26 08:18:37 mail postfix/lmtp[25038]: E5D5838B3: to=<<a href="mailto:troy@carpenter.cx">troy@carpenter.cx</a>>, relay=mail.carpenter.cx[/var/lib/imap/socket/lmtp], delay=0.12, delays=0.03/0.01/0/0.08, dsn=2.1.5, status=sent (250 2.1.5 Ok SESSIONID=<mail.carpenter.cx-24907-1395836316-1>)<o:p></o:p></p><p class=MsoNormal>Mar 26 08:18:37 mail postfix/qmgr[1873]: E5D5838B3: removed<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Here are some relevant lines from my postfix configs:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>smtp inet n - n - - smtpd<o:p></o:p></p><p class=MsoNormal>2525 inet n - n - - smtpd<o:p></o:p></p><p class=MsoNormal>submission inet n - n - - smtpd<o:p></o:p></p><p class=MsoNormal> -o cleanup_service_name=cleanup_submission<o:p></o:p></p><p class=MsoNormal> -o syslog_name=postfix/submission<o:p></o:p></p><p class=MsoNormal> -o smtpd_tls_security_level=encrypt<o:p></o:p></p><p class=MsoNormal> -o smtpd_sasl_auth_enable=yes<o:p></o:p></p><p class=MsoNormal> -o smtpd_sasl_authenticated_header=yes<o:p></o:p></p><p class=MsoNormal> -o smtpd_client_restrictions=permit_sasl_authenticated,reject<o:p></o:p></p><p class=MsoNormal> -o smtpd_data_restrictions=$submission_data_restrictions<o:p></o:p></p><p class=MsoNormal> -o smtpd_recipient_restrictions=$submission_recipient_restrictions<o:p></o:p></p><p class=MsoNormal> -o smtpd_sender_restrictions=$submission_sender_restrictions<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>smtps inet n - n - - smtpd<o:p></o:p></p><p class=MsoNormal> -o syslog_name=postfix/smtps<o:p></o:p></p><p class=MsoNormal> -o smtpd_tls_wrappermode=yes<o:p></o:p></p><p class=MsoNormal> -o smtpd_sasl_auth_enable=yes<o:p></o:p></p><p class=MsoNormal> -o smtpd_client_restrictions=permit_sasl_authenticated,reject<o:p></o:p></p><p class=MsoNormal> -o milter_macro_daemon_name=ORIGINATING<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>submission_sender_restrictions = reject_non_fqdn_sender, check_policy_service unix:private/submission_policy, permit_sasl_authentica<o:p></o:p></p><p class=MsoNormal>ted, reject<o:p></o:p></p><p class=MsoNormal>submission_recipient_restrictions = check_policy_service unix:private/submission_policy, permit_sasl_authenticated, reject<o:p></o:p></p><p class=MsoNormal>smtpd_recipient_restrictions = permit_mynetworks, <o:p></o:p></p><p class=MsoNormal> permit_sasl_authenticated, <o:p></o:p></p><p class=MsoNormal> reject_unauth_destination,<o:p></o:p></p><p class=MsoNormal> reject_invalid_hostname,<o:p></o:p></p><p class=MsoNormal> reject_unauth_pipelining, <o:p></o:p></p><p class=MsoNormal> reject_non_fqdn_recipient, <o:p></o:p></p><p class=MsoNormal> reject_unknown_recipient_domain, <o:p></o:p></p><p class=MsoNormal> reject_invalid_helo_hostname, <o:p></o:p></p><p class=MsoNormal> check_policy_service unix:private/recipient_policy_incoming, <o:p></o:p></p><p class=MsoNormal> reject_rbl_client zen.spamhaus.org,<o:p></o:p></p><p class=MsoNormal> reject_rbl_client dbsbl.sorbs.net,<o:p></o:p></p><p class=MsoNormal> reject_rbl_client bl.spamcop.net,<o:p></o:p></p><p class=MsoNormal> reject_rbl_client rhsbl.sorbs.net,<o:p></o:p></p><p class=MsoNormal> permit<o:p></o:p></p><p class=MsoNormal>smtpd_sender_restrictions = permit_mynetworks, check_policy_service unix:private/sender_policy_incoming<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I notice that smtpd_recipient_restrictions isn’t mentioned in the master.cf file, however I’ve seen in the logs the reject_rbl_client lines get hit and reject all kinds of email, so I know they are getting used somehow.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Any advice?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Troy Carpenter<o:p></o:p></p></div></body></html>