Dear Team,
Debian 12
fresh installaiton of hestiacp with below command
sudo bash hst-install.sh --port ‘8083’ --lang ‘en’ --hostname ‘host.abc.com’ --email ‘[email protected]’ --password ‘passwd’ --apache yes --phpfpm yes --multiphp yes --vsftpd no --proftpd yes --named yes --mariadb yes --mysql8 no --postgresql no --exim yes --dovecot yes --sieve yes --clamav yes --spamassassin yes --iptables yes --fail2ban yes --quota yes --api yes --interactive yes --force
I referred given below thread
DID, but issue not resolved.
sed -i “s/$config[‘auto_create_user’] = false;/$config[‘auto_create_user’] = true;/g” /etc/roundcube/config.inc.php
root@host:~# systemctl status exim4
● exim4.service - LSB: exim Mail Transport Agent
Loaded: loaded (/etc/init.d/exim4; generated)
Active: active (running) since Mon 2023-07-31 11:11:19 CEST; 12min ago
root@host:~# systemctl status dovecot
● dovecot.service - Dovecot IMAP/POP3 email server
Loaded: loaded (/lib/systemd/system/dovecot.service; enabled; preset: enabled)
Active: active (running) since Mon 2023-07-31 11:11:15 CEST; 13min ago
root@host:/var/log# tail -n 100 dovecot.log
Jul 31 11:10:02 master: Warning: Killed with signal 15 (by pid=48924 uid=0 code=kill)
Jul 31 11:10:05 log(2718): Warning: Killed with signal 15 (by pid=1 uid=0 code=kill)
Jul 31 11:11:15 master: Info: Dovecot v2.3.19.1 (9b53102964) starting up for imap, pop3, sieve (core dumps disabled)
Jul 31 11:21:57 auth: Info: passwd-file([email protected],147.78.103.77): unknown user
Jul 31 11:22:35 auth: Info: passwd-file([email protected],147.78.103.77): unknown user
Jul 31 11:22:53 auth: Info: passwd-file([email protected],147.78.103.77): unknown user
Jul 31 11:22:53 auth: Info: login(?,147.78.103.77): Empty username
Jul 31 11:23:06 auth: Info: login(?,147.78.103.77): Empty username
Jul 31 11:25:29 auth: Info: login(?,147.78.103.77): Request timed out waiting for client to continue authentication (150 secs)
Please note that in the above log, all 3 usernames specified are non-existent, probably bot attempts
root@host:/var/log/exim4# tail -n 20 mainlog
2023-07-31 11:21:45 TLS error on connection from (win-clj1b0gq6jp.domain) [147.78.103.77] (gnutls_handshake): A packet with illegal or unsupported version was received.
2023-07-31 11:21:45 TLS error on connection from (win-clj1b0gq6jp.domain) [147.78.103.77] (gnutls_handshake): A packet with illegal or unsupported version was received.
2023-07-31 11:21:47 no host name found for IP address 147.78.103.77
2023-07-31 11:21:52 no host name found for IP address 147.78.103.77
2023-07-31 11:21:52 H=(win-clj1b0gq6jp.domain) [147.78.103.77] F=<[email protected]> rejected RCPT <[email protected]>: Rejected because 147.78.103.77 is in a black list at zen.spamhaus.org
2023-07-31 11:21:57 no host name found for IP address 147.78.103.77
2023-07-31 11:21:59 dovecot_login authenticator failed for (win-clj1b0gq6jp.domain) [147.78.103.77]: 535 Incorrect authentication data ([email protected])
2023-07-31 11:22:01 unexpected disconnection while reading SMTP command from (win-clj1b0gq6jp.domain) [147.78.103.77] D=8s
2023-07-31 11:22:04 no host name found for IP address 147.78.103.77
2023-07-31 11:22:34 no host name found for IP address 147.78.103.77
2023-07-31 11:22:37 dovecot_login authenticator failed for (win-clj1b0gq6jp.domain) [147.78.103.77]: 535 Incorrect authentication data ([email protected])
2023-07-31 11:22:48 no host name found for IP address 147.78.103.77
2023-07-31 11:22:53 no host name found for IP address 147.78.103.77
2023-07-31 11:22:55 dovecot_login authenticator failed for (win-clj1b0gq6jp.domain) [147.78.103.77]: 535 Incorrect authentication data
2023-07-31 11:22:55 dovecot_login authenticator failed for (win-clj1b0gq6jp.domain) [147.78.103.77]: 535 Incorrect authentication data ([email protected])
2023-07-31 11:22:59 no host name found for IP address 147.78.103.77
2023-07-31 11:23:07 TLS error on connection from scanner-04.ch1.censys-scanner.com [162.142.125.12] (recv): The TLS connection was non-properly terminated.
