Long established Postfix / Dovecot environ had to be rebuilt, became an open relay; How do I know fore sure it's fixed, and, if not, fix it fast?

ru flag

Because it's bad form here to ask multiple questions in ONE entry, I'll be asking about specific Postfix and Dovecot entries, however this nightmare has been going on since about January 19 and it's now Feb 10! In the original situation, it took several days to be discovered by the spammers as crackable before we were inundated with their [expletive], and we just THOUGHT we had it fixed, brought it up again, and they cracked it again in about, oh, several hours - not sure exactly.

You can read up on the background here, but the short-short of that is this environ was established circa 1997 and has been using Postfix with Dovecot for nearly that long (it was in the 1990s), and this system was doing fine until when we brought the server up again following what happened on Jan 19, it had become an open mail relay and we didn't know it. So, of course, we took the system down (disabled postfix) and posted that entry just cited.

If you read up on that entry, you can see a lot about the environment and some of where we've been, however, since that was last updated we THOUGHT we had it fixed, BUT, we knew it had taken some time to be found out as an open relay so we are SUPER concerned, and have "watched it like a hawk." ...And so it was I just saw a new mail get through and instantly shut it down again. (Comments on how to promptly do that in the other thread.)

So, while we CONTINUE to work on finding and fixing what's wrong, I'm asking:

How the heck is someone supposed to test these things?

I understand that some who are not "as long in the tooth" are SURE to be unaware and so likely wonder WHY even ask, this was never a problem until the last handful of years. For most of the last two decades, there were dozens of helpful, free websites that would perform then state-of-the-art open relay testing on any server whose IP address or domain name was provided in a box on one of their web pages. Most were good, some were fantastic. I haven't needed this in a LONG time and could find NONE still operational.

Of the two dozen or so sites I used to use two still have a page up about it and one gives you ONE free test run per month (not really useful) and then charges and the other says:

"Mail relay testing

A long time ago we provided a service to check for mail servers that were misconfigured as open relays. But we don't anymore."

As bad, the best CLI tool of which I am aware, nmap, it thinks this site is NOT a an open relay, but, well, the spammers have proven otherwise! Further, when it takes only a few days to perhaps hours or less for them to find your system and harness it, and when you are in a production environment where users need it working, well, the stress is on. And we're not ALL super well funded sites. So this question is entirely valid.

Of course, we have to respect free web sites no longer being free, but DAMN is this hard now, and SURELY someone can share how the cracking is done so we can defend ourselves! THAT'S what this question is about!

OTOH, I'm also reasonably confident that we can, to use a sailor's metaphor, "find the hole and patch it."

OF COURSE, nobody knows when new vulnerabilities might be introduced, or old ones get discovered that were previously unknown. But still, the original question still stands (and there's more room here than in the subject/title):

How do I know with reasonably solid confidence it's not an open relay any longer, and, if not, how do I track it so I/we can fix it fast?

Notably, we hadn't been running tracking (logging) as closely as we might have been, especially with auth, but this time we are (we sure hope) capturing everything that'll help us catch it. And we're about to dig deep into the ONE crack we captured, as soon as this is posted... So, I'm sure there'll be more to say!

P.S. As I began writing I had new configuration details put in postfix and tried restarting it and TWO MORE got through just before I was done reviewing this and hitting "post!" -ack!- OBVIOUSLY "we're doing it wrong!" But that doesn't help much!

ru flag
Whoever gave a downvote, it's rather cowardly to do so without saying WHY! You could do so in a comment and educate / convince me and or others, but NO! Coward!
ru flag
@Rohit Gupta Your first two edits were OK, your third is unnecessary - welcome to a broader understanding of English, it's entirely valid! - and when quoting someone else, you don't change it because you don't like it, especially when it was valid English, too! I don't even understand your / related edit proposals and the Notably part is important - maybe not to YOU, but then, you must speak a very different dialect of English than I do.
in flag

MX Toolbox is still free. Select the option "Test Email Server" in the SuperTool. Some explanations may require an account, but there's no pay wall.

ru flag
Unfortunately, I was correct: MX Toolbox said it was not an open relay - double checked after every single config change (none of which were major) since you pointed it out, and yet overnight two more unauthorized mails got relayed! ACK! Is the system mis-configured or being CRACKED?! Here's a qeustion I wrote on the subject:

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.