# Piratage boîte mail?

**URL:** <https://forum.yunohost.org/t/piratage-boite-mail/13407>\
**Category:** Support\
**Tags:** mail, french, english\
**Created:** [November 26, 2020, 11:49am UTC](https://forum.yunohost.org/t/piratage-boite-mail/13407 "2020-11-26T11:49:30Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![rodinux](https://forum.yunohost.org/user_avatar/forum.yunohost.org/rodinux/32/7029_2.png) [@rodinux](https://forum.yunohost.org/u/rodinux)\
**Post date:** [November 26, 2020, 11:49am UTC](https://forum.yunohost.org/t/piratage-boite-mail/13407/1 "2020-11-26T11:49:30Z")

</div>

### Mon serveur YunoHost

**Matériel:** Raspberry Pi à la maison /  
**Version de YunoHost:** 4.0.8.2  
**J’ai accès à mon serveur :** En SSH | Par la webadmin  
**Êtes-vous dans un contexte particulier ou avez-vous effectué des modificiations particulières sur votre instance ?** : non

### Mail piraté ?

Bonjour,  
Un soucis avec les mails du serveur Yunohost. Je suis derrière une freebox. Cela fait un moment que l’adresse est blacklistée car le reverse dns de free ne marche pas bien. Depuis peu, des personnes ont reçu des mails de spam avec l’adresse mail du serveur que je n’ai pas envoyé.  
Je viens de changer tous les mots de passe du serveur dans un premier temps pour peut-être sécurisé un éventuel piratage.  
Je suis en cours de demander un VPN chez ARN pour utiliser Client\_VPN par la suite et déblacklister lers mails… Mais en attendant, j’espère ne pas avoir été piraté…

voici des messages de Diagnosis sur les problèmes de DNS pour le mail

```auto
          - Current reverse DNS: XX-XX-XX-XX.subs.proxad.net
Expected value: mydomain.tld
          - You should first try to configure the reverse DNS with mydomain.tld in your internet router interface or your hosting provider interface. (Some hosting provider may require you to send them a support ticket for this).
          - Some providers won't let you configure your reverse DNS (or their feature might be broken...). If you are experiencing issues because of this, consider the following solutions:
 - Some ISP provide the alternative of using a mail server relay though it implies that the relay will be able to spy on your email traffic.
- A privacy-friendly alternative is to use a VPN *with a dedicated public IP* to bypass this kind of limits. See https://yunohost.org/#/vpn_advantage
- Or it's possible to switch to a different provider
        status: ERROR
        summary: The reverse DNS is not correctly configured in IPv4. Some emails may fail to get delivered or may get flagged as spam.
      3: 
        details: 
          - You should first try to configure the reverse DNS with mydomain.tld in your internet router interface or your hosting provider interface. (Some hosting provider may require you to send them a support ticket for this).
          - Some providers won't let you configure your reverse DNS (or their feature might be broken...). If your reverse DNS is correctly configured for IPv4, you can try disabling the use of IPv6 when sending emails by running 'yunohost settings set smtp.allow_ipv6 -v off'. Note: this last solution means that you won't be able to send or receive emails from the few IPv6-only servers out there.
        status: ERROR
        summary: No reverse DNS is defined in IPv6. Some emails may fail to get delivered or may get flagged as spam.
      4: 
        details: 
          - The blacklist reason is: "https://matrix.spfbl.net/XX.XX.XX.XX"
          - After identifying why you are listed and fixed it, feel free to ask for your IP or domaine to be removed on https://spfbl.net/en/dnsbl/
        status: ERROR
        summary: Your IP or domain XX.XX.XX.XX is blacklisted on SPFBL.net RBL
      5: 
        status: WARNING
        summary: Too many pending emails in mail queue (107 emails)

