gmane.mail.qmail.qmr

Although I'm listed as a best-preference

Lloyd McNeil — 2011-03-31T23:32:25

I started getting this error from some of my users the only thing in common
with the users is I had to go into there .qmail file and pull out a second
copy of preline.

Which I believe came from importing there domain names from the old server.
And my qmail admin didn't show a check mark in the spam box, so when they
put a check in the box it added a second line. I'm not sure if the space
before preline is why the check mark didn't show up but easy enough to fix I
just deleted the first line.

|preline -f /usr/local/bin/maildrop mailfilter

| preline -f /usr/local/bin/maildrop mailfilter

 

But now those users are getting this error if they send to someone else in
there same domain.

<< at >idsfbsd4.integratedds.net>:
Sorry. Although I'm listed as a best-preference MX or A for that host,
it isn't in my control/locals file, so I don't treat it as local. (#5.4.6)

 

I don't want to add domain names to my locals file because the QmailRocks3.0
instructions warned of doing this and it has not been a problem until I
started checking the spam box.

 

PS. I used the John Simpson's migrate-domain script to move my users domains
a few at a time.

 

Lloyd

Re: Still spamming...

Gustavo Castro — 2011-03-25T14:20:26

Shaumarov:

You may have something vulnerable on your web service that allow a
remote attacker to send spam through your server. You might search for
a PHP script or a vulnerable service (squirrelmail perhaps?) that can
be used to send spam. Stop your web service, stop your email service
(qmail-smtpd and qmail-send at least) and AFTER you make sure those
services are down, run this in a bash shell:

for THEMESS in $( /var/qmail/bin/qmail-qread | grep
"david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org" | awk '{print $6}' | sed 's/#//' ; do
qmHandle -d$THEMESS ; done

That will clean your queue without risking your legitimate messages. Then run

qfixq live

(You can download it from this page:
http://qmail.jms1.net/scripts/qfixq.shtml ). That will fix any
inconsistence in the queue.

And then start your qmail-smtp and qmail-send services again (ONLY
if you need them running. Check then if you have something
compromised. Download chkrootkit and run it:

# wget ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gz
# tar xzf chkrootkit.tar.gz
# cd chkrootkit-0.49
# make sense
# ./chkrootkit

Read carefully and fix anything you find. You can use rkhunter if you want.
If you can capture traffic, you can check where is the attacker
coming from. You can find it in the logs too, but you will have to
read more files and waste more time, allowing the attacker to react to
your actions.
There's more things I would do on your situation, but I'm not in
front of your server...
Just my 2 cents... hope it helps.

Cheers,
Gustavo

2011/3/25 Shaumarov Boburhon <mighty_bob-HPQIj1OAFZMvJsYlp49lxw< at >public.gmane.org>:

Re: Still spamming...

Shaumarov Boburhon — 2011-03-25T13:17:59

now my tcp.smtp file likes this

127.:allow,RELAYCLIENT=""
:allow

all other ip address commented to check, also cleared qmail queue,
and in rcphosts file there left just my necessary domens.

after this run

tail -f /var/service/qmail-smtpd/log/main/current, there is almost
normal, coming ip addresses are not repeating so fastly, they are as
usual 2 or 3 times coming, because i am also running greylist that's
why there some delay .

After deleting qmail queue, tail -f
/var/service/qmail-send/log/main/current, as I understand it's going
to send the deleted queue mails?

400000004d8c923d2868bbf4 warning: trouble opening remote/74/5996694; will try again later
< at >400000004d8c923d2868d74c warning: trouble opening remote/168/5996577; will try again later
< at >400000004d8c923d28690a14 warning: trouble opening remote/125/854464; will try again later
< at >400000004d8c923d286944ac warning: trouble opening remote/62/854612; will try again later
< at >400000004d8c923d28697f44 warning: trouble opening remote/9/5996629; will try again later
< at >400000004d8c923d2869bdc4 warning: trouble opening remote/196/854324; will try again later
< at >400000004d8c923d2869f85c warning: trouble opening remote/96/854435; will try again later
< at >400000004d8c923d286a4294 warning: trouble opening remote/39/854800; will try again later
< at >400000004d8c923d286a8ccc warning: trouble opening remote/181/854309; will try again later
< at >400000004d8c923d286adaec warning: trouble opening remote/153/5996773; will try again later
< at >400000004d8c923d286b119c warning: trouble opening remote/174/854513; will try again later
< at >400000004d8c923d286b678c warning: trouble opening remote/62/854190; will try again later
< at >400000004d8c923d286bb1c4 warning: trouble opening remote/5/854555; will try again later
< at >400000004d8c923d286bec5c warning: trouble opening remote/70/854831; will try again later
< at >400000004d8c923d286c3694 warning: trouble opening remote/192/854109; will try again later
< at >400000004d8c923d286c6d44 warning: trouble opening remote/177/5996797; will try again later
< at >400000004d8c923d286cbb64 warning: trouble opening remote/10/854138; will try again later









-----------------------
What is your entry in tcp.smtp. I hope it is like below

:allow
:deny

Also, check your rcpthost file. For temporary if you have allowed web based email access, kindly stop and check. 

With Regards
Jigar

--- On Fri, 3/25/11, Shaumarov Boburhon <mighty_bob-HPQIj1OAFZMvJsYlp49lxw< at >public.gmane.org> wrote:

RE: Still spamming...

Torsten Kersandt — 2011-03-25T11:14:50

Please do a 
tail -f /var/service/qmail-smtpd/log/main/current
and look for repeating ip addresses in the received from

make sure you have no other ip addresses in the tcp.cdb than
127.0.0.1:allow,RELAYCLIENT""

once established where it is coming from,  add it to the tcp server file as
in "1.1.1.1:deny", 
stop qmail-send or you get blacklisted very soon until resolved
clear the queue

there are lots of possibilities of where the stuff comes from.
It may even be a mail script in one of you websites, so the address would be
localhost , 127.0.0.1



-----Original Message-----
From: Shaumarov Boburhon [mailto:mighty_bob-HPQIj1OAFZMvJsYlp49lxw< at >public.gmane.org] 
Sent: 25 March 2011 10:45
To: qmr-iGp6mRlwfsr/sFSC9fAAV0B+6BGkLq7r< at >public.gmane.org
Subject: [qmr] Still spamming...

