Dead.letter growing fast

[republicus]

Code:

Time:    Sat Nov 10 22:24:25 2018 +0100
PID:     1576 (Parent PID:1243)
Account: postfix
Uptime:  89 seconds


Executable:

/usr/libexec/postfix/smtpd


Command Line (often faked in exploits):

smtpd -n smtp -t inet -u -o stress= -s 2


Network connections by the process (if any):

tcp: 0.0.0.0:25 -> 0.0.0.0:0
tcp6: 0.0.0.0:25 -> 0.0.0.0:0

It would appear to me smtpd is trying to make a connection on port 25 to the IP 0.0.0.0 -- which your system is alerting as suspicious.

I think you should look through your configs for any mail settings that may be empty or explicitly set with the IP 0.0.0.0 and correct it.

Did you make changes to postfix configs manually? Maybe configure SSL/TLS with Postfix? If you cannot find the settings in Sentora config, also look there. (Hint: /etc/sentora/configs/postfix/main.csf - "mynetworks" setting)

Have you installed CSF or CSF as a module?
If your email is sending and receiving mail okay and you are unable to locate the problem connection to 0.0.0.0:25 -- you can instruct CSF to ignore this message and prevent it from altering you further while you investigate the cause.

Edit:

Code:

/etc/csf/csf.pignore

Note: The CSF module may place these settings within the Sentora config hierarchy.  You may need to adjust there.  I can't be sure since I do not have this module.


Add line:

Code:

/usr/libexec/postfix/smtpd

Restart CSF service:

Code:

systemctl restart csf