```

```
$ sudo cat /var/log/mail.err
Nov 23 13:40:31 mydomain dovecot: lda(user@mydomain.tld)<21471><lb6cAb+tu1/fUwAAVYPLjw>: Error: sieve: msgid=unspecified: failed to store into mailbox 'Junk': Mailbox doesn't exist: Junk
Nov 23 13:40:31 mydomain dovecot: lda(user@mydomain.tld)<21471><lb6cAb+tu1/fUwAAVYPLjw>: Error: sieve: Execution of script /etc/dovecot/global_script/rspamd.sieve failed, but implicit keep was successful
Nov 23 16:16:38 mydomain dovecot: lda(user@mydomain.tld)<22964><CxOnHVbSu1+0WQAAVYPLjw>: Error: sieve: msgid=<message-10617836-636305828-166100-10040@mail5.wcm-msb.tld>: failed to store into mailbox 'Junk': Mailbox doesn't exist: Junk
Nov 23 16:16:38 mydomain dovecot: lda(user@mydomain.tld)<22964><CxOnHVbSu1+0WQAAVYPLjw>: Error: sieve: Execution of script /etc/dovecot/global_script/rspamd.sieve failed, but implicit keep was successful
Nov 24 15:37:57 mydomain dovecot: lda(user@mydomain.tld)<5325><iJaKAcUavV/NFAAAVYPLjw>: Error: sieve: msgid=<1606228674.ge4toobngmzc2nbqgaztcna@e.infos-actushopping.tld>: failed to store into mailbox 'Junk': Mailbox doesn't exist: Junk
Nov 24 15:37:57 mydomain dovecot: lda(user@mydomain.tld)<5325><iJaKAcUavV/NFAAAVYPLjw>: Error: sieve: Execution of script /etc/dovecot/global_script/rspamd.sieve failed, but implicit keep was successful
Nov 25 11:23:05 mydomain dovecot: lda(user@mydomain.tld)<24501><mRW3Lokwvl+1XwAAVYPLjw>: Error: sieve: msgid=<3003A379DE744E8BABC66BA4676B681E@LenovoPC>: failed to store into mailbox 'Junk': Mailbox doesn't exist: Junk
Nov 25 11:23:05 mydomain dovecot: lda(user@mydomain.tld)<24501><mRW3Lokwvl+1XwAAVYPLjw>: Error: sieve: Execution of script /etc/dovecot/global_script/rspamd.sieve failed, but implicit keep was successful
Nov 26 00:55:08 mydomain dovecot: lda(user@mydomain.tld)<1906><EbY3LNzuvl9yBwAAVYPLjw>: Error: sieve: msgid=<em3d4af818-07fa-4a76-8d50-342968e02a50@alans>: failed to store into mailbox 'Junk': Mailbox doesn't exist: Junk
Nov 26 00:55:08 mydomain dovecot: lda(user@mydomain.tld)<1906><EbY3LNzuvl9yBwAAVYPLjw>: Error: sieve: Execution of script /etc/dovecot/global_script/rspamd.sieve failed, but implicit keep was successful

```

Je ne sais pas où chercher pour savoir si le serveur a pu être piraté… Peut-être fau-t-il chercher avec fail2ban ??

Je précise aussi que tout ceci concerne le serveur d’un ami et que je suis son administrateur…

Voici les messages reçus qui l’inquiète:

> Depuis presque une semaine, je reçois plus d’une cinquantaine de messages comme ci-dessous. Et plusieurs personnes m’ont contacté pour me dire qu’elles avaient reçu un message étrange de ma part. Cela peut il avoir un lien avec mon serveur ?

