spammers using the mail server to send spam

Hi. Sad man, it's really sad. The proper course of action would be:

-block all the email server ports in the firewall;

-stop the email service - postfix, but you uninstalled it instead;

-maybe do those for apache also as you might have some malware on your website;

--------------------------------------------------------------------------------------------------------------this is what you should do in the first place, even bring down the interface or removing the cable; but mainly stop the suspected services, not panicking and format everything, because you have to figure why and how it happened; you will do it eventually but... Personally I leave things running a bit, and I am trying to understand what's happening.

-now install postfix back & reconfigure your postfix, that's why it's not starting - use the online docs;

-copy your logs and all the data locally to analyze it (BTW can't you restore the VPS from a backup, and also download the whole VPS, for forensics?);

-you shouldn't have deleted postfix and the .conf because maybe it was something wrong with your configuration, IE an open relay; now we can't know that;

-analize your website scripts on the server - in the first phase, just order the files after the date created/modified and the recent ones (not by you) should pop up; maybe your website was hacked (or others hosted) and you have a simple php mailer > delete the suspected files and investigate how did those got there in the first place;

-also maybe they got a username and password and are just using a simple client to send spam via that account;

-after all of this... proceed to request delistings in the RBLs, because everyone knows know that the IP was compromised;

-the end step: you should also reinstall and reconfigure everything - do not suppose that "it's fine" change all the passwords and so on...

-you have to read a lot to mitigate this kind of stuff.

-we need more info anyway...

Howdy,

I'm glad to hear you were able to get Postfix working again!

Are you still seeing spam in your email queue?

You can view the email queue in Webmin -> Servers -> Postfix -> Mail Queue.

If you see spam in your mail queue, can you view the mail headers and then paste those in here? Those mail headers will help track down how those emails are getting there.

-Eric

szer0p tell us what scripts are you using on your VPS aside of Virtualmin/webmin, like wordpress, etc.

I bet the beers I am about to drink out at the pub tonight that a Wordpress instance got hacked. I for myself am keeping away from it, but my users... use it - the last hack on myserver did exactly the same thing, only mine tried to send 25000 emails at once.

It was a weird named file in the plugins directory, uploaded through an older exploit (the website was never updated by it's owner... sigh) and was sending automatically fake emails, from the domain. What was in the file I don't know, it was encrypted; so ClamAV regular scans missed it also - that AV does that, try to use it.

PS (later edit): that looks like a rate limiting message from Google? You can't do anything about those - you are blocked for now, for sending SPAM and it is not up to you if the recipient accepts it or not, that's how email is working. First you have to:

-stop sending by any means necessary;

-see why/how are you sending and correct the problem;

-maybe reinstall if you have been seriously compromised;

-if it's only Wordpress don't worry so much, those things happen on a regular bases; you don't have to reinstall the OS or something, but a clean instance and up to date (do not forget the extensions!) will help for sure;

-only AFTER you solved the problem, try to remove yourself from the blacklists - else you will get right back in!

szer0p probably the main reason why is this happening is your wordpress and outdated (or nulled e.g. pirated) themes/addons. Other reson it could be easy passwords used for your VPS and wordpress. Either way i cant say this is 100% true but the chance is big. Now you have two options, first is to wait and see if spam will come back and then post what Eric was asking you. Second option is to wipe out everything and make clean OS install and not bring back anything from old sites if was not checked before from someone who knows what to do. I hope i'm wrong but in case this continue your host could terminate your account as they have full right to do in case you are the reason for spam or used for ongoing ddos (or any other) attacks. Worst case scenario, spammer(s) manage to compromise your VPS and install some sort of backdoor so whatever you do now with your scripts (including Virtualmin) it will end in the same way, your IP blacklisted and your VPS used for other nasty things.

what if u will not see anything more in the Mail Quete thas mean that spamers are not sending emails anymore ? and the problem is solved ?
i musst now know where is the hackfile on my vps and delete it
If you dont check your VPS you dont know if the problem is solved. Hacker do not need to "use" your VPS right away as he could wait and only later come back and use it for anything he needs.
Usualy how it works:

- you used compromised theme or addon: in this case hacker will get a notification on his server and then proceed when he wants or when he think is good opportunity
- outdated wordpress, theme or addon: automatic scripts scan your site and search for vulnerabilities, once they find it then they notify the hacker
- you used weak passwords: classic bruteforce attacks, once the script found your password it will notify the hacker

Now how "deep" the hacker manage to go we dont know that and probably only one who could tell you this info is sysadmin who could check entire VPS. Even if you delete your themes, addons or even wordpress you cant be sure if server was left intact. Maybe someone have better idea what to do but if we speak how to be sure your VPS is still clean i think no one here can help you with suggestion "what to do" posted on forum.

Howdy,

Hmm, at first glance those don't appear to be spam messages, though I'm not sure what would be generating those -- I don't believe any services installed by default would do that.

