I have a mail server hosted with amazon aws.
I setup the server on Ubuntu 14.04 with postfix & dovecot.
I keep getting emails from mail delivery system saying mails are returned to sender that I did not send.
I have 2fa setup on my domain provider and my ec2 server and to log in I only have ssh port configured to be open to a specific IP. Also I have key based log-in setup as well so only the owner of the key can access the server while being registered at a specific IP and logging in with only 1 username that isn't as standard one.
Looking at my syslog I have taken out a small section that concerns me
Dec 7 21:25:16 ip-myip postfix/smtpd[14438]: Anonymous TLS connection established from dazzle.jagoanhosting.com[103.27.206.196]: TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)
Dec 7 21:25:17 ip-myip postfix/smtp[14490]: connect to mx1.comcast.net[96.114.157.80]:25: Connection timed out
Dec 7 21:25:17 ip-ip-myip postfix/smtp[14490]: connect to mx1.comcast.net[2001:558:fe16:1b::15]:25: Network is unreachable
Dec 7 21:25:18 ip-ip-myip postfix/smtpd[14438]: 0E5EB2614C: client=dazzle.jagoanhosting.com[103.27.206.196], sasl_method=LOGIN, [email protected]
Dec 7 21:25:18 ip-ip-myip postfix/cleanup[14441]: 0E5EB2614C: message-id=<[email protected]>
Dec 7 21:25:18 ip-ip-myip postfix/qmgr[1176]: 0E5EB2614C: from=<[email protected]>, size=1734, nrcpt=1 (queue active)
Dec 7 21:25:19 ip-ip-myip postfix/smtpd[14438]: disconnect from dazzle.jagoanhosting.com[103.27.206.196]
Dec 7 21:25:22 ip-ip-myip postfix/smtp[14444]: connect to mta7.am0.yahoodns.net[98.136.216.25]:25: Connection timed out
Dec 7 21:25:22 ip-ip-myip postfix/smtp[14444]: 443D526141: to=<[email protected]>, relay=none, delay=151, delays=0.68/0/150/0, dsn=4.4.1, status=deferred (connect to mta7.am0.yahoodns.net[98.136.216.25]:25: Connection timed out)
Like I said that is a small section and there is loads of lines just like that
The thing that confused me first that all the returned emails I got referenced email addresses that I had received mail from at some point and I cannot believe that that is a coincidence.
I am wondering if there is anyone that can help me figure out the issue or at least point me in the right direction
Update..
The last returned mail I have says
From:
Mail Delivery System [email protected]
To:
[email protected]
Subject:
Mail delivery failed: returning message to sender
Body:
This message was created automatically by mail delivery software.
A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:
[email protected]
Domain larsa.nl has exceeded the max defers and failures per hour (5/5 (100%)) allowed. Message discarded.
[email protected]
Domain larsa.nl has exceeded the max defers and failures per hour (5/5 (100%)) allowed. Message discarded.
[email protected]
Domain larsa.nl has exceeded the max defers and failures per hour (5/5 (100%)) allowed. Message discarded.
[email protected]
Domain larsa.nl has exceeded the max defers and failures per hour (5/5 (100%)) allowed. Message discarded.
[email protected]
Domain larsa.nl has exceeded the max defers and failures per hour (5/5 (100%)) allowed. Message discarded.
Now from the from address that would assume to me that nothing is wrong and the mail isn't actually being sent from my server but the addresses that have been mailed are pretty specific to mail addresses I would have received from. It is pretty random that someone would be able to guess at least 4 of them addresses at random
EDIT 2
I just checked postqueue -p and returned this. I've only included the ones from the last day but there is loads there
ECE6A2EBD6 1449 Sun Dec 11 17:16:39 [email protected]
(connect to mx.ono.com[62.42.230.22]:25: Connection timed out)
[email protected]
E9A7E2CDBC 1625 Sun Dec 11 04:40:35 [email protected]
(connect to mx01.1and1.es[217.72.192.67]:25: Connection timed out)
[email protected]
EE2532CF3A 1604 Sun Dec 11 00:00:10 [email protected]
(delivery temporarily suspended: connect to mx3.hotmail.com[65.55.37.104]:25: Connection timed out)
[email protected]
EE15D2C1B6 1474 Sat Dec 10 02:57:23 [email protected]
(delivery temporarily suspended: connect to mx3.hotmail.com[104.44.194.235]:25: Connection timed out)
[email protected]
-- 67941 Kbytes in 27611 Requests.
Could this be actual emails being sent from my server?
I have deleted all mail from the mail queue using postsuper -d ALL
Thank you
