Email failing continuosly

Hi,
I have 2 emails addresses each one related to a website running on a ispconfig install on a vps with ubuntu 16, everything works smooth but since last weeks im having lots of problems with the mail server of ispconfig. im using my gmail account as client to read/send my emails.
Since last weeks looks like im not receiving emails and when i notice it a have lost lots of emails, there are not even on the mail client built in ispconfig. im getting a bit paranoid thinking that someone is getting my emails due to a security break. I have changed my pass few times and when i notice my emails are not working again i change it again.

What do you think guys? how can i check that everything is working as it must be?
Thanks,

 

Check your maillog at /var/log/maillog and see if someone logs in as you from a different IP then where you are at and block that IP.

 

thanks, im taking a look to the log but it looks hard to interpretate. anyway i have a dynamic ip, and im not sure if gmail uses the same ip also.

:\

 

ohhh i just have seen this doing some tests:

Jan 23 19:18:58 vps327633 postfix/smtp[10596]: 070B74240B: to=<[email protected]>, relay=none, delay=0.1, delays=0.07/0.03/0/0, dsn=4.4.1, status=deferred (connect to 127.0.0.1[127.0.0.1]:10026: Connection refused)

I tried to send one email from the ispconfig mail client to my gmail account and that gave me that error.

Any ideas about why is localhost refusing connections from itself??

 

amavisd: no process found



Failed to start amavisd.service: Unit amavisd.service not found.

 

Ok, sorry, i was wrong. I restarted amavis:

Code:

sudo /etc/init.d/amavis restart

then i blocked a ukranian IP which was doiing constant tryings to get into my email. btw the ukranian ip and hostname is one hosted in https://hidehost.net/

then send few emails between my accounts and its working again finally.
Thanks guys

 

Well, email failing again this morning.

I really dont understand what is happening.

 

Hi Till, the first of all, thanks for your support.
My vps have 2GB of ram, is not a big one. I have been taking a look constantly to the mail.log and other logs, looks like someone is attacking my server with a dictionary attack against my email server trying lots of passwords using different email protocols.

I had to block 2 countries today, china and ukraine the attacks were coming from that countries.

Now my emails are working again, i will also did few amavis restarts.

If im wrong and this is not caused by that kind of attacks i will inform you here to see what is going on.

Thanks.

 

Install fail2ban right now and that will start blocking these hackers after 3 failed attempts or whatever you set. Add a nice long bantime like a week and your mail service should be ok.