Same time in /var/log/qmail/smtp/current show this log:
@400000004c20ae8b0e33b054 CHKUSER accepted null sender: from <::> remote
<eslovenia.intralesc.sc.gov.br:unknown:200.192.66.25> rcpt <> : accepted
null sender always
@400000004c20ae8c09af4944 tcpserver: status: 14/100
@400000004c20ae8c09af5114 tcpserver: pid 8948 from 123.127.247.104
@400000004c20ae8c09af54fc tcpserver: ok 8948 net:10.1.1.254:25
:123.127.247.104::55903
@400000004c20ae90008f12f4 CHKUSER accepted null sender: from <::> remote
<exchange.lvcgroup.com:unknown:123.127.247.104> rcpt <> : accepted null
sender always
@400000004c20ae920602eae4 tcpserver: status: 15/100
@400000004c20ae920602f2b4 tcpserver: pid 8950 from 200.228.168.2
@400000004c20ae920602f69c tcpserver: ok 8950 net:10.1.1.254:25
:200.228.168.2::52084
@400000004c20ae92225def7c tcpserver: end 8948 status 0
@400000004c20ae92225df74c tcpserver: status: 14/100
@400000004c20ae931ac30d24 CHKUSER accepted null sender: from <::> remote
<server.aceam.unb.org.br:unknown:200.228.168.2> rcpt <> : accepted null
sender always
in /var/log/maillog
Jun 22 09:37:27 net spamdyke[8948]: DENIED_RDNS_MISSING from: (unknown)
to: [email protected] origin_ip: 123.127.247.104 origin_rdns:
(unknown) auth: (unknown)
Jun 22 09:37:29 net spamdyke[8950]: DENIED_RDNS_MISSING from: (unknown)
to: [email protected] origin_ip: 200.228.168.2 origin_rdns:
(unknown) auth: (unknown)
Jun 22 09:37:44 net spamdyke[8952]: DENIED_RDNS_MISSING from: (unknown)
to: [email protected] origin_ip: 200.228.168.2 origin_rdns:
(unknown) auth: (unknown)
Jun 22 09:38:03 net spamdyke[8954]: DENIED_RDNS_MISSING from: (unknown)
to: [email protected] origin_ip: 195.235.66.91 origin_rdns:
(unknown) auth: (unknown)
________________________________________________________________________________________________________________________________
Rafael Andrade <http://www.riosulense.com.br>
...Administrador de Sistemas
. 47 3531-4152
Antes de imprimir, pense em sua responsabilidade e compromisso com o
Meio Ambiente!
senthil vel escreveu:
Honestly, I am not using, spamdyke. Does spamtyke appends all the log
to /var/log/maillog? also seems spamdyke is rejecting these mails. Is
this current log? if so somebody still sending mails. Can't you get
any information from /var/log/qmail/smtp/current regarding this?
On Tue, Jun 22, 2010 at 5:43 PM, Rafael Andrade
<[email protected] <mailto:[email protected]>> wrote:
Look in /var/log/maillog
Jun 22 09:02:10 net spamdyke[5028]: DENIED_RDNS_MISSING from:
(unknown) to: [email protected]
<mailto:[email protected]> origin_ip: 189.2.134.108
origin_rdns: (unknown) auth: (unknown)
Jun 22 09:02:11 net spamdyke[5024]: DENIED_RDNS_MISSING from:
[email protected]
<mailto:[email protected]> to:
[email protected] <mailto:[email protected]> origin_ip:
79.189.227.34 origin_rdns: (unknown) auth: (unknown)
Jun 22 09:02:14 net spamdyke[5025]: DENIED_RDNS_MISSING from:
[email protected] <mailto:[email protected]> to:
[email protected] <mailto:[email protected]> origin_ip:
80.184.67.122 origin_rdns: (unknown) auth: (unknown)
Jun 22 09:02:14 net spamdyke[5026]: DENIED_RDNS_RESOLVE from:
(unknown) to: [email protected]
<mailto:[email protected]> origin_ip: 209.113.141.35
origin_rdns: mlsvr01.mindleaf.com <http://mlsvr01.mindleaf.com>
auth: (unknown)
Jun 22 09:02:44 net spamdyke[5033]: DENIED_RDNS_MISSING from:
(unknown) to: [email protected]
<mailto:[email protected]> origin_ip: 200.143.203.70
origin_rdns: (unknown) auth: (unknown)
Jun 22 09:02:50 net spamdyke[5032]: DENIED_OTHER from:
[email protected] <mailto:[email protected]> to:
[email protected] <mailto:[email protected]>
origin_ip: 200.185.80.78 origin_rdns: smtp4.votorantim.com.br
<http://smtp4.votorantim.com.br> auth: (unknown)
Jun 22 09:03:09 net spamdyke[5043]: DENIED_RDNS_MISSING from:
(unknown) to: [email protected]
<mailto:[email protected]> origin_ip: 202.181.238.101
origin_rdns: (unknown) auth: (unknown)
Jun 22 09:03:26 net spamdyke[5046]: DENIED_RDNS_MISSING from:
(unknown) to: [email protected]
<mailto:[email protected]> origin_ip: 200.14.68.55
origin_rdns: (unknown) auth: (unknown)
Jun 22 09:03:30 net spamdyke[5050]: DENIED_RDNS_MISSING from:
(unknown) to: [email protected]
<mailto:[email protected]> origin_ip: 200.228.168.2
origin_rdns: (unknown) auth: (unknown)
Jun 22 09:03:42 net spamdyke[5106]: DENIED_RDNS_MISSING from:
(unknown) to: [email protected]
<mailto:[email protected]> origin_ip: 200.228.168.2
origin_rdns: (unknown) auth: (unknown)
Jun 22 09:03:53 net spamdyke[5108]: DENIED_RBL_MATCH from:
(unknown) to: [email protected]
<mailto:[email protected]> origin_ip: 201.76.223.15
origin_rdns: send.wnetrj.com.br <http://send.wnetrj.com.br> auth:
(unknown)
The ips are spoofing?
