Issue Emails being sent from unknown users

[LinuxDash]

Hi,

I'm running Plesk on Ubuntu and have been recently having issues sending out emails to Hotmail addresses.
This is due to my server being added to the Microsoft blacklist. However further inspection shows that mail is being sent from my server from a unknown user.

The logs have not helped much either, I'm getting a lot of connect from unknown. I have added a few IPs to the firewall and this has not helped much.

listen=6, status=5, dbpath='/plesk/passwd.db', chroot=1, unprivileged=1
plesk_saslauthd[25534]: privileges set to (113:121) (effective 113:121)
plesk_saslauthd[25534]: main cycle started
plesk_saslauthd[25534]: main cycle iteration
plesk_saslauthd[25534]: activity on 1 channel(s)
plesk_saslauthd[25534]: new client (fd=10) registered
plesk_saslauthd[25534]: main cycle iteration
plesk_saslauthd[25534]: activity on 1 channel(s)
plesk_saslauthd[25534]: some read activity on client 10
plesk_saslauthd[25534]: read(10, &buf, 2)=2
plesk_saslauthd[25534]: processing client data chunk [state=0]
plesk_saslauthd[25534]: read(10, &buf, 11)=11
plesk_saslauthd[25534]: processing client data chunk [state=1]
plesk_saslauthd[25534]: read(10, &buf, 2)=2
plesk_saslauthd[25534]: processing client data chunk [state=2]
plesk_saslauthd[25534]: read(10, &buf, 12)=12
plesk_saslauthd[25534]: processing client data chunk [state=3]
plesk_saslauthd[25534]: read(10, &buf, 2)=2
plesk_saslauthd[25534]: processing client data chunk [state=4]
plesk_saslauthd[25534]: read(10, &buf, 4)=4
plesk_saslauthd[25534]: processing client data chunk [state=5]
plesk_saslauthd[25534]: read(10, &buf, 2)=2
plesk_saslauthd[25534]: processing client data chunk [state=6]
plesk_saslauthd[25534]: processing client data chunk [state=7]
plesk_saslauthd[25534]: Invalid mail address 'mast@'

I am noticing in the logs, that some of the from fields are empty. from=<>

Any help would be great.

 

[UFHH01]

Hi LinuxDash,

pls. don't forget to set:

smtp_sasl_security_options=noanonymous
smtp_sasl_tls_security_options=noanonymous
smtpd_sasl_security_options=noanonymous
smtpd_sasl_tls_security_options=noanonymous

in your "main.cf", located at "/etc/postfix", if you use SASL - authentification and postfix ( you don't provide enough informations about your server, the used mail-server and it's configuration, for further suggestions! ).


Your provided entries from your mail - log are not unusual, so if you would like further help with investigations, consider to add your configuration files and consider as well to post more from your mail - log to investigate your issue.
Please use as well Fail2Ban, to protect your mail - server against spam-bots and script-kiddies.


Plesk provides as well a KB - article, if you experience issues with spam, send with scripts over your domain(s):

Many email messages are sent from PHP scripts on a server. How to find domains on which these scripts are running if Postfix is used? ( Plesk Knowledge-Base - article 114845/ postfix - usage )​