I’m gonna be honest here, I have no clue how to word this thread, or what I need to provide to receive help. All I know is that Discourse sent 18K+ emails and failed to send 7K+ emails (after my Amazon SES was frozen for having such a high bounce rate ~%20). It also looks like its still trying to se…

You can see what’s got it open. You didn’t install a name server, so that’s probably the culprit. You need to spin up a new server and move there. You cannot know what is on the server. Everything is suspect.

My guess is that email or redis was broken for a long time and today it got fixed and sent out a bunch of queued up mail. You can look at admin, email, to see what it sent.

There’s only been 23 emails sent ever when I go there. EDIT: The day of this happening was the April 10th (just now figured out it was discourse that sent the emails), and there’s not a single email on there from the 10th.

Then something else sent the emails. That’s the best explanation.

What would’ve, I don’t run anything else on the server but discourse, could I have been attacked or something?

Also just found this, under the retries tab on the Sidekiq dashboard, the arguments are all something like this: {"type"=>"digest", "user_id"=>11, "current_site_id"=>"default"}

Perhaps someone got your smtp password and sent from somewhere else? Perhaps they hacked your server (is it protected by a password and you don’t have fail2ban?). Something like that. There’s pretty much zero chance that Discourse has anything to do with it. You should probably set up a new server…

[图片] pfaffman: Perhaps they hacked your server That’s what I thought, so I went and checked the last login into it, and it was from me in March.

It may be surprising, but it’s not hard to edit logs. Or install a root kit that does it. The addresses you’re sending to don’t exist in discourse, right? So it didn’t send the messages. It’s almost certain that you’ve been hacked. Do you log in with a password? Do you have fail2ban? Google for h…

The only other port than 22, 80, and 443 that’re open is 53. And I don’t know what fail2ban is, but I’ll look into it and try to increase security. I assume I should go ahead and close port 53?

What about the backup files, are they okay to import there?

Discourse 发送了 18K+ 封邮件？或者，我的服务器被黑了

支持

BobHill74 (200Tigersbloxed) 2020 年4 月 18 日 00:43 5

我本来想说，我在服务器上只运行了 Discourse，没有其他东西，我是不是遭到了攻击或类似的情况？

话题		回复	浏览量
Discourse not sending Emails Support unsupported-install	11	1145	2022 年6 月 24 日
Email failed jobs Support	7	188	2025 年3 月 4 日
Severe Email Issue since last update a couple days ago - 3.4.0.beta4-dev Support	25	472	2025 年2 月 16 日
SMTP failure not reported and too many login attempts on backlog clearing Support	23	9938	2022 年12 月 22 日
Extreme memory usage due to bad mail credentials Self-hosting server-resources	16	1126	2022 年11 月 16 日

Discourse 发送了 18K+ 封邮件？或者，我的服务器被黑了

相关话题