Error when server stops receiving and sending roundcube email

aaP_betabrasil177

After a few hours of testing the email server it simply stops working and sending emails.
my log roundcube config.inc.php:

[14-Feb-2025 03:56:33 +0800]: <qhqk45hv> IMAP Error: Login failed for ti@taquracudeminas.mg.gov.br against localhost from 177.128.26.160. AUTHENTICATE PLAIN: Authentication failed. in /www/wwwroot/mail.taquaracudeminas.mg.gov.br/program/lib/Roundcube/rcube_imap.php on line 211 (POST /?task=login&action=login)
[14-Feb-2025 03:56:46 +0800]: <qhqk45hv> IMAP Error: Login failed for ti@taquracudeminas.mg.gov.br against localhost from 177.128.26.160. AUTHENTICATE PLAIN: Authentication failed. in /www/wwwroot/mail.taquaracudeminas.mg.gov.br/program/lib/Roundcube/rcube_imap.php on line 211 (POST /?task=login&action=login)
[14-Feb-2025 03:57:03 +0800]: <qhqk45hv> IMAP Error: Login failed for ti@taquracudeminas.mg.gov.br against localhost from 177.128.26.160. AUTHENTICATE PLAIN: Authentication failed. in /www/wwwroot/mail.taquaracudeminas.mg.gov.br/program/lib/Roundcube/rcube_imap.php on line 211 (POST /?task=login&action=login)
[14-Feb-2025 03:57:27 +0800]: <qhqk45hv> IMAP Error: Login failed for ti@taquracudeminas.mg.gov.br against localhost from 177.128.26.160. AUTHENTICATE PLAIN: Authentication failed. in /www/wwwroot/mail.taquaracudeminas.mg.gov.br/program/lib/Roundcube/rcube_imap.php on line 211 (POST /?task=login&action=login)
[14-Feb-2025 03:58:59 +0800]: <kn5e22ub> PHP Error: Invalid response code received from server (POST /?task=mail&unlock=loading1739476679148&framed=1&action=send)