Actually im not using 587 port
Im using vpopmail to auth my users.
Thanks so much!!
senthil vel escreveu:
Seems some one is spamming. Any one of your mail account might
be compromised. The server is using port 587 to accept mails
from local users? . /var/log/qmail/submission or
/var/log/qmail/smtp will tell the truth.
say for example, search for "[email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>>" in above mentioned logs.
So that we can get the origination of this mail. If it is
using a local mail id for authentication, reset the password
of the mail. Also remove the mails in queue using qmail-remove.
--Senthilvel.
On Tue, Jun 22, 2010 at 4:29 PM, Rafael Andrade
<[email protected] <mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>>> wrote:
Hello list,
I have a production server with qmailtoaster on centos
running 2
years perfectly, recently the server stuck, with many
messages in
queue, i need to stop qmail, clean the queue and running qmail
again, but i need a solution to fix this problem, any knows
or can
help?
Thanks so much
Examples in queue:
Client = Hide Client Domain
[r...@net ~]# qmailctl queue | head
messages in queue: 14691
messages in queue but not yet preprocessed: 2
21 Jun 2010 22:45:02 GMT #3087267 1435
<[email protected] <mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>>>
remote [email protected]
<mailto:[email protected]>
<mailto:[email protected] <mailto:[email protected]>>
21 Jun 2010 22:34:44 GMT #3069258 1430
<[email protected] <mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>>>
remote [email protected]
<mailto:[email protected]> <mailto:[email protected]
<mailto:[email protected]>>
21 Jun 2010 22:44:39 GMT #3079585 1439
<[email protected] <mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>>>
remote [email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>>
22 Jun 2010 00:02:57 GMT #2443198 1438
<[email protected] <mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>>>
remote [email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>>
Thanks so much
---------------------------------------------------------------------------------
Qmailtoaster is sponsored by Vickers Consulting Group
(www.vickersconsulting.com
<http://www.vickersconsulting.com>
<http://www.vickersconsulting.com>)
Vickers Consulting Group offers Qmailtoaster support and
installations.
If you need professional help with your setup, contact
them today!
---------------------------------------------------------------------------------
Please visit qmailtoaster.com <http://qmailtoaster.com>
<http://qmailtoaster.com> for the
latest news, updates, and packages.
To unsubscribe, e-mail:
[email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>>
For additional commands, e-mail:
[email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>>
---------------------------------------------------------------------------------
Qmailtoaster is sponsored by Vickers Consulting Group
(www.vickersconsulting.com <http://www.vickersconsulting.com>)
Vickers Consulting Group offers Qmailtoaster support and
installations.
If you need professional help with your setup, contact them today!
---------------------------------------------------------------------------------
Please visit qmailtoaster.com <http://qmailtoaster.com> for the
latest news, updates, and packages.
To unsubscribe, e-mail:
[email protected]
<mailto:[email protected]>
For additional commands, e-mail:
[email protected]
<mailto:[email protected]>
---------------------------------------------------------------------------------
Qmailtoaster is sponsored by Vickers Consulting Group
(www.vickersconsulting.com)
Vickers Consulting Group offers Qmailtoaster support and installations.
If you need professional help with your setup, contact them today!
---------------------------------------------------------------------------------
Please visit qmailtoaster.com for the latest news, updates, and packages.
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
