I just received an email that corresponds to the description here, which was posted just a couple of hours ago:
Since the sender was was
firstname.lastname@example.org, might someone have logged into my Ubuntu server, or was the email simply sent to the email service on my server, in which case it's just spam.
I couldn't find any evidence of unknown logins using
last or in
syslog, but there are an insane amount of these in
postfix/smtpd: connect from jackofallthreads.co[22.214.171.124] postfix/smtpd: lost connection after UNKNOWN from jackofallthreads.co[126.96.36.199] postfix/smtpd: disconnect from jackofallthreads.co[188.8.131.52]
SSH login to my server requires a private key, and root login is disabled.
EDIT: Here is the email's
Delivered history. Note I have email forward from
$ME@gmail.com. How can glean from this whether my server was compromised?
Delivered-To: $ME@gmail.com Received: by $SOMEIP with SMTP id $ID; $DATE Received: from localhost ($MYHOSTNAME. [$MYIP]) by mx.google.com with ESMTP id $ID for <$ME@gmail.com>; $DATE Received-SPF: neutral (google.com: $MYIP is neither ... admin@$MYDOMAIN) client-ip=$MYIP; Authentication-Results: mx.google.com; spf=neutral (google.com: $MYIP is neither ... admin@$MYDOMAIN) smtp.mailfrom=admin@MYDOMAIN Received: from [$SOMEIP] (unknown [$SOMEIP]) by localhost (Postfix) with ESMTP id $ID for <$ME@$MYDOMAIN>; $DATE