My log is mail:
2025-02-13T17:01:59.446310-03:00 mail postfix/smtps/smtpd[6937]: warning: problem talking to service rewrite: Application error
2025-02-13T17:01:59.446447-03:00 mail postfix/master[4664]: warning: process /usr/lib/postfix/sbin/trivial-rewrite pid 13854 exit status 1
2025-02-13T17:01:59.452875-03:00 mail postfix/submission/smtpd[9558]: warning: problem talking to service rewrite: Connection reset by peer
2025-02-13T17:01:59.453336-03:00 mail postfix/smtpd[7858]: warning: problem talking to service rewrite: Application error
2025-02-13T17:01:59.453838-03:00 mail postfix/smtpd[9337]: warning: problem talking to service rewrite: Connection reset by peer
2025-02-13T17:01:59.453966-03:00 mail postfix/master[4664]: warning: process /usr/lib/postfix/sbin/trivial-rewrite pid 13855 exit status 1
2025-02-13T17:01:59.461003-03:00 mail postfix/smtpd[7021]: warning: problem talking to service rewrite: Connection reset by peer
2025-02-13T17:01:59.461311-03:00 mail postfix/smtpd[7955]: warning: problem talking to service rewrite: Connection reset by peer
2025-02-13T17:01:59.461600-03:00 mail postfix/smtpd[5890]: warning: problem talking to service rewrite: Application error
2025-02-13T17:01:59.461723-03:00 mail postfix/master[4664]: warning: process /usr/lib/postfix/sbin/trivial-rewrite pid 13856 exit status 1
2025-02-13T17:01:59.469388-03:00 mail postfix/smtpd[4996]: warning: problem talking to service rewrite: Connection reset by peer
2025-02-13T17:01:59.469712-03:00 mail postfix/smtpd[6684]: warning: problem talking to service rewrite: Connection reset by peer
2025-02-13T17:01:59.470004-03:00 mail postfix/smtpd[9330]: warning: problem talking to service rewrite: Connection reset by peer
2025-02-13T17:01:59.470275-03:00 mail postfix/smtpd[9332]: warning: problem talking to service rewrite: Application error
2025-02-13T17:01:59.470347-03:00 mail postfix/master[4664]: warning: process /usr/lib/postfix/sbin/trivial-rewrite pid 13857 exit status 1
2025-02-13T17:01:59.477989-03:00 mail postfix/smtpd[8746]: warning: problem talking to service rewrite: Connection reset by peer
2025-02-13T17:01:59.478289-03:00 mail postfix/smtpd[5081]: warning: problem talking to service rewrite: Connection reset by peer
2025-02-13T17:01:59.478558-03:00 mail postfix/smtpd[5082]: warning: problem talking to service rewrite: Connection reset by peer
2025-02-13T17:01:59.478863-03:00 mail postfix/smtpd[6151]: warning: problem talking to service rewrite: Application error
2025-02-13T17:01:59.478935-03:00 mail postfix/master[4664]: warning: process /usr/lib/postfix/sbin/trivial-rewrite pid 13858 exit status 1
2025-02-13T17:01:59.486534-03:00 mail postfix/smtpd[6006]: warning: problem talking to service rewrite: Connection reset by peer
2025-02-13T17:01:59.486945-03:00 mail postfix/smtpd[6952]: warning: problem talking to service rewrite: Connection reset by peer
2025-02-13T17:01:59.487217-03:00 mail postfix/smtpd[9482]: warning: problem talking to service rewrite: Application error
2025-02-13T17:01:59.487295-03:00 mail postfix/master[4664]: warning: process /usr/lib/postfix/sbin/trivial-rewrite pid 13859 exit status 1
2025-02-13T17:01:59.494299-03:00 mail postfix/submission/smtpd[13571]: warning: problem talking to service rewrite: Connection reset by peer
2025-02-13T17:01:59.494628-03:00 mail postfix/submission/smtpd[13085]: warning: problem talking to service rewrite: Connection reset by peer
2025-02-13T17:01:59.494923-03:00 mail postfix/smtpd[6866]: warning: problem talking to service rewrite: Connection reset by peer
2025-02-13T17:01:59.495204-03:00 mail postfix/smtpd[9565]: warning: problem talking to service rewrite: Application error
2025-02-13T17:01:59.495277-03:00 mail postfix/master[4664]: warning: process /usr/lib/postfix/sbin/trivial-rewrite pid 13860 exit status 1
2025-02-13T17:01:59.501882-03:00 mail postfix/submission/smtpd[13003]: warning: problem talking to service rewrite: Connection reset by peer
2025-02-13T17:01:59.502196-03:00 mail postfix/smtpd[6141]: warning: problem talking to service rewrite: Application error
2025-02-13T17:01:59.502275-03:00 mail postfix/master[4664]: warning: process /usr/lib/postfix/sbin/trivial-rewrite pid 13861 exit status 1
2025-02-13T17:02:13.502887-03:00 mail postfix/master[4664]: warning: unix_trigger_event: read timeout for service public/pickup

aaPanel_Kern

Hello, is the server load normal?
Try clicking Repair to fix Postfix can be resolved?

aaP_betabrasil177

It didn't work, I'll reinstall and restore the backup to show you another log, I'm not sure but it looks like an attack.

aaP_betabrasil177

This is part of the log, can you tell me how to solve it?