Are there any services that were installed onto your system that would ban an IP address? If it's not a service, it could also be a WordPress plugin.

-Eric

Diabolico is right, I said it also - if you are not sure, it is better to re-install everything from scratch, after you figured what the problem was; now, there are more to Linux than a website, and recently there were of wave of serious vulnerabilities (mainly found by Google, after realizing they weren't doing shit for Open Source, just making huge piles of money, after the Heartbleed event, and nowadays they are auditing everything really).

But at least in my case, I don't (and most of the admins) clean install the OS because of a website hack; because if the server is configured correctly, the hacker can't get further than the root of the public_html or if they got an admin password, beyond the root of the domain. It would be a disaster for everyone in web hosting, if you would have to re-install each time the OS due to a website hack, 'cause those happen on a regular bases - that's why we don't use windows :)

Simply put, you can't root (if you configured things ok, and you are up to date with EVERYTHING) a server via a php script, only if you run the web server as username root, you don't use suexec and fcgid, you have modified the permissions to the infamous 777 (the perms really keep a web server going), there are some serious vulnerabilities that you didn't patch, ports opened, so on, for example... It would take a lot of mistakes to make it happen. Most of the hacks go also through social engineering tricking you into giving/entering/sending your passwords.

But (no offense here mate) if you are asking these questions, we can't know for sure, and rather be on the safe side of things - so wait to see what is happening, for now keep the services up and watch them closely, and in the meantime start a new VPS.

szer0p in case everything go wrong or you decide to start again for any reason keep in mind few things:

1. Drop password to log with your SSH/root and instead use the key. There is no reason why you should use password, its less secure and open to bruteforce attacks. When making the keys use strong passphrase using "AZ - az - 09" symbols. If you dont want to think for your password(s) there are many good programs what can do this for you, like PWGen (check sourceforge.net)
2. Change your default SSH port
3. Change Webmin and Usermin default port
4. With iptables open only ports what you need and close everything else
5. Use strong paswords, i would suggest 12+ in length (i use 20). To be sure you will not lockout yourself, open a "secret" gmail account and send to yourself all login details while keeping them on your PC. In case you delete your file with passwords you will be able to recover everything from your mail.
6. If you are hosting only your sites and so no one else need to upload anything, turn off FTP for virtual servers and instead use SFTP with keys (remember no psw for root login). WinSCP is great program for this. Watch out for FileZilla as in the past i saw this software coming with tons of bloatware even from original site, depending what link did you select to download. Btw SFTP is much faster and secure than FTP.
7. Keep wordpress updated and use only addons you really (but really) need not because they look good.
8. Delete all addons and themes you are not using, even the one that originally come with WP.
9. Never, but never use any nulled/hacked/payed-but-free theme or addon. Chance for that script to come with some sort of backdoor or virus is almost 100%.
10. Use any type of captcha for your WP, login, comments, contact.
11. Backup, backup and backup. I cant tell you how much is this important. If for any reason you dont want to pay for extra backup service at least buy 500GB HDD and make weekly (full) backup on your PC. Frankly even if you pay for extra backup, your hosting company or some other, always have one copy with you. Dont trust anyone to keep safe your data not even yourself.

And this is really only small amount of things you could do to keep yourself safe. But it should be enough to keep out most of the scripts and hackers as they will move to easier target.
Just take this example, fresh IP, not used for a long time, never in production on my server... it took less than 7 days to see bruteforce attacks. This suggestions will not make your server or websites 100% safe but at least will give you some protection. I could suggest to install fail2ban, apf, csf and many others but i'm not sure if this would be too much for you (please no offense meant) and you could easily ban yourself.
Or scrap all this, keep only suggestions about wordpress, and go for managed VPS.

Unfortunately, after reviewing the information you provided and in compliance with our mail policies, we are unable to offer immediate mitigation for your deliverability issue. Yeah looks like you are on black list and they will not remove you from there, at least not so soon. I'm only afraid your host could charge you for blacklisted IP or even terminate your account if they start receiving complains. Here are some specific recommendations for you to consider: Brand your mail Ensure mails are cleanly formatted and clearly identifiable as originating from your service. Forgot to mention in my previous post, add SPF, DKIM and rDNS for your domain(s)/IP. Ensure your email lists are up to date Remove those who do not want to receive the emails and consider making the unsubscribe process more visible to ensure you are only delivering mail to interested recipients. If you have any mailing list best would be to have double opt in system and have option on every single mail to opt-out. If all this is too much for you then maybe is better to go back to some good shared hosting and take a small VPS to learn. Never put production sites on VPS if you dont know what are you doing. P.S. VPS with 4GB and 2 cores for 8 EUR (around 9 USD) is just too cheap and i'm afraid in the end you will lose everything (hope i'm wrong). Good place to check for some good hosting and his reputation is webhostingtalk.com. Majority of review sites what you find on google are payed affiliates and do not represent real information. Good luck.