> This is the mail system at host domain.tld. I’m sorry to have to inform you that your message could not be delivered to one or more recipients. It’s attached below. For further assistance, please send mail to postmaster. If you do so, please include this problem report. You can delete your own text from the attached returned message. The mail system [7653223147@txt.att.net](mailto:7653223147@txt.att.net): host [mx3b.txt.att.net](http://mx3b.txt.att.net)[166.216.152.132] said: 550 5.1.1 [7653223147@txt.att.net](mailto:7653223147@txt.att.net) recipient does not exist here. (in reply to RCPT TO command) [7753796439@txt.att.net](mailto:7753796439@txt.att.net): host [mx3b.txt.att.net](http://mx3b.txt.att.net)[166.216.152.132] said: 550 5.1.1 [7753796439@txt.att.net](mailto:7753796439@txt.att.net) recipient does not exist here. (in reply to RCPT TO command)
> 
> Reporting-MTA: dns; domain.tld X-Postfix-Queue-ID: 5977620D1 X-Postfix-Sender: rfc822; [user@domain.tld](mailto:user@domain.tld) Arrival-Date: Thu, 26 Nov 2020 02:40:45 +0100 (CET) Final-Recipient: rfc822; [7653223147@txt.att.net](mailto:7653223147@txt.att.net) Original-Recipient: [rfc822;7653223147@txt.att.net](mailto:7653223147@txt.att.net) Action: failed Status: 5.1.1 Remote-MTA: dns; [mx3b.txt.att.net](http://mx3b.txt.att.net) Diagnostic-Code: smtp; 550 5.1.1 [7653223147@txt.att.net](mailto:7653223147@txt.att.net) recipient does not exist here. Final-Recipient: rfc822; [7753796439@txt.att.net](mailto:7753796439@txt.att.net) Original-Recipient: [rfc822;7753796439@txt.att.net](mailto:7753796439@txt.att.net) Action: failed Status: 5.1.1 Remote-MTA: dns; [mx3b.txt.att.net](http://mx3b.txt.att.net) Diagnostic-Code: smtp; 550 5.1.1 [7753796439@txt.att.net](mailto:7753796439@txt.att.net) recipient does not exist here.
> 
> .eml
> 
> De :
> 
> ocgscntrc [user@domain.tld](mailto:user@domain.tld)  
> Date :
> 
> 26/11/2020 à 02:40
> 
> Pour :
> 
> [5137877158@vtext.com](mailto:5137877158@vtext.com), [7143143933@usamobility.net](mailto:7143143933@usamobility.net), [7147673656@txt.att.net](mailto:7147673656@txt.att.net), [4708910182@vtext.com](mailto:4708910182@vtext.com), [7757624722@txt.att.net](mailto:7757624722@txt.att.net), [2162193013@vtext.com](mailto:2162193013@vtext.com), [5133353177@vtext.com](mailto:5133353177@vtext.com), [5134979206@vtext.com](mailto:5134979206@vtext.com), [5135435663@vtext.com](mailto:5135435663@vtext.com), [9494669179@txt.att.net](mailto:9494669179@txt.att.net), [7753796439@txt.att.net](mailto:7753796439@txt.att.net), [5626828553@tmomail.net](mailto:5626828553@tmomail.net), [9802419040@vtext.com](mailto:9802419040@vtext.com), [9725338903@txt.att.net](mailto:9725338903@txt.att.net), [7653223147@txt.att.net](mailto:7653223147@txt.att.net), [4074519653@txt.att.net](mailto:4074519653@txt.att.net), [8043896105@vtext.com](mailto:8043896105@vtext.com), [8165203639@vtext.com](mailto:8165203639@vtext.com), [5857640588@txt.att.net](mailto:5857640588@txt.att.net), [4027190733@vtext.com](mailto:4027190733@vtext.com)
> 
> You have received an important announcement regarding your Facebook acc.: [http://rann-ghjyjpyoz.integra-sols.hr](http://rann-ghjyjpyoz.integra-sols.hr)

---

<div class="post-metadata">

**Author:** ![rodinux](https://forum.yunohost.org/user_avatar/forum.yunohost.org/rodinux/32/7029_2.png) [@rodinux](https://forum.yunohost.org/u/rodinux)\
**Post date:** [November 26, 2020, 1:05pm UTC](https://forum.yunohost.org/t/piratage-boite-mail/13407/2 "2020-11-26T13:05:55Z")

</div>

J’ajoute ce constat, en lisant ce topic [My Yunohost hacked / Yunohost piratée](https://forum.yunohost.org/t/my-yunohost-hacked-yunohost-piratee/5055/7) j’ai regardé une quelques suggestions:

D’abord ceci:

```auto
# find /var/spool/postfix/deferred -type f | wc -l
107

```

`# mailq `  
donne ces logs [https://paste.yunohost.org/exawaveval.pl](https://paste.yunohost.org/exawaveval.pl)

Je ne sais pas vraiment ce que veux dire cela ??  
Est-ce une queue d’attente de mails qui n’ont pas été envoyés ??

