Dead.letter growing fast

[eirsik]

It would appear to me smtpd is trying to make a connection on port 25 to the IP 0.0.0.0 -- which your system is alerting as suspicious.

I think you should look through your configs for any mail settings that may be empty or explicitly set with the IP 0.0.0.0 and correct it.

Did you make changes to postfix configs manually? Maybe configure SSL/TLS with Postfix? If you cannot find the settings in Sentora config, also look there. (Hint: /etc/sentora/configs/postfix/main.csf - "mynetworks" setting)

Have you installed CSF or CSF as a module?
If your email is sending and receiving mail okay and you are unable to locate the problem connection to 0.0.0.0:25 -- you can instruct CSF to ignore this message and prevent it from altering you further while you investigate the cause.

Edit:

Code:

/etc/csf/csf.pignore

Note: The CSF module may place these settings within the Sentora config hierarchy.  You may need to adjust there.  I can't be sure since I do not have this module.


Add line:

Code:

/usr/libexec/postfix/smtpd

Restart CSF service:

Code:

systemctl restart csf

Hi,

In main.cf the only IP specified is the ones under mynetworks:

Code:

mynetworks = 127.0.0.1, 195.201.146.xxx, 176.9.3.xxx

I have modified the main.cf and master.cf to enable SSL on email server. But it has been working fine for months. It suddenly started doing this.
IP 0.0.0.0 is not mentioned anywhere. The closes is 127.0.0.1 which is in master.cf:

Code:

127.0.0.1:10025 inet n  -       y       -       -       smtpd
-o mynetworks=127.0.0.0/8

Yes I have CSF installed. It's a great security addition :-)

---

Is it CSF who is dumping all these log entries into the dead.letter file?