Hi guys.. it's again me.. i have again the same problem, somebody is
sending alot of spam from my qmail server, looking
tail -f /var/log/maillog, I can't find any strange emails, it seems
everething ok.. last time i found some users which their passwords was
hacked, and from these accounts the spam was sending...
i thought the problem was solved, unfortunately it's still spamming



##ps ax:

 8541 ?        S      0:00 qmail-remote hotmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
dela215-PkbjNfxxIARBDgjK7y7TUQ< at >public.gmane.org
 8543 ?        S      0:00 qmail-remote gmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
deevusa-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org
 8544 ?        S      0:00 qmail-remote gmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
deepconnect-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org
 8546 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
deepalitaware-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
 8549 ?        S      0:00 qmail-remote gmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
deepak4date-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org
 8553 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
deep_laugh001-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 8555 ?        S      0:00 qmail-remote gmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
debasish.das2-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org
 8558 ?        S      0:00 qmail-remote gmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
debabrata.iit-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org
 8559 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
deb_samal2002-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
 8560 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
dearpartha-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
 8561 ?        S      0:00 qmail-remote hotmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
ddrmeena-PkbjNfxxIARBDgjK7y7TUQ< at >public.gmane.org
 8566 ?        S      0:00 qmail-remote bsnl.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
dcpradhan-6Sfbsi4peQ6f0DUV/oxz1A< at >public.gmane.org
 8567 ?        S      0:00 qmail-remote nitrkl.ac.in
david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org dbehera-4kQQnOVyNMMswqFILYFc3g< at >public.gmane.org
 8568 ?        S      0:00 qmail-remote iopb.res.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
dbehera-btAUfHXiA5QxFYw1CcD5bw< at >public.gmane.org
 8569 ?        S      0:00 qmail-remote msn.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
davyboy357-uAjRD0nVeow< at >public.gmane.org
 8573 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
dassofm-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
 8574 ?        S      0:00 qmail-remote gmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
dash.nibedita11-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org
 8578 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
das_meeky-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 8579 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
das_madhusmita-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
 8584 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
darsh1962-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
 8586 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
darkrustam-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
 8587 ?        S      0:00 qmail-remote dutchmail.com
david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org dantrenner-Bv/vjAMuS/YS+FvcfC7Uqw< at >public.gmane.org
 8588 ?        S      0:00 qmail-remote msn.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
danielmohanpersad98-uAjRD0nVeow< at >public.gmane.org
 8589 ?        S      0:00 qmail-remote yogachikitsacentre.com
david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org daniellefeurtado-2r358chHoze0T4qjB+1tsFmuhGz1hbfE< at >public.gmane.org
 8590 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
damodarpathak-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 8591 ?        S      0:00 qmail-remote hotmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
damienrizzello-PkbjNfxxIARBDgjK7y7TUQ< at >public.gmane.org
 8592 ?        S      0:00 qmail-remote ambedkar.org
david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org dalits-AkZeST3orLZg9hUCZPvPmw< at >public.gmane.org
 8593 ?        S      0:00 qmail-remote iopb.res.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
dalaimk-btAUfHXiA5QxFYw1CcD5bw< at >public.gmane.org
 8594 ?        S      0:00 qmail-remote eth.net david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
dakshina-nReEUC9YoSk< at >public.gmane.org
 8595 ?        S      0:00 qmail-remote gmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
daftriandcompany-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org
 8596 ?        S      0:00 qmail-remote gmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
d.rout60-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org
 8597 ?        S      0:00 qmail-remote gmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
d.deepali2007-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org
 8598 ?        S      0:00 qmail-remote hotmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
cyntrasingh-PkbjNfxxIARBDgjK7y7TUQ< at >public.gmane.org
 8599 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
cvomstc-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 8600 ?        S      0:00 qmail-remote hotmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
cvairag-PkbjNfxxIARBDgjK7y7TUQ< at >public.gmane.org
 8601 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
cutelove_kru31-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
 8602 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
ctk_mina-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 8603 ?        S      0:00 qmail-remote gmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
cssnayak2006-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org
 8604 ?        S      0:00 qmail-remote gmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
csrout-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org
 8605 ?        S      0:00 qmail-remote gmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
csabhinavm-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org
 8606 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
crkraju-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
 8607 ?        S      0:00 qmail-remote verizon.net david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
crdesign98-H+0wwilmMs3R7s880joybQ< at >public.gmane.org
 8608 ?        S      0:00 qmail-remote d.umn.edu david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
cowa0037< at >d.umn.edu
 8609 ?        S      0:00 qmail-remote aol.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
coutelil-YDxpq3io04c< at >public.gmane.org
 8610 ?        S      0:00 qmail-remote hotpop.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
coolninad-ktR7oAotx3zQT0dZR+AlfA< at >public.gmane.org
 8611 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
coolmahee_2005-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
 8612 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
cooldipti_13-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 8613 ?        S      0:00 qmail-remote gmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
coolbalaji87-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org
 8614 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
cool_ganesh1-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 8615 ?        S      0:00 qmail-remote tafecon.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
contact-Vy53bkCqlxdBDgjK7y7TUQ< at >public.gmane.org
 8616 ?        S      0:00 qmail-remote iitt.ac.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
contact-A4gU7LdLr+ef0DUV/oxz1A< at >public.gmane.org
 8617 ?        S      0:00 qmail-remote awakeningself.com
david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org connie-56sTcPfcKMjKsszUe28cOwC/G2K4zDHf< at >public.gmane.org
 8618 ?        S      0:00 qmail-remote sbcglobal.net
david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org cmgraham-rphTv4pjVZMJGwgDXS7ZQA< at >public.gmane.org
 8619 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
cmgarg-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
 8620 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
cm4chakra-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
 8621 ?        S      0:00 qmail-remote inovant.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
clukas-5lGiqysVb4JBDgjK7y7TUQ< at >public.gmane.org
 8623 ?        S      0:00 qmail-remote theworld.com
david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org clindley-KVEKqrk+LIpWk0Htik3J/w< at >public.gmane.org
 8624 ?        S      0:00 qmail-remote vassar.edu david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
clhosley-zka7wQWIdxI3uPMLIKxrzw< at >public.gmane.org
 8625 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
cldinakaran-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 8626 ?        S      0:00 qmail-remote euronet.be david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
claude.laurent-dNWzXRSXXtiZIoH1IeqzKA< at >public.gmane.org
 8627 ?        S      0:00 qmail-popup mail.intal.uz
/var/popboxes/bin/vchkpw qmail-pop3d Maildir
 8628 ?        S      0:00 qmail-remote tiscali.be david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
clau8787-IWqWACnzNjyZIoH1IeqzKA< at >public.gmane.org
 8629 ?        S      0:00 qmail-remote rediffmail.com
david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org cknguptha-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
 8630 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
cjm6in4ths-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
 8631 ?        S      0:00 qmail-remote rediffmail.com
david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org chura_giri-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org


