gmane.mail.qmail.qmr

Although I'm listed as a best-preference

Lloyd McNeil — 2011-03-31T23:32:25

I started getting this error from some of my users the only thing in common
with the users is I had to go into there .qmail file and pull out a second
copy of preline.

Which I believe came from importing there domain names from the old server.
And my qmail admin didn't show a check mark in the spam box, so when they
put a check in the box it added a second line. I'm not sure if the space
before preline is why the check mark didn't show up but easy enough to fix I
just deleted the first line.

|preline -f /usr/local/bin/maildrop mailfilter

| preline -f /usr/local/bin/maildrop mailfilter

 

But now those users are getting this error if they send to someone else in
there same domain.

<< at >idsfbsd4.integratedds.net>:
Sorry. Although I'm listed as a best-preference MX or A for that host,
it isn't in my control/locals file, so I don't treat it as local. (#5.4.6)

 

I don't want to add domain names to my locals file because the QmailRocks3.0
instructions warned of doing this and it has not been a problem until I

Re: Still spamming...

Gustavo Castro — 2011-03-25T14:20:26

Shaumarov:

  You may have something vulnerable on your web service that allow a
remote attacker to send spam through your server. You might search for
a PHP script or a vulnerable service (squirrelmail perhaps?) that can
be used to send spam. Stop your web service, stop your email service
(qmail-smtpd and qmail-send at least) and AFTER you make sure those
services are down, run this in a bash shell:

  for THEMESS in $( /var/qmail/bin/qmail-qread | grep
"david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org" | awk '{print $6}' | sed 's/#//' ; do
qmHandle -d$THEMESS ; done

  That will clean your queue without risking your legitimate messages. Then run

   qfixq live

  (You can download it from this page:
http://qmail.jms1.net/scripts/qfixq.shtml ). That will fix any
inconsistence in the queue.

  And then start your qmail-smtp and qmail-send services again (ONLY
if you need them running. Check then if you have something
compromised. Download chkrootkit and run it:

 # wget ftp://ftp.pangeia.com.br/pub/seg/pac/

Re: Still spamming...

Shaumarov Boburhon — 2011-03-25T13:17:59

now my tcp.smtp file likes this

127.:allow,RELAYCLIENT=""
:allow

all other ip address commented to check, also cleared qmail queue,
and in rcphosts file there left just my necessary domens.

after this run

tail -f /var/service/qmail-smtpd/log/main/current, there is almost
normal, coming ip addresses are not repeating so fastly, they are as
usual 2 or 3 times coming, because i am also running greylist that's
why there some delay .

After deleting qmail queue, tail -f
/var/service/qmail-send/log/main/current, as I understand it's going
to send the deleted queue mails?

400000004d8c923d2868bbf4 warning: trouble opening remote/74/5996694; will try again later
< at >400000004d8c923d2868d74c warning: trouble opening remote/168/5996577; will try again later
< at >400000004d8c923d28690a14 warning: trouble opening remote/125/854464; will try again later
< at >400000004d8c923d286944ac warning: trouble opening remote/62/854612; will try again later
< at >400000004d8c923d28697f44 warning: trouble opening remote/9/5996629; will try again

RE: Still spamming...

Torsten Kersandt — 2011-03-25T11:14:50

Please do a 
tail -f /var/service/qmail-smtpd/log/main/current
and look for repeating ip addresses in the received from

make sure you have no other ip addresses in the tcp.cdb than
127.0.0.1:allow,RELAYCLIENT""

once established where it is coming from,  add it to the tcp server file as
in "1.1.1.1:deny", 
stop qmail-send or you get blacklisted very soon until resolved
clear the queue

there are lots of possibilities of where the stuff comes from.
It may even be a mail script in one of you websites, so the address would be
localhost , 127.0.0.1



-----Original Message-----
From: Shaumarov Boburhon [mailto:mighty_bob-HPQIj1OAFZMvJsYlp49lxw< at >public.gmane.org] 
Sent: 25 March 2011 10:45
To: qmr-iGp6mRlwfsr/sFSC9fAAV0B+6BGkLq7r< at >public.gmane.org
Subject: [qmr] Still spamming...

Hi guys.. it's again me.. i have again the same problem, somebody is
sending alot of spam from my qmail server, looking
tail -f /var/log/maillog, I can't find any strange emails, it seems
everething ok.. last time i found some users whic

Re: Still spamming...

Jigar Raval — 2011-03-25T11:14:37

Hello,

What is your entry in tcp.smtp. I hope it is like below

:allow
:deny

Also, check your rcpthost file. For temporary if you have allowed web based email access, kindly stop and check. 