Ici des logs de `/var/log/auth.log` [https://paste.yunohost.org/suregexoyu.cs](https://paste.yunohost.org/suregexoyu.cs)  
Est-ce que je dois comprendre qu’une personne extérieure essaie de se connecter en root ? J’avoue être inquiet.

---

<div class="post-metadata">

**Author:** ![Aleks](https://forum.yunohost.org/user_avatar/forum.yunohost.org/aleks/32/1704_2.png) [@Aleks](https://forum.yunohost.org/u/Aleks)\
**Post date:** [November 26, 2020, 2:24pm UTC](https://forum.yunohost.org/t/piratage-boite-mail/13407/3 "2020-11-26T14:24:52Z")

</div>

Mouaibon il faut faire attention car dans les logs que tu cites, il y a des choses “normales” (dans auth.log, avoir des tentatives de bruteforce en root, ça arrive sur n’importe quel serveur, c’est pour ça qu’il y a fail2ban et qu’on désactive le login en root par défaut…)

Par contre effectivement, que y’ai pleins de trucs bizarre dans mailq, ça c’est chelou. Pour creuser + à mon avis il faut regarder `tail -n 1000 /var/log/mail.{log,info,err}` (par contre fais gaffe car il peut y’avoir des infos privées là dedans)

---

<div class="post-metadata">

**Author:** ![rodinux](https://forum.yunohost.org/user_avatar/forum.yunohost.org/rodinux/32/7029_2.png) [@rodinux](https://forum.yunohost.org/u/rodinux)\
**Post date:** [November 26, 2020, 2:58pm UTC](https://forum.yunohost.org/t/piratage-boite-mail/13407/4 "2020-11-26T14:58:57Z")

</div>

Ok, j’ai ceci avec cette commande: [https://paste.yunohost.org/uzuqovepuz.vbs](https://paste.yunohost.org/uzuqovepuz.vbs)  
je ne sais pas si ça apporte quelquechose ??

---

<div class="post-metadata">

**Author:** ![rodinux](https://forum.yunohost.org/user_avatar/forum.yunohost.org/rodinux/32/7029_2.png) [@rodinux](https://forum.yunohost.org/u/rodinux)\
**Post date:** [November 26, 2020, 3:08pm UTC](https://forum.yunohost.org/t/piratage-boite-mail/13407/5 "2020-11-26T15:08:53Z")

</div>

Autre chose anormale…  
Dans sa boîte roundcube, il y a plusieurs fichiers. Je sais qu’il utilise Thunderbird comme client local pour regarder ces mails. Je constaste qu’il a deux rangées de fichiers sur son interface Rouncube. Moi aussi j’utilise Roundcube et Thunderbird en local et je n’ai pas cela… Je joint une capture d’écran:

 ![Capture d’écran du 2020-11-26 16-04-53](https://forum.yunohost.org/uploads/default/original/2X/f/febab3b7d5953396eb2c4790e33a156fa981d05b.png)

Je fais cela pour une personne, ce n’est pas pour moi…

---

<div class="post-metadata">

**Author:** ![Aleks](https://forum.yunohost.org/user_avatar/forum.yunohost.org/aleks/32/1704_2.png) [@Aleks](https://forum.yunohost.org/u/Aleks)\
**Post date:** [November 26, 2020, 3:10pm UTC](https://forum.yunohost.org/t/piratage-boite-mail/13407/6 "2020-11-26T15:10:44Z")

</div>

> [@rodinux](#):
>
> Ok, j’ai ceci avec cette commande: [hastebin](https://paste.yunohost.org/uzuqovepuz.vbs)  
> je ne sais pas si ça apporte quelquechose ??