 ### tail -f /var/service/qmail-send/log/main/current
< at >400000004d8c715617b89be4 status: local 0/10 remote 254/255
< at >400000004d8c715617b8ab84 starting delivery 35382: msg 854058 to remote
ips_38con-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
< at >400000004d8c715617b8bf0c status: local 0/10 remote 255/255
< at >400000004d8c715629d0f2cc delivery 34355: deferral:
Sorry,_I_wasn't_able_to_establish_an_SMTP_connection._(#4.4.1)/
< at >400000004d8c715629d10e24 status: local 0/10 remote 254/255
< at >400000004d8c715629d11dc4 starting delivery 35383: msg 854058 to remote
invisible_flying_torsoman-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
< at >400000004d8c715629d1314c status: local 0/10 remote 255/255
< at >400000004d8c71562fab7fb4 delivery 34676: deferral:
Sorry,_I_wasn't_able_to_establish_an_SMTP_connection._(#4.4.1)/
< at >400000004d8c71562fab9724 status: local 0/10 remote 254/255
< at >400000004d8c71562fabaaac starting delivery 35384: msg 854058 to remote
iniselvi-DaQTI0RpDDMAvxtiuMwx3w< at >public.gmane.org
< at >400000004d8c71562fabba4c status: local 0/10 remote 255/255
< at >400000004d8c7158272e0974 delivery 35379: deferral:
Sorry,_I_wasn't_able_to_establish_an_SMTP_connection._(#4.4.1)/
< at >400000004d8c7158272e20e4 status: local 0/10 remote 254/255
< at >400000004d8c7158272e346c starting delivery 35385: msg 854058 to remote
info-mINZXyi5oyee8kRwQpwjMg< at >public.gmane.org
< at >400000004d8c7158272e440c status: local 0/10 remote 255/255
< at >400000004d8c715a07a03794 delivery 35368: deferral:
Sorry,_I_wasn't_able_to_establish_an_SMTP_connection._(#4.4.1)/
< at >400000004d8c715a07a04f04 status: local 0/10 remote 254/255
< at >400000004d8c715a07a0628c starting delivery 35386: msg 854058 to remote
imt.rajeev-BqWrnlxIIWiRq8AjE7tl8g< at >public.gmane.org
< at >400000004d8c715a07a07614 status: local 0/10 remote 255/255
< at >400000004d8c715b051a53ec delivery 35377: success:
74.125.39.27_accepted_message./Remote_host_said:_250_2.0.0_OK_1301049799_y3s
i850346fak.158/
< at >400000004d8c715b051a6b5c status: local 0/10 remote 254/255
< at >400000004d8c715b051a7ee4 starting delivery 35387: msg 854058 to remote
imsurana-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
< at >400000004d8c715b051a8e84 status: local 0/10 remote 255/255
< at >400000004d8c715b0ebae984 delivery 35225: success:
166.77.11.48_accepted_message./Remote_host_said:_250_ok:__Message_216732716_
accepted/
< at >400000004d8c715b0ebb04dc status: local 0/10 remote 254/255
< at >400000004d8c715b0ebb147c starting delivery 35388: msg 854058 to remote
imamashraf1-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org

Re: Still spamming...

Jigar Raval — 2011-03-25T11:14:37

Hello,

What is your entry in tcp.smtp. I hope it is like below

:allow
:deny

Also, check your rcpthost file. For temporary if you have allowed web based email access, kindly stop and check. 

With Regards
Jigar

--- On Fri, 3/25/11, Shaumarov Boburhon <mighty_bob< at >rambler.ru> wrote:

Still spamming...

Shaumarov Boburhon — 2011-03-25T10:45:29

Hi guys.. it's again me.. i have again the same problem, somebody is
sending alot of spam from my qmail server, looking
tail -f /var/log/maillog, I can't find any strange emails, it seems
everething ok.. last time i found some users which their passwords was
hacked, and from these accounts the spam was sending...
i thought the problem was solved, unfortunately it's still spamming



##ps ax:

