Eu recomendo que você visite os sites da CBL e Spamhuas novamente, porque eles têm todas as informações que você precisa para começar a solução de problemas e proteger seu servidor. As informações lá podem ajudá-lo a entender como funciona o processo de blacklisting e por que alguém é listado e também conselhos sobre como manter o servidor seguro para evitar blaklisting.
Vou apenas citar algumas partes importantes da CBL, o resto você pode verificar por si mesmo. O ponto é, desde que você está sendo listado novamente e novamente, seu servidor é provavelmente comprometido e não está relacionado ao seu postfix. Agora você precisa investigar e descobrir a possível causa . Pode ser um rootkit ou um trojan ou spambot ou apenas outro script malicioso. Você precisa fazer uma varredura completa do seu sistema para possíveis problemas. Depois de encontrar a causa real, você poderá resolver o problema e tomar as medidas necessárias para evitar que isso aconteça novamente.
Aqui é da CBL:
What is the CBL?
The CBL takes its source data from very large mail server (SMTP) installations. Some of these are pure spamtrap servers, and some are not.
The CBL only lists IPs exhibiting characteristics which are specific to open proxies of various sorts (HTTP, socks, AnalogX, wingate, Bagle call-back proxies etc) and dedicated Spam BOTs (such as Cutwail, Rustock, Lethic, Kelihos etc) which have been abused to send spam, worms/viruses that do their own direct mail transmission, or some types of trojan-horse or "stealth" spamware, dictionary mail harvesters etc.
I'm running Linux (FreeBSD, OpenBSD, UNIX...) and CANNOT be infected with a virus!
While it is perfectly true that UNIX-like operating systems are almost NEVER infectable with Windows viruses, there are a number of virus-like things that UNIX-like systems are susceptible to. For example:
- Windows emulation software (eg: VMWARE or Wine) are just as susceptable to infection as native Windows. In fact, it's probably somewhat more likely that an emulator instance of Windows gets infected, because the fact that it's running under another O/S can lead to a false sense of security, and emulator instances are less likely to be protected with a full anti-virus suite.
- Open proxies (eg: insecure Squid configurations) leading to open proxy spamming.
- Web server vulnerabilities or compromises. For example, the DarkMailer/DirectMailer trojan is injected via FTP (using compromised user's userid/passwords) onto web servers, and thereupon is used to send very larger volumes of spam. Virtually all web servers are susceptible to this if they permit upload of content from the Internet.
- Application vulnerabilities: many applications have security vulnerabilities, particularly those associated with PHP on web servers. Eg: older versions of Wordpress, PHPNuke, Mamba etc. Some of these vulnerabilities are to the extent that a malefactor can install a full proxy/trojan spamming engine on your machine and control it remotely. Through this, they can set up spamming engines, open proxies, malware download and spam redirectors. Watch out for strange directories being created, particularly those starting with a "." in /tmp. Check for this by doing an "ls -la" in /tmp, and look for directory names starting with "." (other than "." and ".." themselves).
Para solução de problemas e proteção
It is CRITICALLY IMPORTANT that all web-facing applications or application infrastructures (Wordpress, Joomla, Cpanel, etc. etc.) are kept fully patched and up-to-date. Furthmore, userid/passwords and other credentials for logging into such systems should be highly protected, require strong passwords and changed as frequently as practical/feasible.
Such sites should consider continous monitoring of web, ftp and other subsystems.
Rootkits are where a malicious entity has installed software on your machine and buried it in such a way that the normal system utilities cannot find it. In some cases they replace the normal system utilities with hacked versions that won't show their tracks.
Check that you have good remote login-capable passwords (eg: telnet, FTP, SSH), inspect your logs for large quantities of failed/SSH/telnet login attempts.
Consider running a "system modification" detector such as Tripwire or rkhunter. Tripwire is designed to detect and report modification to important system programs. Rkhunter does what Tripwire does, but looks for specific rootkits, insecure versions of system software and more. Not all viruses are windows binaries. Some viruses/worms are in application-level files using non-binary programming techniques (such as macro viruses, Java, PHP or Perl). These can be truly infectious cross-platform.
Mais sobre MailServer na CBL: Servidor de e-mail no CBL
De Spamhuas:
O que é o "sequestro de proxy"? O que preciso saber sobre proxies?
O que é um "honeypot" ou "proxypot"? O que é um "proxy hijack source" ou "C & C"?