Spam Postmaster

Discussion forum for Enterprise Edition.
Post Reply
Toddy
Posts: 18
Joined: Thu Mar 26, 2015 4:04 pm

Spam Postmaster

Post by Toddy »

Hi,

some of our customer couldn't sent mails to yahoo. the Connection is refused by General failure.
After searching for a reason i found under SMTP -> Queues .> Outbound lots of emails pending to be send from postmaster@...
Postmaster isn't a Mailbox, so how can i avoid sending spam from this postmaster ??

Thanks for every help!!!!

Toddy

Toddy
Posts: 18
Joined: Thu Mar 26, 2015 4:04 pm

Re: Spam Postmaster

Post by Toddy »

Hi again,

just disabled the postmaster Mailbox in order to stop spam going through outquue.
Seems to work ..
But how to find this Mailbox as i didn't create it ..?

MailEnable-Ian
Site Admin
Posts: 9738
Joined: Mon Mar 22, 2004 4:44 am
Location: Melbourne, Victoria, Australia

Re: Spam Postmaster

Post by MailEnable-Ian »

Hi,

Your problems sound like a spammer has compromised a mailbox password and is relaying spam. Please review the following articles to help you troubleshoot further:

http://www.mailenable.com/kb/content/ar ... D=me020339
http://www.mailenable.com/kb/content/ar ... D=me020280
http://www.mailenable.com/kb/content/ar ... D=me020250
Regards,

Ian Margarone
MailEnable Support

web@awhonn.org
Posts: 7
Joined: Thu Nov 29, 2018 4:37 pm

Re: Spam Postmaster

Post by web@awhonn.org »

1. Why is the postmaster mailbox enabled by default? This alone creates a security issue.
2. Secondly, days after installing ME, the postmaster mailbox is compromised. There MUST be a common password used because hackers seem to just get right in.
3. Passwords - appears to be plain text and not encrypted
4. How can we block those ips that are responsible?

Thanks

rfwilliams777
Posts: 1370
Joined: Thu Nov 11, 2004 5:26 pm
Location: Kingsville, Texas

Re: Spam Postmaster

Post by rfwilliams777 »

Almost always and by default you have to have and/or ME creates a postmaster account. Even when you use certain DKIM and whatnot you have to have a postmaster account. It is the email account that kicks back messages saying "message undeliverable" and things like that. In short, it is basically required. Passwords are stored (by default) in an uncrypted way. It isn't that someone compromised the mail server (however, double check that) but rather they have a hashing way to guess what the password is. You can choose the encrypt option for the passwords to be encrypted. Just remember that once you encrypt, you're not recovering the passwords if someone needs it.
As an added precaution, set it up that your server requires authentication in order to send email. This will force anyone who wishes to relay (or abuse) through your server, they must know the username (the email address) and it's respective password.
Robert Williams, Owner
www.WilliamsWebSolutions.com
#1 in MailEnable Business-Class Email Hosting - Switch to Williams Web Solutions and we will migrate your accounts to us for FREE!
We can be hired to help you with your Mail Enable server, too!

Post Reply