0

I need your help.

My postfix is sending spam mails.

I checked my main.cf and it should be fine. In the following a snippet of my mail.log

Jan  3 22:35:41 mail postfix/pickup[104179]: 866352963F01: uid=33 from=<[email protected]>
Jan  3 22:35:41 mail postfix/cleanup[104027]: 866352963F01: message-id=<[email protected]>
Jan  3 22:35:41 mail opendkim[3895]: 866352963F01: DKIM-Signature field added (s=key1, d=mydomain.net)
Jan  3 22:35:41 mail postfix/qmgr[27451]: 866352963F01: from=<[email protected]>, size=6867, nrcpt=1 (queue active)

Any clue what happen?

Thanks in advance!

Mike
  • 1
  • 2
    The user with uid 33 sent the mail. Look to see which user that is. My money is on the web user `www-data`, which would mean your web site was compromised. – Michael Hampton Jan 06 '21 at 20:55
  • 1
    I wouldn't jump into the conclusion the server is compromised. A simple web application vulnerability could enable anyone to send email without giving possibilities for persistent access. There could be e.g. PHP `mail()` function that allows setting arbitrary recipients. – Esa Jokinen Jan 07 '21 at 04:27

0 Answers0