A mon avis il manque des bouts … Tu es sur d’avoir tapé la commande que j’ai mis et d’avoir partagé toute la sortie ? Il devrait y’avoir au moins 1000 lignes … (et pas sur que ça suffise)

---

<div class="post-metadata">

**Author:** ![Aleks](https://forum.yunohost.org/user_avatar/forum.yunohost.org/aleks/32/1704_2.png) [@Aleks](https://forum.yunohost.org/u/Aleks)\
**Post date:** [November 26, 2020, 3:11pm UTC](https://forum.yunohost.org/t/piratage-boite-mail/13407/7 "2020-11-26T15:11:55Z")

</div>

> [@rodinux](#):
>
> Autre chose anormale…

Bon il faut faire gaffe aussi à pas partir en full-paranoia et penser que toutes les choses “anormales” sont liées à une attaque informatique qui n’a pas encore démontrée. En l’occurence là ça ne semble avoir aucun rapport si ce n’est que c’est l’UI du client mail…

---

<div class="post-metadata">

**Author:** ![Kit](https://forum.yunohost.org/user_avatar/forum.yunohost.org/kit/32/1208_2.png) [@Kit](https://forum.yunohost.org/u/Kit)\
**Post date:** [November 26, 2020, 3:15pm UTC](https://forum.yunohost.org/t/piratage-boite-mail/13407/8 "2020-11-26T15:15:38Z")

</div>

Attention avec les screens rodlinux, il y a manifestement l’identité d’une personne (ton ami ?) dans un des dossiers de roundcube.

Pense à anonymiser tes screens d’un coup de paint avant de poster 🙂

---

<div class="post-metadata">

**Author:** ![rodinux](https://forum.yunohost.org/user_avatar/forum.yunohost.org/rodinux/32/7029_2.png) [@rodinux](https://forum.yunohost.org/u/rodinux)\
**Post date:** [November 26, 2020, 3:27pm UTC](https://forum.yunohost.org/t/piratage-boite-mail/13407/9 "2020-11-26T15:27:11Z")

</div>

Ok, bon, ce n’était pas grand chose, mais merci de préciser…

---

<div class="post-metadata">

**Author:** ![rodinux](https://forum.yunohost.org/user_avatar/forum.yunohost.org/rodinux/32/7029_2.png) [@rodinux](https://forum.yunohost.org/u/rodinux)\
**Post date:** [November 26, 2020, 3:50pm UTC](https://forum.yunohost.org/t/piratage-boite-mail/13407/10 "2020-11-26T15:50:30Z")

</div>

> [@Aleks](#):
>
> Tu es sur d’avoir tapé la commande que j’ai mis et d’avoir partagé toute la sortie ?

Heu, oui, peut-être… En fait j’ai du changer des paramètres de mon terminal pour pouvoir aller plus haut dans la sortie… Du coup beaucoup de lignes ici:  
[https://paste.yunohost.org/enikicojiq.scala](https://paste.yunohost.org/enikicojiq.scala)

---

<div class="post-metadata">

**Author:** ![rodinux](https://forum.yunohost.org/user_avatar/forum.yunohost.org/rodinux/32/7029_2.png) [@rodinux](https://forum.yunohost.org/u/rodinux)\
**Post date:** [November 26, 2020, 4:05pm UTC](https://forum.yunohost.org/t/piratage-boite-mail/13407/11 "2020-11-26T16:05:25Z")

</div>

Sinon un détail, peut-être important ?? Au début de l’installation de ce serveur, j’avais édité le fichier /etc/postfix/main.conf avec ces lignes:

```auto
relayhost = smtp.free.fr
compatibility_level = 2

```

Depuis que nous avons fait la migration vers Buster Yunohost 4, il y a de cela environ 2 mois, j’ai fait un regen-conf postfix (et commenter ces lignes en bas pour m’en souvenir). Il me semble que ce ne soit plus la peine d’utiliser ce type de configuration…  
Quoi que je vois des topics récents où est encore utiliser cette méthode. je vais quand même remettre juste la première ligne là où la ligne est vide, `relayhost`

---

<div class="post-metadata">

**Author:** ![Aleks](https://forum.yunohost.org/user_avatar/forum.yunohost.org/aleks/32/1704_2.png) [@Aleks](https://forum.yunohost.org/u/Aleks)\
**Post date:** [November 26, 2020, 4:16pm UTC](https://forum.yunohost.org/t/piratage-boite-mail/13407/12 "2020-11-26T16:16:46Z")

</div>

Est-ce que

`grep -nr "auth=1" /var/log/mail.info*`

retourne des choses ?

