Is it bad that I have just finished applying 1903 to my machines?

https://www.freepbx.org/freepbx-15-is-released/

Anyone ballsy enough to upgrade?

Well, it looks that it is actually FreePBX as part of the problem again with some stupid cron jobs.

And there is an issues with Moodle but I think that is more of an authentication issue and not actually a spam issue.

@scottalanmiller said in How can I tell if one of our linux boxes is a spam generator?:

@WLS-ITGuy said in How can I tell if one of our linux boxes is a spam generator?:

@scottalanmiller said in How can I tell if one of our linux boxes is a spam generator?:

Do you have a specific Linux box to check? Or is this a pool of many and you are wondering if "any of them" is compromised?

Single box. It is our Moodle Server which sends email through class discussions.

Oh, that makes it much harder. You are looking for a compromise inside an existing email stream!

That's what I thought.

Email is passed from the Moodle server, to the exchange box, and then to our spam filter. Both incoming and outgoing emails are going through the spam filter.

@scottalanmiller said in How can I tell if one of our linux boxes is a spam generator?:

Do you have a specific Linux box to check? Or is this a pool of many and you are wondering if "any of them" is compromised?

Single box. It is our Moodle Server which sends email through class discussions.

I have all our mail going through our Spam filter. In the last 24 hours our OutgoingQueue has hit over 400. All of them are no names on sender and receiver. How do I check if a linux box has been compromised. I cannot turn it off at this point.

@Emad-R said in UFW rules question:

@WLS-ITGuy

Ok you dont need to make any deny rules, cause by default this is working. Just put the stuff you wish to make exceoption and allow

Then this should be good?

@Emad-R said in UFW rules question:

@WLS-ITGuy

ufw status verbose

will help you more, cause it will show the default incoming and outgoing rule

I see that I have to delete the 1st entry.

I am trying to troubleshoot some weird access on one of our webhosts. I only want 80 and 443 accessible from anywhere, I'd like 587 to be only pointing to our mail server IP, and only want SSH to be allowed from our WAN IP. Am I missing anything?