root email - security

[Qtech]

Hi I have been trying to secure my server down.

I am now getting this from root@domain.com
Has anyone encountered an issue like this.
thanks.


Time:    Tue Apr  4 23:42:23 2017 -0700
PID:     3046 (Parent PID:2542)
Account: postfix
Uptime:  112 seconds


Executable:

/usr/libexec/postfix/smtpd


Command Line (often faked in exploits):

smtpd -n 127.0.0.1:10025 -t inet -u -c -o content_filter= -o smtpd_helo_restrictions= -o smtpd_sender_restrictions= -o smtpd_recipient_restrictions=permit_mynetworks,reject -o mynetworks=127.0.0.0/8 -o smtpd_error_sleep_time=0 -o smtpd_soft_error_limit=1001 -o smtpd_hard_error_limit=1000 -o receive_override_options=no_header_body_checks -o smtpd_helo_required=no -o smtpd_client_restrictions= -o smtpd_restriction_classes= -o disable_vrfy_command=no -o strict_rfc821_envelopes=yes


Network connections by the process (if any):

tcp: 127.0.0.1:10025 -> 0.0.0.0:0
tcp: 127.0.0.1:10025 -> 127.0.0.1:53888


Files open by the process (if any):

/dev/null
/dev/null
/dev/null
/var/spool/postfix/pid/inet.127.0.0.1:10025
anon_inode:[eventpoll]
/etc/aliases.db
/etc/aliases.db

[Me.B]

nope but you might google it.

[TGates]

I have not seen this before either.

[Qtech]

These messages were sent out by sentora because of CSF firewall. Removed it and alerts were gone. Still don't understand the messages.