cat /var/log/qmail/smtp/* | grep -i [email protected]
(empty)
cat /var/log/qmail/submission/* | grep -i [email protected]
(empty)
:(
still showing in maillog:
Jun 22 10:59:33 net spamdyke[16032]: DENIED_RDNS_MISSING from: (unknown)
to: [email protected] origin_ip: 200.228.168.2 origin_rdns:
(unknown) auth: (unknown)
Jun 22 10:59:43 net spamdyke[16034]: DENIED_RDNS_MISSING from: (unknown)
to: [email protected] origin_ip: 200.228.168.2 origin_rdns:
(unknown) auth: (unknown)
Jun 22 11:00:15 net spamdyke[16038]: DENIED_OTHER from: (unknown) to:
[email protected] origin_ip: 64.20.61.10 origin_rdns:
ip10.njs0.srv.infoex.com auth: (unknown)
Jun 22 11:00:30 net spamdyke[16042]: DENIED_RDNS_MISSING from: (unknown)
to: [email protected] origin_ip: 200.14.68.55 origin_rdns:
(unknown) auth: (unknown)
Jun 22 11:01:07 net spamdyke[16046]: DENIED_OTHER from: (unknown) to:
[email protected] origin_ip: 200.174.214.66 origin_rdns:
ns.usinamoreno.com.br auth: (unknown)
[r...@net metalservice.ind.br]# cat /var/log/qmail/smtp/current | grep
-i ns.usinamoreno.com.br
@400000004c20b8c62a1ca99c CHKUSER rejected rcpt: from <::> remote
<ns.usinamoreno.com.br:unknown:200.174.214.66> rcpt
<[email protected]> : not existing recipient
@400000004c20bd792b6ff8e4 CHKUSER accepted null sender: from <::> remote
<ns.usinamoreno.com.br:unknown:200.174.214.66> rcpt <> : accepted null
sender always
@400000004c20bd793057445c CHKUSER rejected rcpt: from <::> remote
<ns.usinamoreno.com.br:unknown:200.174.214.66> rcpt
<[email protected]> : not existing recipient
@400000004c20c22b376a2e1c CHKUSER accepted null sender: from <::> remote
<ns.usinamoreno.com.br:unknown:200.174.214.66> rcpt <> : accepted null
sender always
@400000004c20c22c00a04934 CHKUSER rejected rcpt: from <::> remote
<ns.usinamoreno.com.br:unknown:200.174.214.66> rcpt
<[email protected]> : not existing recipient
senthil vel escreveu:
message posted from /var/log/qmail/smtp/current doesnot having any
information regarding this issue
Step 1. #qmailctl queue
it will show the mails in queue. Say for example, i am pasting the
output you have posted in first mail.
21 Jun 2010 22:45:02 GMT #3087267 1435 <[email protected]
<mailto:[email protected]>>
remote [email protected] <mailto:[email protected]>
21 Jun 2010 22:34:44 GMT #3069258 1430 <[email protected]
<mailto:[email protected]>>
remote [email protected] <mailto:[email protected]>
21 Jun 2010 22:44:39 GMT #3079585 1439 <[email protected]
<mailto:[email protected]>>
remote [email protected]
<mailto:[email protected]>
22 Jun 2010 00:02:57 GMT #2443198 1438 <[email protected]
<mailto:[email protected]>>
remote [email protected]
<mailto:[email protected]>
select a mail id which is in 'remote' field. for example let us take,
[email protected]. <mailto:[email protected]>
Step 2. Use the grep command to search the mailid we collected in the
first field.
grep -i '[email protected] <mailto:[email protected]>'
/var/log/qmail/smtp/current
if no results found, check time of the mail in queue (21 Jun 2010
22:45:02) for this mail. if so check the log file which is having this
time stamp. To do this, go to /var/log/qmail/smtp/
#cd /var/log/qmail/smtp/
#ll or # ls -l
check the log file for appropriate date and time.
If anything does not work,
use,
grep -i '[email protected] <mailto:[email protected]>'
/var/log/qmail/smtp/*
grep -i '[email protected] <mailto:[email protected]>'
/var/log/qmail/submission/*
This may take long time and server resource. It will show the log for
origin of the mail.
--Senthilvel.