2025-02-13T23:45:47.451261-03:00 mail postfix/smtpd[108446]: warning: unknown[195.211.191.98]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=test
2025-02-13T23:45:47.451837-03:00 mail postfix/smtpd[108452]: warning: unknown[87.120.93.11]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=panda@gov.br
2025-02-13T23:45:47.452127-03:00 mail postfix/smtpd[108399]: warning: unknown[87.120.93.11]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=partenaires@gov.br
2025-02-13T23:45:47.637438-03:00 mail postfix/smtpd[108446]: lost connection after AUTH from unknown[195.211.191.98]
2025-02-13T23:45:47.637551-03:00 mail postfix/smtpd[108446]: disconnect from unknown[195.211.191.98] ehlo=1 auth=0/1 commands=1/2
2025-02-13T23:45:48.124183-03:00 mail postfix/smtpd[108452]: disconnect from unknown[87.120.93.11] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
2025-02-13T23:45:51.762664-03:00 mail postfix/smtpd[108399]: disconnect from unknown[87.120.93.11] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
2025-02-13T23:45:57.412760-03:00 mail postfix/smtpd[108446]: connect from unknown[87.120.93.11]
2025-02-13T23:46:04.387227-03:00 mail postfix/smtpd[108446]: warning: unknown[87.120.93.11]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=ox@gov.br
2025-02-13T23:46:05.357960-03:00 mail postfix/smtpd[108446]: disconnect from unknown[87.120.93.11] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
2025-02-13T23:46:10.715753-03:00 mail postfix/smtpd[108452]: connect from unknown[87.120.93.11]
2025-02-13T23:46:13.275155-03:00 mail postfix/smtpd[108399]: connect from unknown[195.211.191.98]
2025-02-13T23:46:16.008495-03:00 mail postfix/smtpd[108399]: warning: unknown[195.211.191.98]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=sysadmin
2025-02-13T23:46:16.190967-03:00 mail postfix/smtpd[108399]: disconnect from unknown[195.211.191.98] ehlo=1 auth=0/1 quit=1 commands=2/3
2025-02-13T23:46:18.654849-03:00 mail postfix/smtpd[108446]: connect from unknown[80.94.95.71]
2025-02-13T23:46:20.443248-03:00 mail postfix/smtpd[108452]: warning: unknown[87.120.93.11]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=omsk@gov.br
2025-02-13T23:46:21.116057-03:00 mail postfix/smtpd[108452]: disconnect from unknown[87.120.93.11] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
2025-02-13T23:46:23.361066-03:00 mail postfix/smtpd[108446]: warning: unknown[80.94.95.71]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=pico@gov.br
2025-02-13T23:46:23.935521-03:00 mail postfix/smtpd[108399]: connect from unknown[87.120.93.11]

log of the site where roundcube is located errors.log

[14-Feb-2025 10:45:23 +0800]: <372o9cul> PHP Error: Invalid response code received from server (POST /?task=mail&unlock=loading1739501062451&framed=1&action=send)

aaPanel_Kern

Hello, are these logins you operated?
Can you successfully log in to roundcube?

aaP_betabrasil177

I didn't log in, these names don't even exist in the emails, to test I disabled all the boxes and left only one, I can log in to Roundcube, but I can't send emails. Is there any way to block these connections? WAF is already activated.

aaPanel_Kern

Hi, can you give us your aapanel information? The server makes a snapshot backup first, if possible, please send it to kern@aapanel.com.
It is recommended to fill in the following
Post link:
SSH IP address, account password and port:
aapanel login link address and account password:
Detailed problem description:

No post link will not be able to know which user's information is, and the problem will not be processed

aaP_betabrasil177

aaPanel_Kern

the backup you refer to within the aapanel panel as in the image below. And would this SSH IP be for you to access my panel?

aaPanel_Kern

Hello, this backup is just a backup of the panel's own database. No websites, mysql, etc.

aaP_betabrasil177

aaPanel_Kern
I sent it with the information.

aaP_betabrasil177

aaPanel_Kern
I have some backups in the backpus folder that I made

aaP_betabrasil177

Did you access the panel because it seems you lost the security code?

aaPanel_Kern

aaP_betabrasil177
Yes, please provide the full access address

aaP_betabrasil177

aaPanel_Kern

I'm trying to access the panel, I think I activated force https and removed the domain

aaPanel_Kern

Hello, is the problem solved? Resend the message to us?

aaP_betabrasil177

aaPanel_Kern
Sorry for the delay, I managed to resolve the issue with the panel not opening, now I'm trying to resolve the email.

aaP_betabrasil177

I discovered one of the errors, as Roundcube could not be updated and even after changing it it did not show in the aapanel, I modified the files so that the user could change the password within Roundcube and update his password in the aapanel panel, it worked but it seems that after the update it is giving an error in the vmail file which prevents it from sending email.