Mail Delivery System Errors and Securing/Protecting agains spam

Question

Good morning all.
This morning I started recieving these:
          From:   Mail Delivery System <[email protected]>
          Subject:   [It] Postfix SMTP server: errors from imr-mb02.mx.aol.com[64.12.207.163]
          Date:   November 18, 2011 8:51:23 AM EST
          To:   Postmaster <[email protected]>
Transcript of session follows.
Out: 220 mail.cotaoil.com ESMTP Postfix
In:  EHLO imr-mb02.mx.aol.com
Out: 250-mail.cotaoil.com
Out: 250-PIPELINING
Out: 250-SIZE
Out: 250-VRFY
Out: 250-ETRN
Out: 250-AUTH LOGIN PLAIN CRAM-MD5 GSSAPI
Out: 250-AUTH=LOGIN PLAIN CRAM-MD5 GSSAPI
Out: 250-STARTTLS
Out: 250-ENHANCEDSTATUSCODES
Out: 250-8BITMIME
Out: 250 DSN
In:  MAIL From:<[email protected]> SIZE=3485
Out: 250 2.1.0 Ok
In:  RCPT To:<[email protected]> ORCPT=rfc822;[email protected]
Out: 451 4.3.5 Server configuration error
In:  DATA
Out: 554 5.5.1 Error: no valid recipients
In:  RSET
Out: 250 2.0.0 Ok
In:  QUIT
Out: 221 2.0.0 Bye
How this started:
Over the past couple of days to approx a week, I have seen a massive influx of Spam on our server.  Spam coming in on random ex employee names that no longer work for the company.
Previous to the spam, I turned on "forward un-deliverable mail to" and set to me.  The CEO was missing emails because people were not spelling his name correctly.  I have actually been able tyo catch a lot of employee emails some important, others not.
In trying to make the mail server more secure, one of the features I tried to turn on was SMTP Client Restrictions, Which broke SMTP for my users.  Obviously the error is mine and I need to do more research, but love some feedback on what needs to be set on the server and clients for SMTP client restrictions to work.
I know THE HOFF (mr hoffman) had information at some point to help users secure postfix, can anyone point me in the right direction, as well as any tips here on how to stop the influx of spam?
pstconf -n is here:
alias_maps = hash:/etc/aliases,hash:/var/mailman/data/aliases
biff = no
body_checks = regexp:/etc/postfix/body_checks
broken_sasl_auth_clients = yes
command_directory = /usr/sbin
config_directory = /etc/postfix
content_filter = smtp-amavis:[127.0.0.1]:10024
daemon_directory = /usr/libexec/postfix
debug_peer_level = 2
enable_server_options = yes
header_checks = pcre:/etc/postfix/custom_header_checks
html_directory = /usr/share/doc/postfix/html
inet_interfaces = all
local_recipient_maps =
mail_owner = _postfix
mailbox_size_limit = 0
mailbox_transport = dovecot
mailq_path = /usr/bin/mailq
manpage_directory = /usr/share/man
maps_rbl_domains =
maximal_queue_lifetime = 2d
message_size_limit = 0
mydestination = $myhostname, localhost.$mydomain, localhost, mail.cotaoil.com, cotaoil.com, $mydomain
mydomain = mail.cotaoil.com
mydomain_fallback = localhost
myhostname = mail.cotaoil.com
mynetworks = 127.0.0.0/8,192.1.1.10,192.1.1.11
newaliases_path = /usr/bin/newaliases
owner_request_special = no
queue_directory = /private/var/spool/imap/dovecot/mail
readme_directory = /usr/share/doc/postfix
recipient_delimiter = +
sample_directory = /usr/share/doc/postfix/examples
sendmail_path = /usr/sbin/sendmail
setgid_group = _postdrop
smtp_sasl_password_maps =
smtpd_client_restrictions = permit_mynetworks permit_sasl_authenticated hash:/etc/postfix/smtpdreject cidr:/etc/postfix/smtpdreject.cidr reject_rbl_client zen.spamhaus.org permit
smtpd_enforce_tls = no
smtpd_helo_required = yes
smtpd_helo_restrictions = reject_invalid_helo_hostname reject_non_fqdn_helo_hostname
smtpd_pw_server_security_options = cram-md5,gssapi,login,plain
smtpd_recipient_restrictions = permit_sasl_authenticated  permit_mynetworks   reject_unknown_recipient_domain  reject_unknown_sender_domain  reject_invalid_hostname  reject_unauth_destination check_policy_service unix:private/policy permit
smtpd_sasl_auth_enable = yes
smtpd_tls_CAfile = /etc/certificates/mail.cotaoil.com.8F44026B8E7E908CEDAAD718F486D91C8FCD693E.cha in.pem
smtpd_tls_cert_file = /etc/certificates/mail.cotaoil.com.8F44026B8E7E908CEDAAD718F486D91C8FCD693E.cer t.pem
smtpd_tls_exclude_ciphers = SSLv2, aNULL, ADH, eNULL
smtpd_tls_key_file = /etc/certificates/mail.cotaoil.com.8F44026B8E7E908CEDAAD718F486D91C8FCD693E.key .pem
smtpd_tls_loglevel = 0
smtpd_use_pw_server = yes
smtpd_use_tls = yes
tls_random_source = dev:/dev/urandom
unknown_local_recipient_reject_code = 550
virtual_alias_maps =
mail:~ administrator$

Answer 1

I am not certain what you mean by immediately removing the 192.1.1.10 and 192.1.1.11, AIX servers that I use to relay admin emails to an IT address here.  Some sort of a gateway implemented on a pair of IBM boxes, I might presume. 
192.1.1.0/24 is in a public address space that you don't have assigned (unless you're BBN).  If that IP routing leaks out, then some folks can get cranky.  Or should you eventially need to contact hosts within the address space of the "real" occupants of 192.1.1.0/24, routing won't necessarilt play nice.  There may well be a static IP route here, depending on the details of the router configuration, as otherwise that IP traffic would be going to BBN and not to those servers.  The Internet works because folks play by the rules, when working with IP routing and DNS services.  And if your predecessor used this address space (and not the likely 192.168.0.0/16 block), I'd look around to see if there were other unusual network configuration choices.
TCP port 25 is the server-to-server mail port.  That's the main connection used among mail servers.  Blocking that has the effect that you've discovered.
It's the clients that can also use that port that need to be relocated off the port, as the clients don't have the reverse DNS and related tests that would allow them access to that port, with various common server security configurations.
Open TCP 587 at the firewall and ensure that this port is active at the mail server host, as a starting point.  You can test that with (among other tools) with a remote "telnet your.mail.server.host.name 587" command or similar; that's a primitive (but effective) (common) port test.
With the Apple Mail client, make sure the SMTP server is configured to use the default SMTP ports.  Mail > Preferences > Account > Account Information > Edit SMTP Server > select the target SMTP server > Advanced > select "use the default ports (25, 465, 587)" and consider using SSL and authentication.  (Apple Mail tries a few ports automatically, so the set-up can be different than other clients.)
I don't have enough space here for a full write-up on how mail or IP works, and setting up an arbitrary mail client or an IP network can be an adventure; I assumed the Apple mail client in the above.  See the user collaboration services disscussion of mail services in the Mac OS X Server Advanced Administration manual as some background.  (And if this stuff all looks a little cryptic, that's understandable, and you might want to consider getting some set-up help or consider moving to hosted mail services and making this stuff somebody else's problem.)