---

<div class="post-metadata">

**Author:** ![rodinux](https://forum.yunohost.org/user_avatar/forum.yunohost.org/rodinux/32/7029_2.png) [@rodinux](https://forum.yunohost.org/u/rodinux)\
**Post date:** [November 26, 2020, 4:19pm UTC](https://forum.yunohost.org/t/piratage-boite-mail/13407/13 "2020-11-26T16:19:43Z")

</div>

> [@Aleks](#):
>
> grep -nr “auth=1” /var/log/mail.info\*

Oui: [hastebin](https://paste.yunohost.org/jemomujewe.cs)

---

<div class="post-metadata">

**Author:** ![rodinux](https://forum.yunohost.org/user_avatar/forum.yunohost.org/rodinux/32/7029_2.png) [@rodinux](https://forum.yunohost.org/u/rodinux)\
**Post date:** [November 26, 2020, 4:24pm UTC](https://forum.yunohost.org/t/piratage-boite-mail/13407/14 "2020-11-26T16:24:29Z")

</div>

Je viens d’essayer de remettre la ligne:

```auto
relayhost = smtp.free.fr

```

dans /etc/postfix/main.conf et de redémarrer postfix, du coup je vois une floppée d’erreurs dans la boîte mail…  
MAIL-DEAMON@domain.tld

```auto
This is the mail system at host lucchareyron.com.

I'm sorry to have to inform you that your message could not
be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to postmaster.

If you do so, please include this problem report. You can
delete your own text from the attached returned message.

                   The mail system

<2163755375@txt.att.net>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1
    Spam Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<5038398672@txt.att.net>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1
    Spam Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<5094993646@txt.att.net>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1
    Spam Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<5136808993@txt.att.net>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1
    Spam Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<7026828121@txt.att.net>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1
    Spam Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<7027685990@txt.att.net>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1
    Spam Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<7142734784@txt.att.net>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1
    Spam Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<7143505452@txt.att.net>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1
    Spam Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<7148120147@txt.att.net>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1
    Spam Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<7168661545@txt.att.net>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1
    Spam Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<9186061259@txt.att.net>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1
    Spam Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<2055683608@vtext.com>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1 Spam
    Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<2164104360@vtext.com>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1 Spam
    Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<2165367172@vtext.com>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1 Spam
    Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<2708559801@vtext.com>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1 Spam
    Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<3365809663@vtext.com>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1 Spam
    Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<3367076984@vtext.com>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1 Spam
    Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<4043136083@vtext.com>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1 Spam
    Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<4045614387@vtext.com>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1 Spam
    Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<4192058917@vtext.com>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1 Spam
    Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<4192804726@vtext.com>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1 Spam
    Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<4407598668@vtext.com>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1 Spam
    Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<5106726612@vtext.com>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1 Spam
    Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<5204712048@vtext.com>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1 Spam
    Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<5856837264@vtext.com>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1 Spam
    Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<5858800173@vtext.com>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1 Spam
    Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<6013746906@vtext.com>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1 Spam
    Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<6083459762@vtext.com>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1 Spam
    Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<6304504617@vtext.com>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1 Spam
    Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<7022750009@vtext.com>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1 Spam
    Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<7024496642@vtext.com>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1 Spam
    Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<7145876515@vtext.com>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1 Spam
    Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<8136904058@vtext.com>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1 Spam
    Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<9099575447@vtext.com>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1 Spam
    Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<9196044263@vtext.com>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1 Spam
    Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<9736003606@vtext.com>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1 Spam
    Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)

<9805253195@vtext.com>: host smtp.free.fr[2a01:e0c:1::25] said: 550 5.7.1 Spam
    Detected - Mail Rejected. Please see our policy at:
    http://postmaster.free.fr/#spam_detected (in reply to end of DATA command)
Reporting-MTA: dns; lucchareyron.com
X-Postfix-Queue-ID: 752081C49
X-Postfix-Sender: rfc822; luccourriel@lucchareyron.com
Arrival-Date: Wed, 25 Nov 2020 18:58:35 +0100 (CET)

Final-Recipient: rfc822; 2163755375@txt.att.net
Original-Recipient: rfc822;2163755375@txt.att.net
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 5038398672@txt.att.net
Original-Recipient: rfc822;5038398672@txt.att.net
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 5094993646@txt.att.net
Original-Recipient: rfc822;5094993646@txt.att.net
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 5136808993@txt.att.net
Original-Recipient: rfc822;5136808993@txt.att.net
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 7026828121@txt.att.net
Original-Recipient: rfc822;7026828121@txt.att.net
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 7027685990@txt.att.net
Original-Recipient: rfc822;7027685990@txt.att.net
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 7142734784@txt.att.net
Original-Recipient: rfc822;7142734784@txt.att.net
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 7143505452@txt.att.net
Original-Recipient: rfc822;7143505452@txt.att.net
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 7148120147@txt.att.net
Original-Recipient: rfc822;7148120147@txt.att.net
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 7168661545@txt.att.net
Original-Recipient: rfc822;7168661545@txt.att.net
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 9186061259@txt.att.net
Original-Recipient: rfc822;9186061259@txt.att.net
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 2055683608@vtext.com
Original-Recipient: rfc822;2055683608@vtext.com
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 2164104360@vtext.com
Original-Recipient: rfc822;2164104360@vtext.com
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 2165367172@vtext.com
Original-Recipient: rfc822;2165367172@vtext.com
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 2708559801@vtext.com
Original-Recipient: rfc822;2708559801@vtext.com
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 3365809663@vtext.com
Original-Recipient: rfc822;3365809663@vtext.com
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 3367076984@vtext.com
Original-Recipient: rfc822;3367076984@vtext.com
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 4043136083@vtext.com
Original-Recipient: rfc822;4043136083@vtext.com
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 4045614387@vtext.com
Original-Recipient: rfc822;4045614387@vtext.com
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 4192058917@vtext.com
Original-Recipient: rfc822;4192058917@vtext.com
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 4192804726@vtext.com
Original-Recipient: rfc822;4192804726@vtext.com
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 4407598668@vtext.com
Original-Recipient: rfc822;4407598668@vtext.com
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 5106726612@vtext.com
Original-Recipient: rfc822;5106726612@vtext.com
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 5204712048@vtext.com
Original-Recipient: rfc822;5204712048@vtext.com
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 5856837264@vtext.com
Original-Recipient: rfc822;5856837264@vtext.com
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 5858800173@vtext.com
Original-Recipient: rfc822;5858800173@vtext.com
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 6013746906@vtext.com
Original-Recipient: rfc822;6013746906@vtext.com
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 6083459762@vtext.com
Original-Recipient: rfc822;6083459762@vtext.com
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 6304504617@vtext.com
Original-Recipient: rfc822;6304504617@vtext.com
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 7022750009@vtext.com
Original-Recipient: rfc822;7022750009@vtext.com
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 7024496642@vtext.com
Original-Recipient: rfc822;7024496642@vtext.com
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 7145876515@vtext.com
Original-Recipient: rfc822;7145876515@vtext.com
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 8136904058@vtext.com
Original-Recipient: rfc822;8136904058@vtext.com
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 9099575447@vtext.com
Original-Recipient: rfc822;9099575447@vtext.com
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 9196044263@vtext.com
Original-Recipient: rfc822;9196044263@vtext.com
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 9736003606@vtext.com
Original-Recipient: rfc822;9736003606@vtext.com
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

Final-Recipient: rfc822; 9805253195@vtext.com
Original-Recipient: rfc822;9805253195@vtext.com
Action: failed
Status: 5.7.1
Remote-MTA: dns; smtp.free.fr
Diagnostic-Code: smtp; 550 5.7.1 Spam Detected - Mail Rejected. Please see our
    policy at: http://postmaster.free.fr/#spam_detected

```

Du coup, j’enlève cette ligne et je remet comme avant:

```auto
relayhost =

```

---

<div class="post-metadata">

**Author:** ![Aleks](https://forum.yunohost.org/user_avatar/forum.yunohost.org/aleks/32/1704_2.png) [@Aleks](https://forum.yunohost.org/u/Aleks)\
**Post date:** [November 26, 2020, 4:33pm UTC](https://forum.yunohost.org/t/piratage-boite-mail/13407/15 "2020-11-26T16:33:32Z")