With Regards
Jigar

--- On Fri, 3/25/11, Shaumarov Boburhon <mighty_bob< at >rambler.ru> wrote:

Still spamming...

Shaumarov Boburhon — 2011-03-25T10:45:29

Hi guys.. it's again me.. i have again the same problem, somebody is
sending alot of spam from my qmail server, looking
tail -f /var/log/maillog, I can't find any strange emails, it seems
everething ok.. last time i found some users which their passwords was
hacked, and from these accounts the spam was sending...
i thought the problem was solved, unfortunately it's still spamming



##ps ax:

 8541 ?        S      0:00 qmail-remote hotmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org dela215-PkbjNfxxIARBDgjK7y7TUQ< at >public.gmane.org
 8543 ?        S      0:00 qmail-remote gmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org deevusa-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org
 8544 ?        S      0:00 qmail-remote gmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org deepconnect-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org
 8546 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org deepalitaware-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
 8549 ?        S      0

Re: Re[2]: How to find out who is spamming

Shepherd Nhongo — 2011-03-25T06:09:05

On Fri, Mar 25, 2011 at 8:03 AM, Shaumarov Boburhon
<mighty_bob-HPQIj1OAFZMvJsYlp49lxw< at >public.gmane.org>wrote:


How did they manage to hack the pass? I hope you will put preventive
measures to avoid this from happening. Current password change is a
corrective measure. Good luck. You need to close that loop hole that got the
pass to be compromised.

Cheers man

Re[2]: How to find out who is spamming

Shaumarov Boburhon — 2011-03-25T06:03:23

Re: --SPAM-- Qmail Attachment

Ravi bhargav — 2011-03-25T06:03:10

Thanks Torsten.
I could get all of them going good :-) That was a great help!

Thanks,
Ravi Bhargav

On Wed, Mar 23, 2011 at 9:02 PM, Torsten Kersandt <torsten-M0oyaKSkMe4Be96aLqz0jA< at >public.gmane.org>wrote:

Re: How to find out who is spamming

Shepherd Nhongo — 2011-03-25T05:39:52

On Fri, Mar 25, 2011 at 7:36 AM, Shaumarov Boburhon
<mighty_bob-HPQIj1OAFZMvJsYlp49lxw< at >public.gmane.org>wrote:


How did you find out man ? Can you share with us ?

Re: How to find out who is spamming

Shaumarov Boburhon — 2011-03-25T05:36:40

Hy guys! Tanx for advice! I found out who was spamming!




This something related to Back Scatter.It seems one of your machine in network is compromised .

-Abhishek

On Thu, Mar 24, 2011 at 5:07 PM, Shaumarov Boburhon <mighty_bob-HPQIj1OAFZMvJsYlp49lxw< at >public.gmane.org> wrote:



The best way to deal with such issue is to allow only you mail servers to talk to the www on port 25 alone. On your gateway put a rule that drops all other hosts smtp connections. I use a Linux gateway, to check who is spamming I use tcpdump and it has sufficient details
Hi Guys! I need your help...
I can't find who is sending spam from my qmail server. 
If you will see with ps ax, u can see  like this. 

 3355 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manojpasricha-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 3356 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manojpandeydo11s-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 3360 ?        S

Re: How to find out who is spamming

Shepherd Nhongo — 2011-03-25T04:59:06


Sent from my iPhone® 

On Mar 25, 2011, at 6:49 AM, Abhishek Anand Amralkar <abhishekanand1984< at >gmail.com> wrote:


The best way to deal with such issue is to allow only you mail servers to talk to the www on port 25 alone. On your gateway put a rule that drops all other hosts smtp connections. I use a Linux gateway, to check who is spamming I use tcpdump and it has sufficient details

Re: How to find out who is spamming

Abhishek Anand Amralkar — 2011-03-25T04:49:29

This something related to Back Scatter.It seems one of your machine in
network is compromised .

-Abhishek

On Thu, Mar 24, 2011 at 5:07 PM, Shaumarov Boburhon
<mighty_bob-HPQIj1OAFZMvJsYlp49lxw< at >public.gmane.org>wrote:

RE: How to find out who is spamming

Torsten Kersandt — 2011-03-24T11:52:11

HI 

If you use smtp-auth look at the /var/log/maillog

Look for lines as in

Mar 24 11:46:27 www vpopmail[92340]: vchkpw-smtp:
or
Mar 24 11:46:27 www vpopmail[92340]: vchkpw-smtps:


and the ~qmail-send/current log file

if a user is  logging in for sending more than usual, change the password
and if you are sure it is the right one, delete 

regards
torsten

 

From: Shaumarov Boburhon [mailto:mighty_bob-HPQIj1OAFZMvJsYlp49lxw< at >public.gmane.org] 
Sent: 24 March 2011 11:38
To: qmr-iGp6mRlwfsr/sFSC9fAAV0B+6BGkLq7r< at >public.gmane.org
Subject: [qmr] How to find out who is spamming

 

Hi Guys! I need your help...

I can't find who is sending spam from my qmail server. 

If you will see with ps ax, u can see  like this. 

 

 3355 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manojpasricha-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

 3356 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manojpandeydo11s-/E1597aS9LQxFYw1Cc

How to find out who is spamming

Shaumarov Boburhon — 2011-03-24T11:37:39

RE: --SPAM-- Qmail Attachment

Ravi Bhargav — 2011-03-23T15:52:54

Thx Torsten for the quick response. 
I will give out a try & will post the results :-)
Thx
Ravi

Sent from my Nokia Phone
-----Original Message-----
From: Torsten Kersandt
Sent:  23/03/2011 9:02:04 PM
Subject:  RE: [qmr] --SPAM-- Qmail Attachment

Hi Ravi

To point 1

A almost easy way to deal with databytes per user is to use the
/etc/tcp.smtp file but this requires all PC's in the network to have fixed
IP's

You can set the DATABYTES variable from tcpserver, just like RELAYCLIENT.

1.1.1.1.:allow,DATABYTES="500000"

1.1.1.2.:allow,DATABYTES="5000000"

A second, more dynamic possibility would be to use the auth.cdb method as in

http://qmail.jms1.net/scripts/mkauth.shtml

Both would simply overwrite the databytes set in the config 

Point 2

You could have just done a "svc -d /service/qmail-send" to stop the outgoing
messages and given you more time to deal with individual messages.

In addition, user education is a good start but after years and years of
that I still have people sending 75 M

RE: --SPAM-- Qmail Attachment

Torsten Kersandt — 2011-03-23T15:32:04

Hi Ravi

 

To point 1

A almost easy way to deal with databytes per user is to use the
/etc/tcp.smtp file but this requires all PC's in the network to have fixed
IP's

 

You can set the DATABYTES variable from tcpserver, just like RELAYCLIENT.

1.1.1.1.:allow,DATABYTES="500000"

1.1.1.2.:allow,DATABYTES="5000000"

 

A second, more dynamic possibility would be to use the auth.cdb method as in

http://qmail.jms1.net/scripts/mkauth.shtml

 

Both would simply overwrite the databytes set in the config 

 

Point 2

You could have just done a "svc -d /service/qmail-send" to stop the outgoing
messages and given you more time to deal with individual messages.

In addition, user education is a good start but after years and years of
that I still have people sending 75 MB emails to gmail and sorts.

 

Or you can create a smtproutes file entry for those domains and route the
emails to a BW limited server.

You can install a second qmail on the server and bind this qmail-send to a
specific IP address (qmail-1.03-bi

--SPAM-- Qmail Attachment

Ravi bhargav — 2011-03-23T14:42:56

Hi,

I have a Qmail server running in a corprate enviroment since 3 years.  I
have 3 queries.. Somebody please suggest me if these can be solved :-)

1. I have set the attachment size in  in /var/*qmail*/control/databytes.
Now the size what I have specified in the databytes applies to all the
users. Is there a way I can specify different attachment size for different
catagory of users, say for developers is 4M, executives, is 8M, and
something which is how possible on MS exchange?

2. Marking on the above point, since we have attachment size set globally to
all the mailboxes, there are situations when there is possibility of choking
our internet bandwidth when every body are sending mails with attachments.
This is effecting our business mails to reach the recipients on time as it
is a first come first out.  Is there a way I can defer all the mails other
than the business mails which are in the queue?  LIke ex.  If in queue I see
so many mails to Yahoo, hotmail & the client domains too & I just need to
defer

Re: Blocking mails to external id's

Shepherd Nhongo — 2011-03-23T12:25:59

correct

Re: Blocking mails to external id's

Gustavo Castro — 2011-03-23T11:18:59

Ajan:

  Looks like this is what you are looking for: http://www.inter7.com/?page=empf

2011/3/23 Ajan-netBIOS <ajan-FA1va909hu6f0DUV/oxz1A< at >public.gmane.org>:

Re: Blocking mails to external id's

Shepherd Nhongo — 2011-03-23T10:02:50

The mail boxes already exist that CBS is for new accounts only

Sent from my iPhone® 

On Mar 23, 2011, at 11:13 AM, rahul asai <asai.rahul-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org> wrote: