Hello, I have a droplet hosted on DigitalOcean and received a ticket with a complaint saying my server ip was blocked for sending spam email.
I justed checked the postfix logs and they are over 6 GB in size.
I think someone exploited a flaw or some configuration error on the postfix server, because I changed all the email passwords to very secure ones and I still see spam emails being sent on the server.
Here are some parts of the logs:
Is there maybe a security bug built in Sentora? Is there a way I can secure my server to stop this spam complaints? If you need access to the server or the logs I can give you access.
Thank you
I justed checked the postfix logs and they are over 6 GB in size.
I think someone exploited a flaw or some configuration error on the postfix server, because I changed all the email passwords to very secure ones and I still see spam emails being sent on the server.
Here are some parts of the logs:
Quote:Apr 30 10:49:09 zentora postfix/smtp[10637]: 9F7B2126826: to=<bobreisner@earthlink.net>, relay=mx1.earthlink.net[209.86.93.226]:25, delay=236801, delays=234764/2037/0.29/0.02, dsn=4.0.0, status=SOFTBOUNCE (host mx1.earthlink.net[209.86.93.226] said: 550 IP xx.xx.xx.xx is blocked by EarthLink. Go to earthlink.net/block for details. (in reply to MAIL FROM command))
Quote:Apr 30 10:48:49 zentora postfix/smtp[10286]: 93E7F12FB8C: to=<amandawg@ara.seed.net.tw>, relay=mx.seed.net.tw[139.175.54.239]:25, delay=214822, delays=212804/2016/1.4/0.45, dsn=4.0.0, status=SOFTBOUNCE (host mx.seed.net.tw[139.175.54.239] said: 550 unknown user (in reply to RCPT TO command))
Apr 30 10:48:49 zentora postfix/qmgr[3435]: 6B41513E98B: from=<sec@mydomain.com>, size=4895, nrcpt=1 (queue active)
Is there maybe a security bug built in Sentora? Is there a way I can secure my server to stop this spam complaints? If you need access to the server or the logs I can give you access.
Thank you
