Server exploited sending spam

invaliduser

a few hours a go i got a notification saying my friends mailserver was on a bunch of spam lists, looking into it rspamd was reporting unknown user from 172.22.1.1 was sending emails as and to random domains postfix logs show some ipv6s were trying and failing to use the server as a relay so i assume they also managed to spoof the from which made the server reply back with failed to send emails.

looking though posts/github issue say to set userland-proxy to false in the docker config that has seemed to fix it as my mail queue isn’t filling up anymore I’m wondering why this isn’t disabled by default and if i should be disabling it on my server?

esackbauer

Looks like your friends mailserver is an open relay. Which would not happen if you have the default config of mailcow.
Please test first: https://mxtoolbox.com/diagnostic.aspx
Also we need more information about the setup. IPv6 disabled? You should disable it if you dont use it. There was a problem with IPv6 enabled and open relays, please search the forum.
172.22.1.1 is mailcows internal network, so the user was already authenticated in maybe SOGo?
Usually things like this happen when a users password was compromised.

invaliduser

forums also said that mx tools wont report it as a open relay. i have the default config unless they messed with it and lying to me all i could find were people saying to disable userland-proxy but if this is a known issue then why is the default ipv6 config not got it disabled?

ipv6 is enabled and we do use it as everyone should.

esackbauer forgot to add it cant be a user logged in to SOGo because wouldnt rspamd show the user? and we use SSO and logs only show trusted/known ips

ParkerTFO

I’m the friend.
I very very seldom touch the CLI config unless it’s to update, I personally don’t know what Open Relay does, so I won’t touch it

invaliduser

so i did something stupid i reverted my change and tried to use it as a relay and it failed

nc -nv 2602:<my mail ip> 25
Connection to 2602:<my mail ip>  25 port [tcp/*] succeeded!
220 mail.mailserver.com ESMTP Postcow
HELO testing.com
250 mail.mailserver.com
MAIL FROM:<invaliduser@testing.com>
250 2.1.0 Ok
RCPT TO:<invaliduser@testing.com>
454 4.7.1 <invaliduser@testing.com>: Relay access denied

so im not sure how they managed to send in the first place unless me updating and restarting the containers fixed something?