Subject: postfix spam relay problem
To: None <tech-userlevel@NetBSD.ORG>
From: Kent Polk <kent@goathill.org>
List: tech-userlevel
Date: 09/27/2001 00:45:05
I just discovered that my someone has been using my postfix mailer
to deliver spam this afternoon.

Now :
# By default, Postfix relays mail
# - from trusted clients whose IP address matches $mynetworks,
# - from trusted clients matching $relay_domains or subdomains thereof,
# - from untrusted clients to destinations that match $relay_domains
#   or subdomains thereof, except addresses with sender-specified routing.

now I have *none of the relay options* turned on, and I have
specifically listed the ip address of the local hosts that are
allowed to relay using:

mynetworks = ....

the maillist shows:
Sep 26 03:03:17 tiamat postfix/qmgr[369]: AD2EFE9B: from=<f3clzs10g@msn.com>,
size=1833, nrcpt=48 (queue active)
Sep 26 03:03:17 tiamat postfix/qmgr[369]: AC0DE111C: from=<7lpv9jwxe10@msn.com>,
size=1860, nrcpt=48 (queue active)
Sep 26 03:03:17 tiamat postfix/qmgr[369]: AA7EDE78: from=<jrx3@msn.com>,
size=1831, nrcpt=48 (queue active)
Sep 26 03:03:17 tiamat postfix/qmgr[369]: A4E29116B: from=<>, size=6556, nrcpt=1
(queue active)

...

Sep 26 03:04:38 tiamat postfix/smtp[3107]: AD2EFE9B: to=<xxx@dellnet.com>,
relay=none, delay=125045, status=deferred (Name service error for dellnet.com:
Host not found, try again)
...

and ps showed a long list of processes before I shut postfix down:

postfix  7660  0.0  0.2   136   536 ??  S     6:56PM    0:00.00 flush -t unix -u
postfix  7659  0.0  0.2   136   536 ??  S     6:56PM    0:00.01 flush -t unix -u
postfix  7654  0.0  0.2   188   616 ??  S     6:55PM    0:00.01 smtp -t unix -u
postfix  7650  0.0  0.2   152   552 ??  S     6:54PM    0:00.02 bounce -n defer
postfix  7582  0.0  0.2   188   624 ??  I     6:53PM    0:00.01 smtp -t unix -u
postfix  7572  0.0  0.2   196   628 ??  S     6:53PM    0:00.01 smtp -t unix -u
postfix  7515  0.0  0.3   216   656 ??  S     6:51PM    0:00.02 smtp -t unix -u
postfix  7514  0.0  0.3   228   668 ??  S     6:51PM    0:00.03 smtp -t unix -u
postfix  7513  0.0  0.3   212   652 ??  I     6:51PM    0:00.02 smtp -t unix -u
postfix  7512  0.0  0.3   212   652 ??  S     6:51PM    0:00.02 smtp -t unix -u
postfix  7511  0.0  0.3   212   652 ??  S     6:51PM    0:00.02 smtp -t unix -u
...

What else is required to shut down relaying except for the hosts
specified by mynetworks?