Controlling outbound spam

AllCore James

New Member
Dec 20, 2018
11
0
1
50
Hello, I am new to PMG, and have recently switched from a 3rd party product... so far, we are very pleased with the change... but we are having a few issues understanding how PMG thinks / does things...

when we check the stastistics >> Domain >> Outgoing reports, one of the largest domain (receiver) is listed as --- Empty Address ---

From our experience with our old product, this would be a big indication of SPAM...

1. Am I correct in reading this report as outgoing spam from our servers through PMG ?
2. IF I am correct, how do we prevent PMG from allowing this to go out to the internet ?
 
Just analyse your email logs via the message tracking center and you will see the details about these messages.
 
i delete postfix queue ... 89888 mail !!!
and finaly go to track center .... how proxmox gateway can send mail when there is not sender ??????
 
Mails with empty senders are also called bounces/NDR/....
They are regularly used from mailservers to inform users that something did not work (e.g. that a remote mailbox did not exist or is over quota, or that a mail did not yet get delivered but is still queued)

If your PMG installation got hijacked and was used for spamming I would guess that also many of those bounce mails got generated by PMG (to inform the fake senders that a mail was rejected)

If a mailbox that was relayed over PMG got hijacked the same could happen.

Cleaning the mailq if you have tons of spam-mails in your system sounds like a good idea.
 
Mails with empty senders are also called bounces/NDR/....
They are regularly used from mailservers to inform users that something did not work (e.g. that a remote mailbox did not exist or is over quota, or that a mail did not yet get delivered but is still queued)

If your PMG installation got hijacked and was used for spamming I would guess that also many of those bounce mails got generated by PMG (to inform the fake senders that a mail was rejected)

If a mailbox that was relayed over PMG got hijacked the same could happen.

Cleaning the mailq if you have tons of spam-mails in your system sounds like a good idea.
yep mails -d ALL was done ...
but i'm blacklisted , now .... :-(((

Who prevent this ?
(trace every sender ?)
 
Who prevent this ?
(trace every sender ?)
The most important question here would be - where did the spammer get access and was able to send mail (via PMG):
* hacked end-user account (in that case you need to change the password of that user - and educate your users on the value of good passwords (and encryption)
* hacked downstream server, which sends via PMG (in that case - change the password of all users on the server, and find out how the attacker got access)
* misconfiguration in PMG (letting the internal port be available from everywhere and having too many ips listed in the trusted networks - in that case fix the config - and do some tests from servers not in your network - to make sure you cannot sent to arbitrary addresses from external IPs)

but i'm blacklisted , now .... :-(((
That is inconvenient, but if you remove the point where the spammer got access you should get delisted in a few days
 
The most important question here would be - where did the spammer get access and was able to send mail (via PMG):
* hacked end-user account (in that case you need to change the password of that user - and educate your users on the value of good passwords (and encryption)
* hacked downstream server, which sends via PMG (in that case - change the password of all users on the server, and find out how the attacker got access)
* misconfiguration in PMG (letting the internal port be available from everywhere and having too many ips listed in the trusted networks - in that case fix the config - and do some tests from servers not in your network - to make sure you cannot sent to arbitrary addresses from external IPs)


That is inconvenient, but if you remove the point where the spammer got access you should get delisted in a few days
hello , and first thank you for your support.
Simple ...
hacker - web - firewall - haproxy - MX

With relaying haproxy submission ... with MX (internal)
openrelay with jump.

This why i answer Proxmox if it will be possible to filter incoming submission on mail gateway too ... ?
 
Simple ...
hacker - web - firewall - haproxy - MX
Did they hack a website under your control? (did you fix that?)
Did they hack your firewall? (did you fix that?)
or was it just the way the hacker sent the mails - e.g. by a unprotected mail-form on a website?( if yes - fix that form)


With relaying haproxy submission ... with MX (internal)
openrelay with jump.
I don't understand what that means?

This why i answer Proxmox if it will be possible to filter incoming submission on mail gateway too ... ?
PMG can scan mails in both directions - just make sure that internal services do use the internal port (default: 26) and that your rule system is configured to scan both directions.

I hope this helps!
 
hello , and first thank you for your support.
Simple ...
hacker - web - firewall - haproxy - MX

With relaying haproxy submission ... with MX (internal)
openrelay with jump.

This why i answer Proxmox if it will be possible to filter incoming submission on mail gateway too ... ?
Yes you can filter outgoing messages
 

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get yours easily in our online shop.

Buy now!