2023-07-31 11:23:08 dovecot_login authenticator failed for (win-clj1b0gq6jp.domain) [147.78.103.77]: 535 Incorrect authentication data
2023-07-31 11:27:55 SMTP command timeout on connection from (win-clj1b0gq6jp.domain) [147.78.103.77]
2023-07-31 11:28:07 dovecot_login authenticator failed for (win-clj1b0gq6jp.domain) [147.78.103.77]: 535 Incorrect authentication data
root@host:/var/log/exim4# tail -n 20 rejectlog
2023-07-31 08:36:58 dovecot_login authenticator failed for (User) [45.129.14.31]: 535 Incorrect authentication data ([email protected])
2023-07-31 08:37:16 dovecot_login authenticator failed for (User) [45.129.14.31]: 535 Incorrect authentication data ([email protected])
2023-07-31 08:37:39 dovecot_login authenticator failed for (User) [45.129.14.31]: 535 Incorrect authentication data ([email protected])
2023-07-31 08:47:55 dovecot_login authenticator failed for (User) [45.129.14.31]: 535 Incorrect authentication data ([email protected])
2023-07-31 08:48:12 dovecot_login authenticator failed for (User) [45.129.14.31]: 535 Incorrect authentication data ([email protected])
2023-07-31 08:48:30 dovecot_login authenticator failed for (User) [45.129.14.31]: 535 Incorrect authentication data ([email protected])
2023-07-31 08:48:53 dovecot_login authenticator failed for (User) [45.129.14.31]: 535 Incorrect authentication data ([email protected])
2023-07-31 08:49:17 dovecot_login authenticator failed for (User) [45.129.14.31]: 535 Incorrect authentication data ([email protected])
2023-07-31 08:59:27 dovecot_login authenticator failed for (User) [45.129.14.31]: 535 Incorrect authentication data ([email protected])
2023-07-31 08:59:42 dovecot_login authenticator failed for (User) [45.129.14.31]: 535 Incorrect authentication data ([email protected])
2023-07-31 09:00:01 dovecot_login authenticator failed for (User) [45.129.14.31]: 535 Incorrect authentication data ([email protected])
2023-07-31 09:00:18 dovecot_login authenticator failed for (User) [45.129.14.31]: 535 Incorrect authentication data ([email protected])
2023-07-31 09:00:38 dovecot_login authenticator failed for (User) [45.129.14.31]: 535 Incorrect authentication data ([email protected])
2023-07-31 11:21:52 H=(win-clj1b0gq6jp.domain) [147.78.103.77] F=<[email protected]> rejected RCPT <[email protected]>: Rejected because 147.78.103.77 is in a black list at zen.spamhaus.org
2023-07-31 11:21:59 dovecot_login authenticator failed for (win-clj1b0gq6jp.domain) [147.78.103.77]: 535 Incorrect authentication data ([email protected])
2023-07-31 11:22:37 dovecot_login authenticator failed for (win-clj1b0gq6jp.domain) [147.78.103.77]: 535 Incorrect authentication data ([email protected])
2023-07-31 11:22:55 dovecot_login authenticator failed for (win-clj1b0gq6jp.domain) [147.78.103.77]: 535 Incorrect authentication data
2023-07-31 11:22:55 dovecot_login authenticator failed for (win-clj1b0gq6jp.domain) [147.78.103.77]: 535 Incorrect authentication data ([email protected])
2023-07-31 11:23:08 dovecot_login authenticator failed for (win-clj1b0gq6jp.domain) [147.78.103.77]: 535 Incorrect authentication data
2023-07-31 11:28:07 dovecot_login authenticator failed for (win-clj1b0gq6jp.domain) [147.78.103.77]: 535 Incorrect authentication data
root@host:/var/log/exim4# tail -n 20 /var/log/roundcube/errors.log
tail: cannot open '/var/log/roundcube/errors.log' for reading: No such file or directory
Kindly help resolve.
Thanks in advance