On Tue, Jun 22, 2010 at 6:16 PM, Rafael Andrade
<[email protected] <mailto:[email protected]>> wrote:
Same time in /var/log/qmail/smtp/current show this log:
@400000004c20ae8b0e33b054 CHKUSER accepted null sender: from <::>
remote <eslovenia.intralesc.sc.gov.br:unknown:200.192.66.25> rcpt
<> : accepted null sender always
@400000004c20ae8c09af4944 tcpserver: status: 14/100
@400000004c20ae8c09af5114 tcpserver: pid 8948 from 123.127.247.104
@400000004c20ae8c09af54fc tcpserver: ok 8948 net:10.1.1.254:25
<http://10.1.1.254:25> :123.127.247.104::55903
@400000004c20ae90008f12f4 CHKUSER accepted null sender: from <::>
remote <exchange.lvcgroup.com:unknown:123.127.247.104> rcpt <> :
accepted null sender always
@400000004c20ae920602eae4 tcpserver: status: 15/100
@400000004c20ae920602f2b4 tcpserver: pid 8950 from 200.228.168.2
@400000004c20ae920602f69c tcpserver: ok 8950 net:10.1.1.254:25
<http://10.1.1.254:25> :200.228.168.2::52084
@400000004c20ae92225def7c tcpserver: end 8948 status 0
@400000004c20ae92225df74c tcpserver: status: 14/100
@400000004c20ae931ac30d24 CHKUSER accepted null sender: from <::>
remote <server.aceam.unb.org.br:unknown:200.228.168.2> rcpt <> :
accepted null sender always
in /var/log/maillog
Jun 22 09:37:27 net spamdyke[8948]: DENIED_RDNS_MISSING from:
(unknown) to: [email protected]
<mailto:[email protected]> origin_ip: 123.127.247.104
origin_rdns: (unknown) auth: (unknown)
Jun 22 09:37:29 net spamdyke[8950]: DENIED_RDNS_MISSING from:
(unknown) to: [email protected]
<mailto:[email protected]> origin_ip: 200.228.168.2
origin_rdns: (unknown) auth: (unknown)
Jun 22 09:37:44 net spamdyke[8952]: DENIED_RDNS_MISSING from:
(unknown) to: [email protected]
<mailto:[email protected]> origin_ip: 200.228.168.2
origin_rdns: (unknown) auth: (unknown)
Jun 22 09:38:03 net spamdyke[8954]: DENIED_RDNS_MISSING from:
(unknown) to: [email protected]
<mailto:[email protected]> origin_ip: 195.235.66.91
origin_rdns: (unknown) auth: (unknown)
________________________________________________________________________________________________________________________________
Rafael Andrade <http://www.riosulense.com.br>
...Administrador de Sistemas
. 47 3531-4152
Antes de imprimir, pense em sua responsabilidade e compromisso com
o Meio Ambiente!
senthil vel escreveu:
Honestly, I am not using, spamdyke. Does spamtyke appends all
the log to /var/log/maillog? also seems spamdyke is rejecting
these mails. Is this current log? if so somebody still sending
mails. Can't you get any information from
/var/log/qmail/smtp/current regarding this?
On Tue, Jun 22, 2010 at 5:43 PM, Rafael Andrade
<[email protected] <mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>>> wrote:
Look in /var/log/maillog
Jun 22 09:02:10 net spamdyke[5028]: DENIED_RDNS_MISSING from:
(unknown) to: [email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>> origin_ip: 189.2.134.108
origin_rdns: (unknown) auth: (unknown)
Jun 22 09:02:11 net spamdyke[5024]: DENIED_RDNS_MISSING from:
[email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>> to:
[email protected] <mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>> origin_ip:
79.189.227.34 origin_rdns: (unknown) auth: (unknown)
Jun 22 09:02:14 net spamdyke[5025]: DENIED_RDNS_MISSING from:
[email protected] <mailto:[email protected]>
<mailto:[email protected] <mailto:[email protected]>> to:
[email protected] <mailto:[email protected]>
<mailto:[email protected] <mailto:[email protected]>>
origin_ip:
80.184.67.122 origin_rdns: (unknown) auth: (unknown)
Jun 22 09:02:14 net spamdyke[5026]: DENIED_RDNS_RESOLVE from:
(unknown) to: [email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>> origin_ip: 209.113.141.35
origin_rdns: mlsvr01.mindleaf.com
<http://mlsvr01.mindleaf.com> <http://mlsvr01.mindleaf.com>
auth: (unknown)
Jun 22 09:02:44 net spamdyke[5033]: DENIED_RDNS_MISSING from:
(unknown) to: [email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>> origin_ip: 200.143.203.70
origin_rdns: (unknown) auth: (unknown)
Jun 22 09:02:50 net spamdyke[5032]: DENIED_OTHER from:
[email protected] <mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>> to:
[email protected] <mailto:[email protected]>
<mailto:[email protected] <mailto:[email protected]>>
origin_ip: 200.185.80.78 origin_rdns:
smtp4.votorantim.com.br <http://smtp4.votorantim.com.br>
<http://smtp4.votorantim.com.br> auth: (unknown)
Jun 22 09:03:09 net spamdyke[5043]: DENIED_RDNS_MISSING from:
(unknown) to: [email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>> origin_ip: 202.181.238.101
origin_rdns: (unknown) auth: (unknown)
Jun 22 09:03:26 net spamdyke[5046]: DENIED_RDNS_MISSING from:
(unknown) to: [email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>> origin_ip: 200.14.68.55
origin_rdns: (unknown) auth: (unknown)
Jun 22 09:03:30 net spamdyke[5050]: DENIED_RDNS_MISSING from:
(unknown) to: [email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>> origin_ip: 200.228.168.2
origin_rdns: (unknown) auth: (unknown)
Jun 22 09:03:42 net spamdyke[5106]: DENIED_RDNS_MISSING from:
(unknown) to: [email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>> origin_ip: 200.228.168.2
origin_rdns: (unknown) auth: (unknown)
Jun 22 09:03:53 net spamdyke[5108]: DENIED_RBL_MATCH from:
(unknown) to: [email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>> origin_ip: 201.76.223.15
origin_rdns: send.wnetrj.com.br <http://send.wnetrj.com.br>
<http://send.wnetrj.com.br> auth:
(unknown)
The ips are spoofing?
