<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix"><br>
I find that webmin is a handy tool for stuff like this<br>
<br>
<br>
<br>
<br>
</div>
<blockquote cite="mid:20160615150725.M4366@tetlow.net" type="cite">
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
<meta content="OPENWEBMAIL" name="GENERATOR">
It may be mail still on the server, waiting to go out. And as
soon as you enable Sendmail again - it starts flowing.
<br>
<br>
Check to see what's waiting on the server to go out with the
command-line command "mailq", or if its long - "mailq | more".
The last line should be the number of messages waiting to go out
from your server. Most servers are usually 0 - since mail goes
out quickly. If there just a few - this isn't the problem. But
if there are a LOT (I've seen 40,000+ on a exploited server
before) - you have to get rid of them!
<br>
<br>
In that case, go into /var/spool/mqueue - which is the directory
mail sits in while waiting to go out. Each message is either one
or two files - so there could be a LOT of files in here if there
are a lot of messages in the "mailq" output. And while there
could be valid customer e-mails in there - its VERY time consuming
to identify which is which. So I just delete everything in that
directory - risking loosing a couple of valid customer e-mails
along with all the SPAM in there. Just "rm -f *" in that
directory to get rid of them all, and then restart the mail
services on your server.
<br>
<br>
Good luck cleaning up. I know your pain!!
<br>
<br>
<br>
Chuck
<br>
<br>
<font size="2">
<br>
<br>
<b>---------- Original Message -----------</b>
<br>
From: Meaulnes Legler <a class="moz-txt-link-rfc2396E" href="mailto:bluelist@waveweb.ch"><bluelist@waveweb.ch></a> <br>
To: BlueOnyx General Mailing List
<a class="moz-txt-link-rfc2396E" href="mailto:blueonyx@mail.blueonyx.it"><blueonyx@mail.blueonyx.it></a> <br>
Sent: Wed, 15 Jun 2016 16:43:34 +0200 <br>
Subject: [BlueOnyx:19711] prevent user from sending e-mail in
/etc/mail/access <br>
<br>
> dear list <br>
> <br>
> with iptables, I have been able to stop the e-mail flooding
attacking a <br>
> specific user, see previous post [BlueOnyx:19698] Re:
e-mail flooding <br>
> <br>
> But that user is still sending out tons of mails if I
enable it again <br>
> (unchecking «Suspend» in the GUI), thousands in a couple of
hours with <br>
> subjects like: <br>
> Subject: Warning: could not send message for past 4
hours <br>
> Subject: Returned mail: see transcript for details <br>
> That user must have some virus and I'm afraid that my
server will be <br>
> tagged... <br>
> <br>
> I read that I could prevent user from sending e-mail by
adding these <br>
> lines to /etc/mail/access <br>
> <a class="moz-txt-link-abbreviated" href="mailto:From:janis@legler.org">From:janis@legler.org</a> REJECT
# Reject user from sending mails <br>
> and restarting sendmail. But /etc/mail/access is pretty
much empty: <br>
> <br>
> -------------------------------------------- <br>
> # By default we allow relaying from localhost... <br>
> Connect:localhost.localdomain RELAY <br>
> Connect:localhost RELAY <br>
> Connect:127.0.0.1 RELAY <br>
> # Cobalt Access Section Begin <br>
> <br>
> # Cobalt Access Section End <br>
> /etc/mail/access lines 1-15/15 (END) <br>
> -------------------------------------------- <br>
> <br>
> Can I do so as said above without compromising the mailer?
<br>
> <br>
> Thank you and best regards <br>
> <br>
> Meaulnes Legler <br>
> ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ <br>
> ~ <a moz-do-not-send="true" target="_blank"
href="http://www.waveweb.ch/">http://www.WaveWeb.ch</a> ~ <br>
> ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ <br>
> ~ Zurich, Switzerland ~ <br>
> ~ +41\0 44 260 16 60 ~ <br>
> ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ <br>
> <br>
> _______________________________________________ <br>
> Blueonyx mailing list <br>
> <a class="moz-txt-link-abbreviated" href="mailto:Blueonyx@mail.blueonyx.it">Blueonyx@mail.blueonyx.it</a> <br>
> <a moz-do-not-send="true" target="_blank"
href="http://mail.blueonyx.it/mailman/listinfo/blueonyx">http://mail.blueonyx.it/mailman/listinfo/blueonyx</a>
<br>
<b>------- End of Original Message -------</b>
<br>
</font>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Blueonyx mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Blueonyx@mail.blueonyx.it">Blueonyx@mail.blueonyx.it</a>
<a class="moz-txt-link-freetext" href="http://mail.blueonyx.it/mailman/listinfo/blueonyx">http://mail.blueonyx.it/mailman/listinfo/blueonyx</a>
</pre>
</blockquote>
<p><br>
</p>
</body>
</html>