Everyday I have a notification from my virus scanner that a Virus / Trojan was received from a specific IP:
*************************************************** A virus was found: Trojan.Delf-5385 Banned name: .exe,.exe-ms,postcard.htm ... .exe Scanner detecting a virus: ClamAV-clamd Content type: Virus Internal reference code for the message is 28594-11/qO-PxfSzvjHV First upstream SMTP client IP address: [75.112.128.242] unknown According to a 'Received:' trace, the message apparently originated at: [75.112.128.242], hallmark.com unknown [75.112.128.242] Return-Path: <postca...@hallmark.com> From: postca...@hallmark.com Message-ID: <20100121161108.b572977a...@mail.iamghost.com> Subject: You've received A Hallmark E-Card! The message has been quarantined as: virus-qO-PxfSzvjHV Notification to sender will not be mailed. *************************************************** The email every day is from the same IP to the same recipient on my Postfix server. I have what most of you consider a very small / low traffic Postfix MTA so I was wondering if adding the IP address in /etc/postfix/sender_access is wrong or acceptable to stop receiving mail from this IP. I contacted Brighthouse and realized those are moments of my life I will never get back. Here is what I have in 'sender_access': # Black/Whitelist for senders matching the 'MAIL FROM' field. Examples... 75.112.128.242 REJECT Below is a Postconf -n address_verify_sender = $double_bounce_sender alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases, hash:/etc/mailman/aliases broken_sasl_auth_clients = yes command_directory = /usr/sbin config_directory = /etc/postfix content_filter = amavisfeed:[127.0.0.1]:10024 daemon_directory = /usr/libexec/postfix home_mailbox = Maildir/ html_directory = no inet_interfaces = all mail_owner = postfix mailq_path = /usr/bin/mailq.postfix manpage_directory = /usr/share/man message_size_limit = 20480000 mydestination = $myhostname, $mydomain, mail.$mydomain mydomain = iamghost.com myhostname = mail.iamghost.com mynetworks = $config_directory/mynetworks myorigin = $mydomain newaliases_path = /usr/bin/newaliases.postfix queue_directory = /var/spool/postfix recipient_delimiter = + relay_domains = sendmail_path = /usr/sbin/sendmail.postfix setgid_group = postdrop smtp_tls_security_level = may smtpd_banner = $myhostname ESMTP smtpd_data_restrictions = reject_unauth_pipelining, permit smtpd_delay_reject = yes smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, permit smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_pipelining, reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_unauth_destination, reject_unlisted_recipient, check_policy_service unix:postgrey/socket, check_sender_access hash:/etc/postfix/sender_access, check_helo_access pcre:/etc/postfix/helo_checks.pcre, reject_rbl_client zen.spamhaus.org, reject_rbl_client bl.spamcop.net, permit smtpd_sasl_auth_enable = yes smtpd_sasl_path = private/auth smtpd_sasl_security_options = noanonymous smtpd_sasl_type = dovecot smtpd_sender_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_sender, reject_unknown_sender_domain, reject_unknown_reverse_client_hostname, permit smtpd_tls_auth_only = yes smtpd_tls_cert_file = /etc/ssl/mail.crt smtpd_tls_key_file = /etc/ssl/mail.key smtpd_tls_loglevel = 1 smtpd_tls_security_level = may smtpd_tls_session_cache_database = btree:/var/spool/postfix/smtpd_tls_cache smtpd_tls_session_cache_timeout = 3600s tls_random_source = dev:/dev/urandom unknown_local_recipient_reject_code = 550