 8541 ?        S      0:00 qmail-remote hotmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org dela215-PkbjNfxxIARBDgjK7y7TUQ< at >public.gmane.org
 8543 ?        S      0:00 qmail-remote gmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org deevusa-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org
 8544 ?        S      0:00 qmail-remote gmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org deepconnect-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org
 8546 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org deepalitaware-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
 8549 ?        S      0:00 qmail-remote gmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org deepak4date-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org
 8553 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org deep_laugh001-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 8555 ?        S      0:00 qmail-remote gmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org debasish.das2-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org
 8558 ?        S      0:00 qmail-remote gmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org debabrata.iit-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org
 8559 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org deb_samal2002-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
 8560 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org dearpartha-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
 8561 ?        S      0:00 qmail-remote hotmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org ddrmeena-PkbjNfxxIARBDgjK7y7TUQ< at >public.gmane.org
 8566 ?        S      0:00 qmail-remote bsnl.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org dcpradhan-6Sfbsi4peQ6f0DUV/oxz1A< at >public.gmane.org
 8567 ?        S      0:00 qmail-remote nitrkl.ac.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org dbehera-4kQQnOVyNMMswqFILYFc3g< at >public.gmane.org
 8568 ?        S      0:00 qmail-remote iopb.res.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org dbehera-btAUfHXiA5QxFYw1CcD5bw< at >public.gmane.org
 8569 ?        S      0:00 qmail-remote msn.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org davyboy357-uAjRD0nVeow< at >public.gmane.org
 8573 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org dassofm-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
 8574 ?        S      0:00 qmail-remote gmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org dash.nibedita11-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org
 8578 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org das_meeky-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 8579 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org das_madhusmita-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
 8584 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org darsh1962-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
 8586 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org darkrustam-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
 8587 ?        S      0:00 qmail-remote dutchmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org dantrenner-Bv/vjAMuS/YS+FvcfC7Uqw< at >public.gmane.org
 8588 ?        S      0:00 qmail-remote msn.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org danielmohanpersad98-uAjRD0nVeow< at >public.gmane.org
 8589 ?        S      0:00 qmail-remote yogachikitsacentre.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org daniellefeurtado-2r358chHoze0T4qjB+1tsFmuhGz1hbfE< at >public.gmane.org
 8590 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org damodarpathak-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 8591 ?        S      0:00 qmail-remote hotmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org damienrizzello-PkbjNfxxIARBDgjK7y7TUQ< at >public.gmane.org
 8592 ?        S      0:00 qmail-remote ambedkar.org david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org dalits-AkZeST3orLZg9hUCZPvPmw< at >public.gmane.org
 8593 ?        S      0:00 qmail-remote iopb.res.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org dalaimk-btAUfHXiA5QxFYw1CcD5bw< at >public.gmane.org
 8594 ?        S      0:00 qmail-remote eth.net david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org dakshina-nReEUC9YoSk< at >public.gmane.org
 8595 ?        S      0:00 qmail-remote gmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org daftriandcompany-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org
 8596 ?        S      0:00 qmail-remote gmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org d.rout60-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org
 8597 ?        S      0:00 qmail-remote gmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org d.deepali2007-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org
 8598 ?        S      0:00 qmail-remote hotmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org cyntrasingh-PkbjNfxxIARBDgjK7y7TUQ< at >public.gmane.org
 8599 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org cvomstc-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 8600 ?        S      0:00 qmail-remote hotmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org cvairag-PkbjNfxxIARBDgjK7y7TUQ< at >public.gmane.org
 8601 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org cutelove_kru31-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
 8602 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org ctk_mina-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 8603 ?        S      0:00 qmail-remote gmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org cssnayak2006-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org
 8604 ?        S      0:00 qmail-remote gmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org csrout-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org
 8605 ?        S      0:00 qmail-remote gmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org csabhinavm-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org
 8606 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org crkraju-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
 8607 ?        S      0:00 qmail-remote verizon.net david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org crdesign98-H+0wwilmMs3R7s880joybQ< at >public.gmane.org
 8608 ?        S      0:00 qmail-remote d.umn.edu david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org cowa0037< at >d.umn.edu
 8609 ?        S      0:00 qmail-remote aol.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org coutelil-YDxpq3io04c< at >public.gmane.org
 8610 ?        S      0:00 qmail-remote hotpop.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org coolninad-ktR7oAotx3zQT0dZR+AlfA< at >public.gmane.org
 8611 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org coolmahee_2005-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
 8612 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org cooldipti_13-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 8613 ?        S      0:00 qmail-remote gmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org coolbalaji87-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org
 8614 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org cool_ganesh1-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 8615 ?        S      0:00 qmail-remote tafecon.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org contact-Vy53bkCqlxdBDgjK7y7TUQ< at >public.gmane.org
 8616 ?        S      0:00 qmail-remote iitt.ac.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org contact-A4gU7LdLr+ef0DUV/oxz1A< at >public.gmane.org
 8617 ?        S      0:00 qmail-remote awakeningself.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org connie-56sTcPfcKMjKsszUe28cOwC/G2K4zDHf< at >public.gmane.org
 8618 ?        S      0:00 qmail-remote sbcglobal.net david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org cmgraham-rphTv4pjVZMJGwgDXS7ZQA< at >public.gmane.org
 8619 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org cmgarg-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
 8620 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org cm4chakra-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
 8621 ?        S      0:00 qmail-remote inovant.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org clukas-5lGiqysVb4JBDgjK7y7TUQ< at >public.gmane.org
 8623 ?        S      0:00 qmail-remote theworld.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org clindley-KVEKqrk+LIpWk0Htik3J/w< at >public.gmane.org
 8624 ?        S      0:00 qmail-remote vassar.edu david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org clhosley-zka7wQWIdxI3uPMLIKxrzw< at >public.gmane.org
 8625 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org cldinakaran-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 8626 ?        S      0:00 qmail-remote euronet.be david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org claude.laurent-dNWzXRSXXtiZIoH1IeqzKA< at >public.gmane.org
 8627 ?        S      0:00 qmail-popup mail.intal.uz /var/popboxes/bin/vchkpw qmail-pop3d Maildir
 8628 ?        S      0:00 qmail-remote tiscali.be david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org clau8787-IWqWACnzNjyZIoH1IeqzKA< at >public.gmane.org
 8629 ?        S      0:00 qmail-remote rediffmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org cknguptha-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
 8630 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org cjm6in4ths-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
 8631 ?        S      0:00 qmail-remote rediffmail.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org chura_giri-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org


 ### tail -f /var/service/qmail-send/log/main/current
< at >400000004d8c715617b89be4 status: local 0/10 remote 254/255
< at >400000004d8c715617b8ab84 starting delivery 35382: msg 854058 to remote ips_38con-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
< at >400000004d8c715617b8bf0c status: local 0/10 remote 255/255
< at >400000004d8c715629d0f2cc delivery 34355: deferral: Sorry,_I_wasn't_able_to_establish_an_SMTP_connection._(#4.4.1)/
< at >400000004d8c715629d10e24 status: local 0/10 remote 254/255
< at >400000004d8c715629d11dc4 starting delivery 35383: msg 854058 to remote invisible_flying_torsoman-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
< at >400000004d8c715629d1314c status: local 0/10 remote 255/255
< at >400000004d8c71562fab7fb4 delivery 34676: deferral: Sorry,_I_wasn't_able_to_establish_an_SMTP_connection._(#4.4.1)/
< at >400000004d8c71562fab9724 status: local 0/10 remote 254/255
< at >400000004d8c71562fabaaac starting delivery 35384: msg 854058 to remote iniselvi-DaQTI0RpDDMAvxtiuMwx3w< at >public.gmane.org
< at >400000004d8c71562fabba4c status: local 0/10 remote 255/255
< at >400000004d8c7158272e0974 delivery 35379: deferral: Sorry,_I_wasn't_able_to_establish_an_SMTP_connection._(#4.4.1)/
< at >400000004d8c7158272e20e4 status: local 0/10 remote 254/255
< at >400000004d8c7158272e346c starting delivery 35385: msg 854058 to remote info-mINZXyi5oyee8kRwQpwjMg< at >public.gmane.org
< at >400000004d8c7158272e440c status: local 0/10 remote 255/255
< at >400000004d8c715a07a03794 delivery 35368: deferral: Sorry,_I_wasn't_able_to_establish_an_SMTP_connection._(#4.4.1)/
< at >400000004d8c715a07a04f04 status: local 0/10 remote 254/255
< at >400000004d8c715a07a0628c starting delivery 35386: msg 854058 to remote imt.rajeev-BqWrnlxIIWiRq8AjE7tl8g< at >public.gmane.org
< at >400000004d8c715a07a07614 status: local 0/10 remote 255/255
< at >400000004d8c715b051a53ec delivery 35377: success: 74.125.39.27_accepted_message./Remote_host_said:_250_2.0.0_OK_1301049799_y3si850346fak.158/
< at >400000004d8c715b051a6b5c status: local 0/10 remote 254/255
< at >400000004d8c715b051a7ee4 starting delivery 35387: msg 854058 to remote imsurana-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
< at >400000004d8c715b051a8e84 status: local 0/10 remote 255/255
< at >400000004d8c715b0ebae984 delivery 35225: success: 166.77.11.48_accepted_message./Remote_host_said:_250_ok:__Message_216732716_accepted/
< at >400000004d8c715b0ebb04dc status: local 0/10 remote 254/255
< at >400000004d8c715b0ebb147c starting delivery 35388: msg 854058 to remote imamashraf1-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org

