Issue /dev/mapper/vg00-opt /opt/psa 100.00% full

[bradz]

Server operating system version

Ubuntu 20.04.6 LTS

Plesk version and microupdate number

Version 18.0.63 #4

Hi, I have multiple server with
Ubuntu 20.04.6 LTS
Plesk Obsidian
Version 18.0.63
2 did Update #4
One server is now showing
/dev/mapper/vg00-opt /opt/psa 100.00% full (4.6GB)

What can cause this? and how can I fix this?
The hosted websites seem to be working fine,
However, emails are sending with no subject and no from address
Other issues, can not search for extensions AND can not load SSH Support Extension in Plesk nor via Terminal (that is what lead us to look at disk space)
Diagnose & Repair all show fine
Other server show about 50% use on vg00-opt same size about

Any advise / help is greatly appreciated,
Sincerely, Brad

 

[Martin Dias]

Can you post the output of the command

du -sh /opt/psa/*

 

[bradz]

Sorry Martin, by the time I seen this the Ionos/Plesk team had located a 2.6gb mail log browser file. I bet they use the same approach.
They then removed that extension. The server then started to send mail and seems to be back to normal.

The du now shows
681M /opt/psa/admin
124K /opt/psa/bin
27M /opt/psa/bootstrapper
14M /opt/psa/etc
2.6M /opt/psa/handlers
8.0K /opt/psa/libexec
164K /opt/psa/logrotate
680K /opt/psa/pam_plesk_config
63M /opt/psa/phpMyAdmin
1.1M /opt/psa/PMM
4.0K /opt/psa/tmp
655M /opt/psa/var
4.0K /opt/psa/version

Presently the mail queue still shows about 200 emails deferred. Almost all going to a single gmail account that say they were forwarded from a clients email account that uses outlook. They did not add the forward. I now feel that it was a hack and IT will look for it. Maybe that account was discovered and is now closed?

Question, even if this is all true, how could it result in a 2.6gb mail log browser extension file, taking all the of the psa space?
I do run outgoing mail control which sound stop the sending quickly, I am thinking?

Maybe not related? Your thoughts?
Thanks!
Brad

 

[bradz]

Outlook does not seem to show any forward and still I am seeing emails in Queue trying to send to the what we feel is the email set up by the hacker, but that email gives an error, mailbox full.
The Header shows
X-Sieve: Pigeonhole Sieve 0.5.21 (f6cd4b8e)
X-Sieve-Redirected-From: (a specific email on the server)

Is this hack occurring? It seems to match what I am seeing. Is this being looked at?
dovecot / roundcube sieve hack

dovecot / roundcube sieve hack

Hello Friends, as I mentioned in the topic title, I noticed that e-mail was forwarded by somehow accessing it from somewhere (I couldn't find the vulnerability). In short, for example, the e-mail sent to me is sent directly to the forwarded e-mail address and thus the conversations are...

forum.directadmin.com

 

[bradz]

I now think the hacker got the users password, then used webmail to set up a filter to forward all messages. Will be checking webmail for this.