Question Spamming from localhost in plesk

[Suhesh]

We have noticed spamming form the server ( from localhost ) following is the log for the same. [replaced domain name and some other modification]

Jun 25 19:34:41 server1 postfix/smtpd[7198]: 34B9A38049C: client=localhost[127.0.0.1]
Jun 25 19:34:41 server1 postfix/cleanup[9895]: 34B9A38049C: message-id=<[email protected]>
Jun 25 19:34:42 server1 postfix/qmgr[20618]: 34B9A38049C: from=<[email protected]>, size=1316, nrcpt=1 (queue active)​

Googling shows that, it is something like sending spam using ssh tunneling. Is there any way to identify the culprit account, which is sending the spam mails.

ssh log and postfix logs are not giving any idea about the source.

 

[UFHH01]

Hi Suhesh,

unfortunately, you don't provide much informations, so that investigations would be rather guessing.
Pls. make sure, that you incl. as well your operating system, your depending configuration files for your mail - server in use and it is never wrong to inlude as well your Plesk version ( incl. MU ).

Plesk for Linux services logs and configuration files ( KB - article: 111 283 )​

 

[Suhesh]

Following are the os,plesk version details.

CentOS release 6.8 (Final)
Plesk Version : 12.5.30 CentOS 6 1205160608.10
Micro Update installed : #37

Postfix logs are not that much user friendly, so we cannot get more information from it. Googling showing the symptoms are like "sending spam using ssh tunneling." But I cannot find the exact account causing the issue. Is this any vulnerability in plesk ?

Mails are sending from localhost using the accounts in the server, something like "[email protected]". Anyone facing this type of situation and how can we fix this permanently.

 

[UFHH01]

Hi Suhesh,

( again a guessing, because of missing informations about your configuration files ): Be sure to disallow anonymous SASL connections and forbid unauthorized connections in your configuration.

 

[lvalics]

You can disallow in firewall SSH and open it only for your IP. Then you can try to disallow sending emails from script 9in PLESK, but dunno if will work). Also you can check /var/log/messages and/var/log/secure to have any clue. Then you can try to see access_logs which one is stressed more, where you can find some POST things which is not OK. This is some things what I usually do, but we do not have enough information (as @UFHH01 mentioned) so hard to help you more.