Re: Re[2]: How to find out who is spamming

Shepherd Nhongo — 2011-03-25T06:09:05

On Fri, Mar 25, 2011 at 8:03 AM, Shaumarov Boburhon
<mighty_bob-HPQIj1OAFZMvJsYlp49lxw< at >public.gmane.org>wrote:


How did they manage to hack the pass? I hope you will put preventive
measures to avoid this from happening. Current password change is a
corrective measure. Good luck. You need to close that loop hole that got the
pass to be compromised.

Cheers man

Re[2]: How to find out who is spamming

Shaumarov Boburhon — 2011-03-25T06:03:23

Re: --SPAM-- Qmail Attachment

Ravi bhargav — 2011-03-25T06:03:10

Thanks Torsten.
I could get all of them going good :-) That was a great help!

Thanks,
Ravi Bhargav

On Wed, Mar 23, 2011 at 9:02 PM, Torsten Kersandt <torsten-M0oyaKSkMe4Be96aLqz0jA< at >public.gmane.org>wrote:

Re: How to find out who is spamming

Shepherd Nhongo — 2011-03-25T05:39:52

On Fri, Mar 25, 2011 at 7:36 AM, Shaumarov Boburhon
<mighty_bob-HPQIj1OAFZMvJsYlp49lxw< at >public.gmane.org>wrote:


How did you find out man ? Can you share with us ?

Re: How to find out who is spamming

Shaumarov Boburhon — 2011-03-25T05:36:40

Hy guys! Tanx for advice! I found out who was spamming!




This something related to Back Scatter.It seems one of your machine in network is compromised .

-Abhishek

On Thu, Mar 24, 2011 at 5:07 PM, Shaumarov Boburhon <mighty_bob-HPQIj1OAFZMvJsYlp49lxw< at >public.gmane.org> wrote:



The best way to deal with such issue is to allow only you mail servers to talk to the www on port 25 alone. On your gateway put a rule that drops all other hosts smtp connections. I use a Linux gateway, to check who is spamming I use tcpdump and it has sufficient details
Hi Guys! I need your help...
I can't find who is sending spam from my qmail server. 
If you will see with ps ax, u can see  like this. 

 3355 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manojpasricha-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 3356 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manojpandeydo11s-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 3360 ?        S      0:00 qmail-popup mail.intal.uz /var/popboxes/bin/vchkpw qmail-pop3d Maildir
 3366 ?        S      0:00 qmail-pop3d Maildir
 3370 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manojkumardhankhar-83-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 3371 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manojkumar4891-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
 3373 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manojkumar10_yadav-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 3374 ?        S      0:00 qmail-remote phmhealth.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manojkum-HNfW5e86Fy21Z/+hSey0Gg< at >public.gmane.org
 3376 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manojkmundhra-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 3378 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manojjk2003-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 3380 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manojjain14-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 3381 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manojdwivedi_obra-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 3383 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manojdhuran-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 3385 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manojcoco_07-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 3388 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manojamrit-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 3390 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manoj_yk-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 3400 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manoj_ya123-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 3402 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manoj_srg-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 3403 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manoj_shuklajss-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 3404 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manoj_sharmarjit-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 3412 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manoj_sharmamks-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 3413 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manoj_sharma_786-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
 3414 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manoj_sh76-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
 3423 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manoj_rkgit007-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 3442 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manoj_paswan22-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
 3443 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manoj_pandey511-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
 3444 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manoj_nerist-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
 3445 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manoj_mehta20007-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 3448 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manoj_march02-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 3450 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manoj_manojmbd-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 3451 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manoj_kv_engg-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 3452 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manoj_kumar_malik-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 3453 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manoj_kumar_kushwaha-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 3454 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manoj_kumar_choudhary25-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 3455 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manoj_kulwant-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 3456 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manoj_kmohapatra-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 3457 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manoj_iimc2000-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
 3458 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manoj_happy2005-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org


