1

I am running a server with Ubuntu 12.04 and three wordpress installations, some ftp server and a basic postfix to send mails with wordpress. additionally I am using webmin to administrate this system.

Now I checked my munin side and saw some major postfix activity.

The queue entries look like this:

-Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient-------
AF9AC11A03D9     2489 Sun Dec 22 04:29:26  [email protected]
(host alt1.gmail-smtp-in.l.google.com[173.194.79.26] said: 450-4.2.1 The user you are trying to contact is receiving mail at a rate that 450-4.2.1 prevents additional messages from being delivered. Please resend your 450-4.2.1 message at a later time. If the user is able to receive mail at that 450-4.2.1 time, your message will be delivered. For more information, please 450 4.2.1 visit http://support.google.com/mail/bin/answer.py?answer=6592 pi8si9408127pac.88 - gsmtp (in reply to RCPT TO command))
                                         [email protected]

passwd files were changed only by myself, no suspoicious logins. We do have ssh with passwords enabled.

I think my system is compromised But I would like to know who is the troublemaker: Wordpress, postfix, or the system itself?

To me it looks like wordpress and some hard mail-function in the php of wordpress.

2 Answers 2

0

Have you checked number of successful deliveries to the recipient from your postfix?

It is possible that the recipient at gmail received too many messages from other sources.

2
  • I don't know the identification of sucesfull deliveries. Nevertheless "[email protected]" is definitely not a user who shall be contacted....
    – Riccardo
    Dec 22, 2013 at 11:29
  • www-data makes php/web server the primary suspect.
    – AnFi
    Dec 22, 2013 at 16:32
0

strange signs, simple explanation: we are using a plugin that asks the commentator of a post to verify his comment. This means: each commentator receives an email. After upgrading wordpress to 3.8 some bots are able to set a comment without answering the needed captcha in the blog post. That means: a lot of comments which results in a lot of mails. We are hoping to get an update for the re-captcha plugin soon.

the queue was filled by emails to heavy-usage gmail spam accounts (the receiver gets to much messages in a given time...)

So it is a result of wanted mail-traffic and no "spamming" from our server seems to be involved.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .