There is a CWP server vulnerability. Please help me.

Mail is being sent from my domain name against my request on my CWP server.HELP

Please help URGENTLY.
Log records as follows:
helo=87-207-170-128.dynamic.chello.pl, from=qdzftt632@xxx.com.tr, to=qdzftt632@xxx.com.tr,

The domain mentioned here is mine, but I do not have such mails. Spam is constantly being sent.

_dmarc   14400   IN   TXT   "v=DMARC1; p=reject"
@   14400   IN   TXT   "v=spf1 +a +mx +ip4:xxxxxxx ip4:xxxxxxx -all"

also it is not possible for them to steal any password from me.

Well, yes there was a vulnerability. But if you have updated to 0.9.8.1148 or newer (we are 2 updates past the vulnerable version), you should be safe. But it sounds as if your Postfix installation is not sufficiently hardened, and perhaps CSF/LDF is not doing all it can do for you. Also, consider installing Mod_Security with the Comodo ruleset.
 

Please help me.

from=ferdinand@khe.com, to=ferdinand@khe.com,

They attacked my server again today. The domain khe.com exists, but the mails are not available. It keeps the server busy. What is your recommendation?

Mail Log:
Aug 3 21:32:42 ns85 cbpolicyd[3094]: module=Quotas, action=defer, host=185.208.23.255, helo=255.23.208.185.dynamic.electronicamartinez.es, from=ferdinand@khe.com, to=ferdinand@khe.com, reason=quota_match, policy=9, quota=6, limit=7, track=Sender:@khe.com, counter=MessageCount, quota=51.66/50 (103.3%)

VER: CWP version: 0.9.8.1164

Have you hardened your Postfix installation, as I recommended before? Are you making use of postscreen?
https://www.awsmonster.com/how-to-secure-postfixdovecot-on-cwp

Are you making full use of CSF and LFD?

Add to Posfix main.cf:

Code: [Select]

##//delivery rate controls/restrictions
# Parrallel delivery force (local=2 and dest=20 are aggressive)
local_destination_concurrency_limit = 6
default_destination_concurrency_limit = 30
# Max flow rate (1 sec delay per 50 emails/sec over the number of emails delivered/sec)
in_flow_delay = 1s
# Tarpit those bots/clients/spammers who send errors or scan for accounts
smtpd_error_sleep_time = 10s 
smtpd_soft_error_limit = 5
smtpd_hard_error_limit = 10
# limit max sends per minute
anvil_rate_time_unit = 60s
smtpd_client_event_limit_exceptions = $mynetworks
smtpd_client_recipient_rate_limit = 30
smtpd_client_message_rate_limit = 30

Thank you for your useful suggestions.
I am using firewall. I also add manual thread but there are many different threads. impossible to reach.
I entered the lines you wrote aggressively to the Main conf settings.
But the bombardment continues.
The interesting thing is that he sends the mail inside, not outside.
How do I restrict the domain from sending mail to itself?

My mail server looks like a caravanserai.

Aug 7 20:49:08 ns85 cbpolicyd[20875]: module=Quotas, mode=update, host=35.190.144.99, helo=ytvzrldycp, from=erkakxnzbd@yahoo.com, to=dsfhgsdfsds@outlook.com, reason=quota_update, policy=9, quota=6, limit=7, track=Sender:@yahoo.com, counter=MessageCount, quota=1.00/50 (2.0%)

Maybe in the other thread you should just post your whole main.cf and master.cf so we can take a look and offer suggestions. Have you followed the AWS Monster guide to hardening Postfix with CWP? Are you running SpamAssassin?

It could be a rouge script also.

Make sure you follow:
https://www.alphagnu.com/topic/43-disable-php-mail-function-in-cwp-%E2%80%93-control-webpanel/

Head slap -- yes, I forget about to mention that one because I have php mailer functionality disabled on all my servers as a matter of course during setup. To me it's lazy coding and from a bygone era to rely on the convenience but total lack of accountability and compartmentalization with the php mail function. I require all clients to create a dedicated outbound SMTP user which they can then plug in those authentication details into whatever CMS or contact form requires outbound mail sending. So then you have accountability and proper logging, as well as proper postscreen controls and rate limits in place with Postfix.

Thank you Starburst and overseer. If the php mail function is left on, mail can be sent from non-existent mailboxes. very logical. I edited the php.ini file as follows.

PHP.INI

[mail function]
; For Win32 only.
SMTP = localhost
smtp_port = 25

When I delete them, sending mail via php will stop. Of course after reboot. In addition, PhpMailer script is necessary because it can send via smtp in website contact forms. I hope this method prevents mass spam output from accounts not on my server.