while looking tail -f /var/service/qmail-send/log/main/current, see just this

< at >400000004d8b2c13158bf014 starting delivery 14104: msg 854481 to remote mirbin24dec-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
< at >400000004d8b2c13158c039c status: local 0/10 remote 255/255
< at >400000004d8b2c131d94614c delivery 13856: deferral: Sorry,_I_wasn't_able_to_establish_an_SMTP_connection._(#4.4.1)/
< at >400000004d8b2c131d9478bc status: local 0/10 remote 254/255
< at >400000004d8b2c131d94885c starting delivery 14105: msg 854481 to remote minaxi_ism-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
< at >400000004d8b2c131d949be4 status: local 0/10 remote 255/255
< at >400000004d8b2c132659295c delivery 13954: deferral: Connected_to_180.222.96.138_but_connection_died._(#4.4.2)/
< at >400000004d8b2c13265940cc status: local 0/10 remote 254/255
< at >400000004d8b2c1326595454 starting delivery 14106: msg 854481 to remote minal_likerain-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
< at >400000004d8b2c13265963f4 status: local 0/10 remote 255/255
< at >400000004d8b2c140cff2024 delivery 13947: deferral: Connected_to_180.222.96.138_but_connection_died._(#4.4.2)/
< at >400000004d8b2c140cff3b7c status: local 0/10 remote 254/255
< at >400000004d8b2c140cff4b1c starting delivery 14107: msg 854481 to remote mig_26aug-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
< at >400000004d8b2c140cff5ea4 status: local 0/10 remote 255/255
< at >400000004d8b2c1500918bc4 delivery 14022: deferral: Sorry,_I_wasn't_able_to_establish_an_SMTP_connection._(#4.4.1)/
< at >400000004d8b2c150091ab04 status: local 0/10 remote 254/255
< at >400000004d8b2c150091be8c starting delivery 14108: msg 854481 to remote micheymahapatro-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
< at >400000004d8b2c150091ce2c status: local 0/10 remote 255/255
< at >400000004d8b2c1500be4114 delivery 14000: success: 84.54.69.222_accepted_message./Remote_host_said:_250_2.0.0_p2OBZ9O1018947_Message_accepted_for_delivery/
< at >400000004d8b2c1500be5884 status: local 0/10 remote 254/255
< at >400000004d8b2c1500be6c0c end msg 854058
< at >400000004d8b2c1500c2e494 starting delivery 14109: msg 854481 to remote mia11011972-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
< at >400000004d8b2c1500c2f81c status: local 0/10 remote 255/255
< at >400000004d8b2c15051b2eac delivery 12735: deferral: Sorry,_I_wasn't_able_to_establish_an_SMTP_connection._(#4.4.1)/
< at >400000004d8b2c15051b461c status: local 0/10 remote 254/255
< at >400000004d8b2c15051b55bc starting delivery 14110: msg 854481 to remote mi_siddiqui-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org
< at >400000004d8b2c15051b6944 status: local 0/10 remote 255/255
< at >400000004d8b2c1512e7f934 delivery 14031: deferral: Connected_to_180.222.96.138_but_connection_died._(#4.4.2)/
< at >400000004d8b2c1512e810a4 status: local 0/10 remote 254/255
< at >400000004d8b2c1512e8242c starting delivery 14111: msg 854481 to remote mgupta314-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
< at >400000004d8b2c1512e833cc status: local 0/10 remote 255/255
< at >400000004d8b2c1530fab434 delivery 13891: deferral: Connected_to_180.222.96.138_but_connection_died._(#4.4.2)/
< at >400000004d8b2c1530facf8c status: local 0/10 remote 254/255
< at >400000004d8b2c1530fae314 starting delivery 14112: msg 854481 to remote mgulati_19nov-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org
  

how to find out by which user it's sending from my server. I think one of my users infacted, and from his login it's all sending.
Relay clinet configured proparly.

Thanks in advace

Re: How to find out who is spamming

Shepherd Nhongo — 2011-03-25T04:59:06


Sent from my iPhone® 

On Mar 25, 2011, at 6:49 AM, Abhishek Anand Amralkar <abhishekanand1984< at >gmail.com> wrote:


The best way to deal with such issue is to allow only you mail servers to talk to the www on port 25 alone. On your gateway put a rule that drops all other hosts smtp connections. I use a Linux gateway, to check who is spamming I use tcpdump and it has sufficient details

Re: How to find out who is spamming

Abhishek Anand Amralkar — 2011-03-25T04:49:29

This something related to Back Scatter.It seems one of your machine in
network is compromised .

-Abhishek

On Thu, Mar 24, 2011 at 5:07 PM, Shaumarov Boburhon
<mighty_bob-HPQIj1OAFZMvJsYlp49lxw< at >public.gmane.org>wrote:

RE: How to find out who is spamming

Torsten Kersandt — 2011-03-24T11:52:11

HI 

If you use smtp-auth look at the /var/log/maillog

Look for lines as in

Mar 24 11:46:27 www vpopmail[92340]: vchkpw-smtp:
or
Mar 24 11:46:27 www vpopmail[92340]: vchkpw-smtps:


and the ~qmail-send/current log file

if a user is  logging in for sending more than usual, change the password
and if you are sure it is the right one, delete 

regards
torsten

 

From: Shaumarov Boburhon [mailto:mighty_bob-HPQIj1OAFZMvJsYlp49lxw< at >public.gmane.org] 
Sent: 24 March 2011 11:38
To: qmr-iGp6mRlwfsr/sFSC9fAAV0B+6BGkLq7r< at >public.gmane.org
Subject: [qmr] How to find out who is spamming

 

Hi Guys! I need your help...

I can't find who is sending spam from my qmail server. 

If you will see with ps ax, u can see  like this. 

 

 3355 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manojpasricha-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

 3356 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manojpandeydo11s-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

 3360 ?        S      0:00 qmail-popup mail.intal.uz
/var/popboxes/bin/vchkpw qmail-pop3d Maildir

 3366 ?        S      0:00 qmail-pop3d Maildir

 3370 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manojkumardhankhar-83-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

 3371 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manojkumar4891-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org

 3373 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manojkumar10_yadav-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

 3374 ?        S      0:00 qmail-remote phmhealth.com
david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org manojkum-HNfW5e86Fy21Z/+hSey0Gg< at >public.gmane.org

 3376 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manojkmundhra-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

 3378 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manojjk2003-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

 3380 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manojjain14-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

 3381 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manojdwivedi_obra-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

 3383 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manojdhuran-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

 3385 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manojcoco_07-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

 3388 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manojamrit-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

 3390 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manoj_yk-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

 3400 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manoj_ya123-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

 3402 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manoj_srg-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

 3403 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manoj_shuklajss-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

 3404 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manoj_sharmarjit-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

 3412 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manoj_sharmamks-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

 3413 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manoj_sharma_786-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org

 3414 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manoj_sh76-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org

 3423 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manoj_rkgit007-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

 3442 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manoj_paswan22-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org

 3443 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manoj_pandey511-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org

 3444 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manoj_nerist-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org

 3445 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manoj_mehta20007-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

 3448 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manoj_march02-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

 3450 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manoj_manojmbd-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

 3451 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manoj_kv_engg-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

 3452 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manoj_kumar_malik-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

 3453 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manoj_kumar_kushwaha-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

