<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 3/27/2013 7:21 AM, (NSD) Thomas
Petersen wrote:<br>
</div>
<blockquote
cite="mid:CA84A5C82D168541ABE2DC472C9E623935A75E8D94@NSD-SBS01.nsd.local"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:3.0cm 2.0cm 3.0cm 2.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Anyone
?<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif"">Fra:</span></b><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif"">
<a class="moz-txt-link-abbreviated" href="mailto:blueonyx-bounces@mail.blueonyx.it">blueonyx-bounces@mail.blueonyx.it</a>
[<a class="moz-txt-link-freetext" href="mailto:blueonyx-bounces@mail.blueonyx.it">mailto:blueonyx-bounces@mail.blueonyx.it</a>] <b>På vegne af </b>Marcello
Torchio<br>
<b>Sendt:</b> 23. marts 2013 07:09<br>
<b>Til:</b> BlueOnyx General Mailing List<br>
<b>Emne:</b> [BlueOnyx:12606] Maximum number of RCPTs for
Vhost<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Good morning
sirs (+1 GMT),<br>
<br>
i've a few question about sendmail settings.<br>
<br>
Recently i have been subject of a spam attack. A mailbox
password was stolen and a bot sends spam through my BO 5108R
server.<br>
<br>
Honestly I have not noticed the issue until the server has
not been put in some blacklists.<br>
<br>
First question, is it possible to have a monitor tool to
understand if there is a spamming activity on the mail
server?<br>
<br>
For example a threshold number of RCPTs in outgoing messages
that can alert the administrator when exceeded, or the
content of messages or i don't know...<br>
One of the wrong setting was that the outgoing mail were not
analyzed by AvSPAM, but only the incoming mail.<br>
<br>
I've reduced the maximum number oc RCPTs to 5. But one of
our customer need to write up to 40 RCPTs.<br>
<br>
Second question: Is it possible to setup Vhost dedicated
maximum number of RCPTS?<br>
<br>
Have someone of you tips&tricks to monitor and prevent
this spam mailing and blacklisting?<br>
<br>
Thanks<br>
<br>
Marcello Torchio<o:p></o:p></p>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Blueonyx mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Blueonyx@mail.blueonyx.it">Blueonyx@mail.blueonyx.it</a>
<a class="moz-txt-link-freetext" href="http://mail.blueonyx.it/mailman/listinfo/blueonyx">http://mail.blueonyx.it/mailman/listinfo/blueonyx</a>
</pre>
</blockquote>
Marcelo<br>
<br>
<br>
Here is a perl script that you could run that will tell you is the
mailq is large<br>
<br>
#!/usr/bin/perl<br>
##################################################################<br>
# This script will check the mailq and email if it is over 200<br>
#################################################################<br>
use <a class="moz-txt-link-freetext" href="MIME::Lite">MIME::Lite</a>;<br>
<br>
<br>
$mailq = `ls /var/spool/mqueue | grep df -c`;<br>
chomp ($mailq);<br>
<br>
$serverdomain = "someserver.com";<br>
<br>
$alertsto = <a class="moz-txt-link-rfc2396E" href="mailto:123456789\@txt.att.nett">"123456789\@txt.att.net t"</a>;<br>
<br>
if ($mailq > 200) {<br>
print "mailq count is $mailq";<br>
#email me<br>
$emailbody = "The mailq count is $mailq on the $serverdomain server.
<BR> Check for spamming issues.<BR>";<br>
$emailbody .= "The mailq command on the server is: mailq <BR><br>
Generally the method I use to find the culprit is:<BR><br>
-Type mailq and note one of the mail id numbers, eg.
oBLJkG8L005990 <BR><br>
That id will correspond to 2 files in the /var/lpool/mqueue/
<BR><br>
e.g. dfoBLJkG8L005990 and qfoBLJkG8L005990 <BR> <BR><br>
<br>
- Then to see if it is spam, look at the content of that file by
typing <BR> <br>
cat /var/spool/mqueue/*oBLJkG8L005990<BR><br>
or<BR><br>
cat /var/spool/mqueue/*oBLJkG8L005990 | more <BR><BR><br>
<br>
- Then you can cat the maillog and grep for the IP address or email
address. <BR><br>
That should show you the authid that they are using so send with;
e.g. elisa <BR><BR><br>
<br>
- To see which site elisa belings to you can type cd ~elisa
<BR><br>
Then ls -al and note the site number. <BR><br>
Then ls -la /home/sites/ | grep site[thesitenumberhere] <BR>
<BR><br>
Then change the pass for that user. <BR><br>
Then delete the outgoing spam files <BR> <BR><br>
<br>
Or, if the sender of the spam is apache, then a php script is
sending the spam. <BR><br>
In that case, check the maillog for the send times. Then crosscheck
the times with the the command<BR><br>
cat /var/log/httpd/access_log | grep php | grep
[thetime]<BR><br>
e.g. cat /var/log/httpd/access_log | grep php | grep
12:40<BR><br>
Then move the compromised script. <BR><br>
<br>
<br>
";<br>
<br>
my $msg = <a class="moz-txt-link-freetext" href="MIME::Lite">MIME::Lite</a>->new<br>
(<br>
Subject => "Large mailq for $serverdomain", <br>
From => "$alertsto",<br>
To => $alertsto,<br>
Cc => "$alertsto",<br>
Type => 'text/html',<br>
Data => "$emailbody"<br>
);<br>
<br>
$msg->send();<br>
<br>
<br>
}<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
Ken Marcus<br>
<br>
</body>
</html>