<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta name=Generator content="Microsoft Word 12 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";
color:black;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
color:black;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Arial","sans-serif";
color:#1F497D;
font-weight:normal;
font-style:normal;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";
color:black;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:85.05pt 56.7pt 85.05pt 56.7pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body bgcolor=white lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D'>My best suggestion would be to have AV-SPAM scan outgoing mail.<o:p></o:p></span></b></p><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D'>This should be the default setting – do you know why it was changed?<o:p></o:p></span></b></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'> blueonyx-bounces@mail.blueonyx.it [mailto:blueonyx-bounces@mail.blueonyx.it] <b>On Behalf Of </b>Ken Marcus<br><b>Sent:</b> Wednesday, March 27, 2013 12:17 PM<br><b>To:</b> BlueOnyx General Mailing List<br><b>Subject:</b> [BlueOnyx:12625] Re: Maximum number of RCPTs for Vhost<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>On 3/27/2013 7:21 AM, (NSD) Thomas Petersen wrote:<o:p></o:p></p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Anyone ?</span><o:p></o:p></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal><b><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>Fra:</span></b><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'> <a href="mailto:blueonyx-bounces@mail.blueonyx.it">blueonyx-bounces@mail.blueonyx.it</a> [<a href="mailto:blueonyx-bounces@mail.blueonyx.it">mailto:blueonyx-bounces@mail.blueonyx.it</a>] <b>På vegne af </b>Marcello Torchio<br><b>Sendt:</b> 23. marts 2013 07:09<br><b>Til:</b> BlueOnyx General Mailing List<br><b>Emne:</b> [BlueOnyx:12606] Maximum number of RCPTs for Vhost</span><o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><div><p class=MsoNormal style='margin-bottom:12.0pt'>Good morning sirs (+1 GMT),<br><br>i've a few question about sendmail settings.<br><br>Recently i have been subject of a spam attack. A mailbox password was stolen and a bot sends spam through my BO 5108R server.<br><br>Honestly I have not noticed the issue until the server has not been put in some blacklists.<br><br>First question, is it possible to have a monitor tool to understand if there is a spamming activity on the mail server?<br><br>For example a threshold number of RCPTs in outgoing messages that can alert the administrator when exceeded, or the content of messages or i don't know...<br>One of the wrong setting was that the outgoing mail were not analyzed by AvSPAM, but only the incoming mail.<br><br>I've reduced the maximum number oc RCPTs to 5. But one of our customer need to write up to 40 RCPTs.<br><br>Second question: Is it possible to setup Vhost dedicated maximum number of RCPTS?<br><br>Have someone of you tips&tricks to monitor and prevent this spam mailing and blacklisting?<br><br>Thanks<br><br>Marcello Torchio<o:p></o:p></p></div><p class=MsoNormal><br><br><br><o:p></o:p></p><pre>_______________________________________________<o:p></o:p></pre><pre>Blueonyx mailing list<o:p></o:p></pre><pre><a href="mailto:Blueonyx@mail.blueonyx.it">Blueonyx@mail.blueonyx.it</a><o:p></o:p></pre><pre><a href="http://mail.blueonyx.it/mailman/listinfo/blueonyx">http://mail.blueonyx.it/mailman/listinfo/blueonyx</a><o:p></o:p></pre></blockquote><p class=MsoNormal style='margin-bottom:12.0pt'>Marcelo<br><br><br>Here is a perl script that you could run that will tell you is the mailq is large<br><br>#!/usr/bin/perl<br>##################################################################<br># This script will check the mailq and email if it is over 200<br>#################################################################<br>use <a href="MIME::Lite">MIME::Lite</a>;<br><br><br>$mailq = `ls /var/spool/mqueue | grep df -c`;<br>chomp ($mailq);<br><br>$serverdomain = "someserver.com";<br><br>$alertsto = <a href="mailto:123456789\@txt.att.nett">"123456789\@txt.att.net t"</a>;<br><br>if ($mailq > 200) {<br> print "mailq count is $mailq";<br> #email me<br>$emailbody = "The mailq count is $mailq on the $serverdomain server. <BR> Check for spamming issues.<BR>";<br>$emailbody .= "The mailq command on the server is: mailq <BR><br>Generally the method I use to find the culprit is:<BR><br>-Type mailq and note one of the mail id numbers, eg. oBLJkG8L005990 <BR><br>That id will correspond to 2 files in the /var/lpool/mqueue/ <BR><br>e.g. dfoBLJkG8L005990 and qfoBLJkG8L005990 <BR> <BR><br><br>- Then to see if it is spam, look at the content of that file by typing <BR> <br>cat /var/spool/mqueue/*oBLJkG8L005990<BR><br>or<BR><br>cat /var/spool/mqueue/*oBLJkG8L005990 | more <BR><BR><br><br>- Then you can cat the maillog and grep for the IP address or email address. <BR><br>That should show you the authid that they are using so send with; e.g. elisa <BR><BR><br><br>- To see which site elisa belings to you can type cd ~elisa <BR><br>Then ls -al and note the site number. <BR><br>Then ls -la /home/sites/ | grep site[thesitenumberhere] <BR> <BR><br>Then change the pass for that user. <BR><br>Then delete the outgoing spam files <BR> <BR><br><br>Or, if the sender of the spam is apache, then a php script is sending the spam. <BR><br>In that case, check the maillog for the send times. Then crosscheck the times with the the command<BR><br>cat /var/log/httpd/access_log | grep php | grep [thetime]<BR><br>e.g. cat /var/log/httpd/access_log | grep php | grep 12:40<BR><br>Then move the compromised script. <BR><br><br><br>";<br><br>my $msg = <a href="MIME::Lite">MIME::Lite</a>->new<br>(<br>Subject => "Large mailq for $serverdomain", <br>From => "$alertsto",<br>To => $alertsto,<br>Cc => "$alertsto",<br>Type => 'text/html',<br>Data => "$emailbody"<br>);<br><br>$msg->send();<br><br> <br>}<br><br><br><br><br><br><br><br><br><br><br>Ken Marcus<o:p></o:p></p></div></body></html>