 3454 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manoj_kumar_choudhary25-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

 3455 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manoj_kulwant-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

 3456 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manoj_kmohapatra-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

 3457 ?        S      0:00 qmail-remote yahoo.co.in david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manoj_iimc2000-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

 3458 ?        S      0:00 qmail-remote yahoo.com david2000-QOiod4cnrWAN+BqQ9rBEUg< at >public.gmane.org
manoj_happy2005-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org

 

 

while looking tail -f /var/service/qmail-send/log/main/current, see just
this

 

< at >400000004d8b2c13158bf014 starting delivery 14104: msg 854481 to remote
mirbin24dec-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

< at >400000004d8b2c13158c039c status: local 0/10 remote 255/255

< at >400000004d8b2c131d94614c delivery 13856: deferral:
Sorry,_I_wasn't_able_to_establish_an_SMTP_connection._(#4.4.1)/

< at >400000004d8b2c131d9478bc status: local 0/10 remote 254/255

< at >400000004d8b2c131d94885c starting delivery 14105: msg 854481 to remote
minaxi_ism-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

< at >400000004d8b2c131d949be4 status: local 0/10 remote 255/255

< at >400000004d8b2c132659295c delivery 13954: deferral:
Connected_to_180.222.96.138_but_connection_died._(#4.4.2)/

< at >400000004d8b2c13265940cc status: local 0/10 remote 254/255

< at >400000004d8b2c1326595454 starting delivery 14106: msg 854481 to remote
minal_likerain-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

< at >400000004d8b2c13265963f4 status: local 0/10 remote 255/255

< at >400000004d8b2c140cff2024 delivery 13947: deferral:
Connected_to_180.222.96.138_but_connection_died._(#4.4.2)/

< at >400000004d8b2c140cff3b7c status: local 0/10 remote 254/255

< at >400000004d8b2c140cff4b1c starting delivery 14107: msg 854481 to remote
mig_26aug-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

< at >400000004d8b2c140cff5ea4 status: local 0/10 remote 255/255

< at >400000004d8b2c1500918bc4 delivery 14022: deferral:
Sorry,_I_wasn't_able_to_establish_an_SMTP_connection._(#4.4.1)/

< at >400000004d8b2c150091ab04 status: local 0/10 remote 254/255

< at >400000004d8b2c150091be8c starting delivery 14108: msg 854481 to remote
micheymahapatro-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

< at >400000004d8b2c150091ce2c status: local 0/10 remote 255/255

< at >400000004d8b2c1500be4114 delivery 14000: success:
84.54.69.222_accepted_message./Remote_host_said:_250_2.0.0_p2OBZ9O1018947_Me
ssage_accepted_for_delivery/

< at >400000004d8b2c1500be5884 status: local 0/10 remote 254/255

< at >400000004d8b2c1500be6c0c end msg 854058

< at >400000004d8b2c1500c2e494 starting delivery 14109: msg 854481 to remote
mia11011972-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org

< at >400000004d8b2c1500c2f81c status: local 0/10 remote 255/255

< at >400000004d8b2c15051b2eac delivery 12735: deferral:
Sorry,_I_wasn't_able_to_establish_an_SMTP_connection._(#4.4.1)/

< at >400000004d8b2c15051b461c status: local 0/10 remote 254/255

< at >400000004d8b2c15051b55bc starting delivery 14110: msg 854481 to remote
mi_siddiqui-/E1597aS9LQAvxtiuMwx3w< at >public.gmane.org

< at >400000004d8b2c15051b6944 status: local 0/10 remote 255/255

< at >400000004d8b2c1512e7f934 delivery 14031: deferral:
Connected_to_180.222.96.138_but_connection_died._(#4.4.2)/

< at >400000004d8b2c1512e810a4 status: local 0/10 remote 254/255

< at >400000004d8b2c1512e8242c starting delivery 14111: msg 854481 to remote
mgupta314-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

< at >400000004d8b2c1512e833cc status: local 0/10 remote 255/255

< at >400000004d8b2c1530fab434 delivery 13891: deferral:
Connected_to_180.222.96.138_but_connection_died._(#4.4.2)/

< at >400000004d8b2c1530facf8c status: local 0/10 remote 254/255

< at >400000004d8b2c1530fae314 starting delivery 14112: msg 854481 to remote
mgulati_19nov-/E1597aS9LQxFYw1CcD5bw< at >public.gmane.org

  

 

how to find out by which user it's sending from my server. I think one of my
users infacted, and from his login it's all sending.

Relay clinet configured proparly.

 

Thanks in advace

How to find out who is spamming

Shaumarov Boburhon — 2011-03-24T11:37:39

RE: --SPAM-- Qmail Attachment

Ravi Bhargav — 2011-03-23T15:52:54

Thx Torsten for the quick response. 
I will give out a try & will post the results :-)
Thx
Ravi

Sent from my Nokia Phone
-----Original Message-----
From: Torsten Kersandt
Sent:  23/03/2011 9:02:04 PM
Subject:  RE: [qmr] --SPAM-- Qmail Attachment

Hi Ravi

To point 1

A almost easy way to deal with databytes per user is to use the
/etc/tcp.smtp file but this requires all PC's in the network to have fixed
IP's

You can set the DATABYTES variable from tcpserver, just like RELAYCLIENT.

1.1.1.1.:allow,DATABYTES="500000"

1.1.1.2.:allow,DATABYTES="5000000"

A second, more dynamic possibility would be to use the auth.cdb method as in

http://qmail.jms1.net/scripts/mkauth.shtml

Both would simply overwrite the databytes set in the config 

Point 2

You could have just done a "svc -d /service/qmail-send" to stop the outgoing
messages and given you more time to deal with individual messages.

In addition, user education is a good start but after years and years of
that I still have people sending 75 MB emails to gmail and sorts.

Or you can create a smtproutes file entry for those domains and route the
emails to a BW limited server.

You can install a second qmail on the server and bind this qmail-send to a
specific IP address (qmail-1.03-bind-interface.patch).

I use this to queue outgoing per service/domain on single machines because
of spf and sorts.

After that it is up to your firewall skills to throttle any from IP2 =>
destination:25

3.

