<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
thank you Chuck, that helped indeed!<br>
<br>
there were about 16'000 files in /var/spool/mqueue, incredible! And
I had to restart sendmail *immediately* after deleting them all,
else the queue got populated again right away... How that happens, I
wonder...<br>
<br>
I hope this will last for a while, it did it until yet.<br>
<br>
Thank you so much for your help!<br>
<br>
Meaulnes Legler<font size="2"><br>
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ <br>
~ <a moz-do-not-send="true" target="_blank"
href="http://www.waveweb.ch/">www.WaveWeb.ch</a> ~ <br>
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ <br>
~ Zurich, Switzerland ~ <br>
~ +41\0 44 260 16 60 ~ <br>
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ </font><br>
<br>
<br>
<div class="moz-cite-prefix">On 15/06/16 17:13, Chuck Tetlow wrote:<br>
</div>
<blockquote cite="mid:20160615150725.M4366@tetlow.net" type="cite">
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
<meta content="OPENWEBMAIL" name="GENERATOR">
It may be mail still on the server, waiting to go out. And as
soon as you enable Sendmail again - it starts flowing. <br>
<br>
Check to see what's waiting on the server to go out with the
command-line command "mailq", or if its long - "mailq | more".
The last line should be the number of messages waiting to go out
from your server. Most servers are usually 0 - since mail goes
out quickly. If there just a few - this isn't the problem. But
if there are a LOT (I've seen 40,000+ on a exploited server
before) - you have to get rid of them! <br>
<br>
In that case, go into /var/spool/mqueue - which is the directory
mail sits in while waiting to go out. Each message is either one
or two files - so there could be a LOT of files in here if there
are a lot of messages in the "mailq" output. And while there
could be valid customer e-mails in there - its VERY time consuming
to identify which is which. So I just delete everything in that
directory - risking loosing a couple of valid customer e-mails
along with all the SPAM in there. Just "rm -f *" in that
directory to get rid of them all, and then restart the mail
services on your server. <br>
<br>
Good luck cleaning up. I know your pain!! <br>
<br>
<br>
Chuck <br>
<br>
<font size="2"> <br>
<br>
<b>---------- Original Message -----------</b> <br>
From: Meaulnes Legler <a class="moz-txt-link-rfc2396E"
href="mailto:bluelist@waveweb.ch"><bluelist@waveweb.ch></a>
<br>
To: BlueOnyx General Mailing List <a
class="moz-txt-link-rfc2396E"
href="mailto:blueonyx@mail.blueonyx.it"><a class="moz-txt-link-rfc2396E" href="mailto:blueonyx@mail.blueonyx.it"><blueonyx@mail.blueonyx.it></a></a>
<br>
Sent: Wed, 15 Jun 2016 16:43:34 +0200 <br>
Subject: [BlueOnyx:19711] prevent user from sending e-mail in
/etc/mail/access <br>
<br>
> dear list <br>
> <br>
> with iptables, I have been able to stop the e-mail flooding
attacking a <br>
> specific user, see previous post [BlueOnyx:19698] Re:
e-mail flooding <br>
> <br>
> But that user is still sending out tons of mails if I
enable it again <br>
> (unchecking «Suspend» in the GUI), thousands in a couple of
hours with <br>
> subjects like: <br>
> Subject: Warning: could not send message for past 4
hours <br>
> Subject: Returned mail: see transcript for details <br>
> That user must have some virus and I'm afraid that my
server will be <br>
> tagged... <br>
> <br>
> I read that I could prevent user from sending e-mail by
adding these <br>
> lines to /etc/mail/access <br>
> <a class="moz-txt-link-abbreviated"
href="mailto:From:janis@legler.org">From:janis@legler.org</a>
REJECT # Reject user from sending mails <br>
> and restarting sendmail. But /etc/mail/access is pretty
much empty: <br>
> <br>
> -------------------------------------------- <br>
> # By default we allow relaying from localhost... <br>
> Connect:localhost.localdomain RELAY <br>
> Connect:localhost RELAY <br>
> Connect:127.0.0.1 RELAY <br>
> # Cobalt Access Section Begin <br>
> <br>
> # Cobalt Access Section End <br>
> /etc/mail/access lines 1-15/15 (END) <br>
> -------------------------------------------- <br>
> <br>
> Can I do so as said above without compromising the mailer?
<br>
> <br>
> Thank you and best regards <br>
> <br>
> Meaulnes Legler <br>
> ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ <br>
> ~ <a moz-do-not-send="true" target="_blank"
href="http://www.waveweb.ch/">http://www.WaveWeb.ch</a> ~ <br>
> ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ <br>
> ~ Zurich, Switzerland ~ <br>
> ~ +41\0 44 260 16 60 ~ <br>
> ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ <br>
> <br>
> _______________________________________________ <br>
> Blueonyx mailing list <br>
> <a class="moz-txt-link-abbreviated"
href="mailto:Blueonyx@mail.blueonyx.it">Blueonyx@mail.blueonyx.it</a>
<br>
> <a moz-do-not-send="true" target="_blank"
href="http://mail.blueonyx.it/mailman/listinfo/blueonyx">http://mail.blueonyx.it/mailman/listinfo/blueonyx</a>
<br>
<b>------- End of Original Message -------</b> <br>
</font> </blockquote>
<br>
</body>
</html>