Actually im not using 587 port
Im using vpopmail to auth my users.
Thanks so much!!
senthil vel escreveu:
Seems some one is spamming. Any one of your mail
account might
be compromised. The server is using port 587 to accept
mails
from local users? . /var/log/qmail/submission or
/var/log/qmail/smtp will tell the truth.
say for example, search for "[email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>>
<mailto:[email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>>>" in above mentioned logs.
So that we can get the origination of this mail. If it is
using a local mail id for authentication, reset the
password
of the mail. Also remove the mails in queue using
qmail-remove.
--Senthilvel.
On Tue, Jun 22, 2010 at 4:29 PM, Rafael Andrade
<[email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>>
<mailto:[email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>>>> wrote:
Hello list,
I have a production server with qmailtoaster on centos
running 2
years perfectly, recently the server stuck, with many
messages in
queue, i need to stop qmail, clean the queue and
running qmail
again, but i need a solution to fix this problem,
any knows
or can
help?
Thanks so much
Examples in queue:
Client = Hide Client Domain
[r...@net ~]# qmailctl queue | head
messages in queue: 14691
messages in queue but not yet preprocessed: 2
21 Jun 2010 22:45:02 GMT #3087267 1435
<[email protected]
<mailto:[email protected]>
<mailto:[email protected] <mailto:[email protected]>>
<mailto:[email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>>>>
remote [email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>>
<mailto:[email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>>>
21 Jun 2010 22:34:44 GMT #3069258 1430
<[email protected]
<mailto:[email protected]>
<mailto:[email protected] <mailto:[email protected]>>
<mailto:[email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>>>>
remote [email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>>
<mailto:[email protected] <mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>>>
21 Jun 2010 22:44:39 GMT #3079585 1439
<[email protected]
<mailto:[email protected]>
<mailto:[email protected] <mailto:[email protected]>>
<mailto:[email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>>>>
remote [email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>>
<mailto:[email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>>>
22 Jun 2010 00:02:57 GMT #2443198 1438
<[email protected]
<mailto:[email protected]>
<mailto:[email protected] <mailto:[email protected]>>
<mailto:[email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>>>>
remote [email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>>
<mailto:[email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>>>
Thanks so much
---------------------------------------------------------------------------------
Qmailtoaster is sponsored by Vickers Consulting Group
(www.vickersconsulting.com
<http://www.vickersconsulting.com>
<http://www.vickersconsulting.com>
<http://www.vickersconsulting.com>)
Vickers Consulting Group offers Qmailtoaster
support and
installations.
If you need professional help with your setup,
contact
them today!
---------------------------------------------------------------------------------
Please visit qmailtoaster.com
<http://qmailtoaster.com> <http://qmailtoaster.com>
<http://qmailtoaster.com> for the
latest news, updates, and packages.
To unsubscribe, e-mail:
[email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>>
<mailto:[email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>>>
For additional commands, e-mail:
[email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>>
<mailto:[email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>>>
---------------------------------------------------------------------------------
Qmailtoaster is sponsored by Vickers Consulting Group
(www.vickersconsulting.com
<http://www.vickersconsulting.com>
<http://www.vickersconsulting.com>)
Vickers Consulting Group offers Qmailtoaster support and
installations.
If you need professional help with your setup, contact
them today!
---------------------------------------------------------------------------------
Please visit qmailtoaster.com <http://qmailtoaster.com>
<http://qmailtoaster.com> for the
latest news, updates, and packages.
To unsubscribe, e-mail:
[email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>>
For additional commands, e-mail:
[email protected]
<mailto:[email protected]>
<mailto:[email protected]
<mailto:[email protected]>>
---------------------------------------------------------------------------------
Qmailtoaster is sponsored by Vickers Consulting Group
(www.vickersconsulting.com <http://www.vickersconsulting.com>)
Vickers Consulting Group offers Qmailtoaster support and
installations.
If you need professional help with your setup, contact them today!
---------------------------------------------------------------------------------
Please visit qmailtoaster.com <http://qmailtoaster.com> for the
latest news, updates, and packages.
To unsubscribe, e-mail:
[email protected]
<mailto:[email protected]>
For additional commands, e-mail:
[email protected]
<mailto:[email protected]>
---------------------------------------------------------------------------------
Qmailtoaster is sponsored by Vickers Consulting Group
(www.vickersconsulting.com)
Vickers Consulting Group offers Qmailtoaster support and installations.
If you need professional help with your setup, contact them today!
---------------------------------------------------------------------------------
Please visit qmailtoaster.com for the latest news, updates, and packages.
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