Search for qmail-cleaner on the net, it's a python script in combination
with qmhandle
Other than that you can use the Webmin module for qmail, quiet nicely
actually

Regards
torsten

From: Ravi bhargav [mailto:ravibhargav76-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org] 
Sent: 23 March 2011 14:43
To: qmr-iGp6mRlwfsr/sFSC9fAAV0B+6BGkLq7r< at >public.gmane.org
Subject: [qmr] --SPAM-- Qmail Attachment

Hi,

I have a Qmail server running in a corprate enviroment since 3 years.  I
have 3 queries.. Somebody please suggest me if these can be solved :-)

1. I have set the attachment size in  in /var/qmail/control/databytes.  Now
the size what I have specified in the databytes applies to all the users. Is
there a way I can specify different attachment size for different catagory
of users, say for developers is 4M, executives, is 8M, and something which
is how possible on MS exchange?

2. Marking on the above point, since we have attachment size set globally to
all the mailboxes, there are situations when there is possibility of choking
our internet bandwidth when every body are sending mails with attachments.
This is effecting our business mails to reach the recipients on time as it
is a first come first out.  Is there a way I can defer all the mails other
than the business mails which are in the queue?  LIke ex.  If in queue I see
so many mails to Yahoo, hotmail & the client domains too & I just need to
defer the mails going to yahoo,hotmail and allow for client domains only.  

Since there was a internet bandwidth choke, I had to delete all the emails
in queue and we lost all business related mails along with the personal
mails.  

3. I am using qmHandle to see all the emails in queue.  Is there a better
tool which helps in the queue management and queue monitoring?

Thanks,

Ravi Bhargav

RE: --SPAM-- Qmail Attachment

Torsten Kersandt — 2011-03-23T15:32:04

Hi Ravi

 

To point 1

A almost easy way to deal with databytes per user is to use the
/etc/tcp.smtp file but this requires all PC's in the network to have fixed
IP's

 

You can set the DATABYTES variable from tcpserver, just like RELAYCLIENT.

1.1.1.1.:allow,DATABYTES="500000"

1.1.1.2.:allow,DATABYTES="5000000"

 

A second, more dynamic possibility would be to use the auth.cdb method as in

http://qmail.jms1.net/scripts/mkauth.shtml

 

Both would simply overwrite the databytes set in the config 

 

Point 2

You could have just done a "svc -d /service/qmail-send" to stop the outgoing
messages and given you more time to deal with individual messages.

In addition, user education is a good start but after years and years of
that I still have people sending 75 MB emails to gmail and sorts.

 

Or you can create a smtproutes file entry for those domains and route the
emails to a BW limited server.

You can install a second qmail on the server and bind this qmail-send to a
specific IP address (qmail-1.03-bind-interface.patch).

I use this to queue outgoing per service/domain on single machines because
of spf and sorts.

After that it is up to your firewall skills to throttle any from IP2 =>
destination:25

 

3.

Search for qmail-cleaner on the net, it's a python script in combination
with qmhandle
Other than that you can use the Webmin module for qmail, quiet nicely
actually
 
Regards
torsten

 

 

 

From: Ravi bhargav [mailto:ravibhargav76-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org] 
Sent: 23 March 2011 14:43
To: qmr-iGp6mRlwfsr/sFSC9fAAV0B+6BGkLq7r< at >public.gmane.org
Subject: [qmr] --SPAM-- Qmail Attachment

 

Hi,

 

I have a Qmail server running in a corprate enviroment since 3 years.  I
have 3 queries.. Somebody please suggest me if these can be solved :-)

 

1. I have set the attachment size in  in /var/qmail/control/databytes.  Now
the size what I have specified in the databytes applies to all the users. Is
there a way I can specify different attachment size for different catagory
of users, say for developers is 4M, executives, is 8M, and something which
is how possible on MS exchange?

 

2. Marking on the above point, since we have attachment size set globally to
all the mailboxes, there are situations when there is possibility of choking
our internet bandwidth when every body are sending mails with attachments.
This is effecting our business mails to reach the recipients on time as it
is a first come first out.  Is there a way I can defer all the mails other
than the business mails which are in the queue?  LIke ex.  If in queue I see
so many mails to Yahoo, hotmail & the client domains too & I just need to
defer the mails going to yahoo,hotmail and allow for client domains only.  

Since there was a internet bandwidth choke, I had to delete all the emails
in queue and we lost all business related mails along with the personal
mails.  

 

3. I am using qmHandle to see all the emails in queue.  Is there a better
tool which helps in the queue management and queue monitoring?

 

Thanks,

 

Ravi Bhargav

--SPAM-- Qmail Attachment

Ravi bhargav — 2011-03-23T14:42:56

Hi,

I have a Qmail server running in a corprate enviroment since 3 years.  I
have 3 queries.. Somebody please suggest me if these can be solved :-)

1. I have set the attachment size in  in /var/*qmail*/control/databytes.
Now the size what I have specified in the databytes applies to all the
users. Is there a way I can specify different attachment size for different
catagory of users, say for developers is 4M, executives, is 8M, and
something which is how possible on MS exchange?

2. Marking on the above point, since we have attachment size set globally to
all the mailboxes, there are situations when there is possibility of choking
our internet bandwidth when every body are sending mails with attachments.
This is effecting our business mails to reach the recipients on time as it
is a first come first out.  Is there a way I can defer all the mails other
than the business mails which are in the queue?  LIke ex.  If in queue I see
so many mails to Yahoo, hotmail & the client domains too & I just need to
defer the mails going to yahoo,hotmail and allow for client domains only.
Since there was a internet bandwidth choke, I had to delete all the emails
in queue and we lost all business related mails along with the personal
mails.

3. I am using qmHandle to see all the emails in queue.  Is there a better
tool which helps in the queue management and queue monitoring?

Thanks,

Ravi Bhargav

Re: Blocking mails to external id's

Shepherd Nhongo — 2011-03-23T12:25:59

correct

Re: Blocking mails to external id's

Gustavo Castro — 2011-03-23T11:18:59

Ajan:

  Looks like this is what you are looking for: http://www.inter7.com/?page=empf

2011/3/23 Ajan-netBIOS <ajan-FA1va909hu6f0DUV/oxz1A< at >public.gmane.org>:

Re: Blocking mails to external id's

Shepherd Nhongo — 2011-03-23T10:02:50

The mail boxes already exist that CBS is for new accounts only

Sent from my iPhone® 

On Mar 23, 2011, at 11:13 AM, rahul asai <asai.rahul-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org> wrote: