Hello everyone.
I’m using mailcow since a while and never had any problem, so thanks for the great product!
But since a yesterday, my mailcow instance is sending Spam-Messages to @qq.com addresses. The addresses are “random” numbers, but many of them are going through and are getting delivered.
The problem is that I don’t really understand why.
Here’s an example out of the postfix log:
01/04/2024, 02:19:16 PM info 94F7847D74: client=unknown[172.22.1.1]
01/04/2024, 02:19:17 PM info 94F7847D74: message-id=<id@mydomain.tld>
01/04/2024, 02:19:20 PM info 94F7847D74: from=<address@mydomain.tld>, size=51105, nrcpt=1 (queue active)
01/04/2024, 02:19:20 PM info 94F7847D74: to=<address@targetmail.tld>, relay=none, delay=4.5, delays=4.5/0.01/0/0, dsn=4.4.1, status=deferred (delivery temporarily suspended: connect to mx1.qq.com[162.62.116.184]:25: Connection timed out)
01/04/2024, 02:19:20 PM info disconnect from unknown[172.22.1.1] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5
I can’t really see which specific other log entries are related, but some of these are probably:
01/04/2024, 02:19:14 PM info connect from unknown[172.22.1.1]
01/04/2024, 02:19:14 PM info WHITELISTED [172.22.1.1]:39742
01/04/2024, 02:19:14 PM info CONNECT from [172.22.1.1]:39742 to [172.22.1.253]:25
01/04/2024, 02:19:14 PM info connect from unknown[172.22.1.1]
01/04/2024, 02:19:14 PM info WHITELISTED [172.22.1.1]:39726
01/04/2024, 02:19:14 PM info CONNECT from [172.22.1.1]:39726 to [172.22.1.253]:25
Anonymous TLS connection established from unknown[185.36.81.40]: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
The sending IP Addresses are from Lithuania or Columbia. The sending Accounts/mailboxes do not exist, nor do they exist as alias addresses.
These are my Firewall Rules:
root@mx:~# iptables -S
# Warning: iptables-legacy tables present, use iptables-legacy to see them
-P INPUT ACCEPT
-P FORWARD DROP
-P OUTPUT ACCEPT
-N DOCKER
-N DOCKER-ISOLATION-STAGE-1
-N DOCKER-ISOLATION-STAGE-2
-N DOCKER-USER
-N MAILCOW
-N f2b-sshd
-A INPUT -m comment --comment mailcow -j MAILCOW
-A INPUT -p tcp -m multiport --dports 22 -j f2b-sshd
-A FORWARD -m comment --comment mailcow -j MAILCOW
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A FORWARD -o br-mailcow -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-mailcow -j DOCKER
-A FORWARD -i br-mailcow ! -o br-mailcow -j ACCEPT
-A FORWARD -i br-mailcow -o br-mailcow -j ACCEPT
-A FORWARD -o br-cff850d7011f -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-cff850d7011f -j DOCKER
-A FORWARD -i br-cff850d7011f ! -o br-cff850d7011f -j ACCEPT
-A FORWARD -i br-cff850d7011f -o br-cff850d7011f -j ACCEPT
-A DOCKER -d 172.22.1.7/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 443 -j ACCEPT
-A DOCKER -d 172.22.1.253/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 587 -j ACCEPT
-A DOCKER -d 172.22.1.7/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 80 -j ACCEPT
-A DOCKER -d 172.22.1.10/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 8983 -j ACCEPT
-A DOCKER -d 172.22.1.253/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 465 -j ACCEPT
-A DOCKER -d 172.22.1.250/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 12345 -j ACCEPT
-A DOCKER -d 172.22.1.250/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 4190 -j ACCEPT
-A DOCKER -d 172.22.1.249/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 6379 -j ACCEPT
-A DOCKER -d 172.22.1.13/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 3306 -j ACCEPT
-A DOCKER -d 172.22.1.253/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 25 -j ACCEPT
-A DOCKER -d 172.22.1.250/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 995 -j ACCEPT
-A DOCKER -d 172.22.1.250/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 993 -j ACCEPT
-A DOCKER -d 172.22.1.250/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 143 -j ACCEPT
-A DOCKER -d 172.22.1.250/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 110 -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -i br-mailcow ! -o br-mailcow -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -i br-cff850d7011f ! -o br-cff850d7011f -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o br-mailcow -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o br-cff850d7011f -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
-A DOCKER-USER -j RETURN
-A MAILCOW -s <fail2ban>/32 -j DROP
-A MAILCOW -s <spamsubnet>/24 -j DROP
-A MAILCOW -s <spamsubnet>/24 -j DROP
-A f2b-sshd -s <fail2ban>/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -j RETURN
I reboot the server daily at night, so the iptables settings are always like these at the moment, nothing was changed manually by myself, just 2 bans from fail2ban included + the 2 subnets I mentioned.
I set a rate-limit for now to stop it + I blocked some of the IP ranges over netfilter.
Any ideas how I can fix that? 🙁 I don’t really have a clue at this point. The only thing I could explain is a contact form from a friend that could be used, but that form runs on another server, so the servers IP should be inside the log, which isnt, and also the mailbox doesn’t have alias addresses, so I would guess that it can’t send under other addresses from the same domain?