</div>

> [@rodinux](#):
>
> Oui: [hastebin](https://paste.yunohost.org/jemomujewe.cs)

Du coup regardons un peu plus en détails les lignes autour, en rajoutant -C5 :

`sudo grep -nr -C5 "auth=1" /var/log/mail.info*`

---

<div class="post-metadata">

**Author:** ![rodinux](https://forum.yunohost.org/user_avatar/forum.yunohost.org/rodinux/32/7029_2.png) [@rodinux](https://forum.yunohost.org/u/rodinux)\
**Post date:** [November 26, 2020, 4:39pm UTC](https://forum.yunohost.org/t/piratage-boite-mail/13407/16 "2020-11-26T16:39:16Z")

</div>

Ce qui m’inquiète entre autre c’est ce message de Diagnosis:

```auto
3: 
        status: WARNING
        summary: Too many pending emails in mail queue (107 emails)

```

Ce serait des messages qui n’arrivent pas en réception ou à être envoyés ??

---

<div class="post-metadata">

**Author:** ![rodinux](https://forum.yunohost.org/user_avatar/forum.yunohost.org/rodinux/32/7029_2.png) [@rodinux](https://forum.yunohost.org/u/rodinux)\
**Post date:** [November 26, 2020, 4:45pm UTC](https://forum.yunohost.org/t/piratage-boite-mail/13407/17 "2020-11-26T16:45:37Z")

</div>

> [@Aleks](#):
>
> sudo grep -nr -C5 “auth=1” /var/log/mail.info\*

[https://paste.yunohost.org/iqogezipab.scala](https://paste.yunohost.org/iqogezipab.scala)

---

<div class="post-metadata">

**Author:** ![Aleks](https://forum.yunohost.org/user_avatar/forum.yunohost.org/aleks/32/1704_2.png) [@Aleks](https://forum.yunohost.org/u/Aleks)\
**Post date:** [November 26, 2020, 5:03pm UTC](https://forum.yunohost.org/t/piratage-boite-mail/13407/18 "2020-11-26T17:03:46Z")

</div>

Et quand c’est marqué “sasl\_username=user”, c’est toi qui a remplacé le vrai “user” que y’avais avant, ou bien c’est le vrai message original ?

---

<div class="post-metadata">

**Author:** ![rodinux](https://forum.yunohost.org/user_avatar/forum.yunohost.org/rodinux/32/7029_2.png) [@rodinux](https://forum.yunohost.org/u/rodinux)\
**Post date:** [November 26, 2020, 5:07pm UTC](https://forum.yunohost.org/t/piratage-boite-mail/13407/19 "2020-11-26T17:07:48Z")

</div>

oui, j’ai remplacé l’utilisateur…

---

<div class="post-metadata">

**Author:** ![Aleks](https://forum.yunohost.org/user_avatar/forum.yunohost.org/aleks/32/1704_2.png) [@Aleks](https://forum.yunohost.org/u/Aleks)\
**Post date:** [November 26, 2020, 5:17pm UTC](https://forum.yunohost.org/t/piratage-boite-mail/13407/20 "2020-11-26T17:17:02Z")

</div>

Bon beh du coup naivement je vois pas mal d’IP différentes dans le log qui se sont authentifié avec cet utilisateur … Donc perso je pencherais pour un mot de passe pas très sécurisé qui a permis à un attaquant de s’authentifier sur le serveur mail et de l’utiliser comme relai de spam …

Si tu veux voir les IP associées, tu peux faire un

```auto
grep -nr "sasl_username" /var/log/mail.info | grep -E -o "client=\S*" | sort | uniq -c

```

(pas besoin de partager les infos, c’est juste pour toi si tu veux continuer à creuser … mais en regardant 2-3 IP sur [https://www.ip-tracker.org/](https://www.ip-tracker.org/) je vois qu’il y en a en Chine alors bon)

Par contre je vais supprimer les logs que tu as posté sur [paste.yunohost.org](http://paste.yunohost.org) car y’a un peu trop d’infos privées

[Next page](https://forum.yunohost.org/t/piratage-boite-mail/13407.md?page=2)