Issue Mail from non-existant user of a local domain

[tkalfaoglu]

Server operating system version

AlmaLinux

Plesk version and microupdate number

Obsidian

Interesting thing.. I'm seeing this in the logs:

Oct 01 16:31:53 storm postfix/smtpd[30855]: disconnect from r31.mail.safisalons.fr[192.243.255.31] ehlo=1 starttls=0/1 commands=1/2
Oct 01 16:32:02 storm postfix/pickup[63938]: 2A76841426BB: uid=10181 from=<ucyildiz@ucyildizltd.com.tr>
Oct 01 16:32:02 storm postfix/cleanup[30875]: 2A76841426BB: message-id=<20221001133202.2A76841426BB@storm.kalfaoglu.net>
Oct 01 16:32:02 storm postfix/qmgr[6297]: 2A76841426BB: from=<ucyildiz@ucyildizltd.com.tr>, size=12360, nrcpt=1 (queue active)
Oct 01 16:32:03 storm postfix/smtp[31440]: 2A76841426BB: to=<lilly2@ziggo.nl>, relay=mxin5.ziggo.nl[212.54.42.8]:25, delay=1.1, delays=0.14/0.01/0.27/0.66, dsn=2.
0.0, status=sent (250 2.0.0 MXIN650 mail accepted for delivery ;id=ecb4oYyqRIVwNecb4offlg;sid=ecb4oYyqRIVwN;mta=mx5.tb;dt=2022-10-01T15:32:03+02:00;ipsrc=176.9.1.
236;)
Oct 01 16:32:03 storm postfix/qmgr[6297]: 2A76841426BB: removed

The domain "ucyildizltd.com.tr" exists and has email service enabled.. But it has NO email addresses defined.. So, the ucyildiz@ucyildizltd.com.tr is NOT a user that exists. So, why is the mail "from" that user is accepted, and how can I prevent it?

Many thanks, -t

 

[IgorG]

Do you have this email in the output of the command:

# postmap -s /var/spool/postfix/plesk/virtual | grep @ucyildizltd.com.tr

?

 

[Michael Gabriel]

strict spf ?
but then again you will not receive many others

 

[Bitpalast]

The first line of your code sample is misleading. It is not part of the transaction. The transaction starts with the second line, the "pickup". This indicates that the mail is transmitted to your local mail server from an authorized system that does not need to login using a user name or password. This is the web server. So what you are seeing there is a website using the PHP mail() function to submit mail to the mail server.

In most cases this is caused by either insecure forms (forms without captchas) that are abused by spambots to send spam. Second comes insecure website scripts that give way to malware or are malware themselves. The best practice is to first secure all website forms with captchas, then check if the problem persists.

 

[tkalfaoglu]

The first line of your code sample is misleading. It is not part of the transaction. The transaction starts with the second line, the "pickup". This indicates that the mail is transmitted to your local mail server from an authorized system that does not need to login using a user name or password. This is the web server. So what you are seeing there is a website using the PHP mail() function to submit mail to the mail server.

In most cases this is caused by either insecure forms (forms without captchas) that are abused by spambots to send spam. Second comes insecure website scripts that give way to malware or are malware themselves. The best practice is to first secure all website forms with captchas, then check if the problem persists.

Wonderful -- many thanks.. I will disable their access to "sendmail" in mail settings. Hopefully this will help. I'll also inspect their web site now..

 

[tkalfaoglu]

Do you have this email in the output of the command:

# postmap -s /var/spool/postfix/plesk/virtual | grep @ucyildizltd.com.tr

?

Thanks.. nope, nothing there..