[r...@net ~]# qmlog -nl -g anonym...@metalservice smtp | grep "CHKUSER
accepted sender"
06-22 14:57:16 CHKUSER accepted sender: from
<[email protected]::> remote
<mail.metalservice.ind.br:unknown:127.0.0.2> rcpt <> : sender accepted
Only show one entry. :(
Eric Shubert escreveu:
Rafael Andrade wrote:
[r...@net metalservice.ind.br]# qmailctl queue | wc -l
86325 :(
[r...@net metalservice.ind.br]# qmailctl queue | head -n 50
messages in queue: 40591
messages in queue but not yet preprocessed: 15
22 Jun 2010 15:46:19 GMT #2467164 1456
<[email protected]>
remote [email protected]
22 Jun 2010 15:09:18 GMT #3087267 1459
<[email protected]>
remote [email protected]
22 Jun 2010 15:37:38 GMT #2461644 1463
<[email protected]>
remote [email protected]
22 Jun 2010 15:45:28 GMT #2447016 1457
<[email protected]>
remote [email protected]
22 Jun 2010 15:49:08 GMT #3069258 1461
<[email protected]>
remote [email protected]
22 Jun 2010 15:38:28 GMT #2462288 2835 <#...@[]>
remote postmas...@net
22 Jun 2010 15:44:16 GMT #2465807 1455
<[email protected]>
remote [email protected]
22 Jun 2010 15:28:35 GMT #2455112 1451
<[email protected]>
remote [email protected]
22 Jun 2010 15:46:45 GMT #2467555 1454
<[email protected]>
remote [email protected]
22 Jun 2010 15:02:44 GMT #3069603 1454
<[email protected]>
remote [email protected]
22 Jun 2010 15:42:13 GMT #2464565 1460
<[email protected]>
remote [email protected]
22 Jun 2010 15:34:11 GMT #2443198 2872 <#...@[]>
remote postmas...@net
22 Jun 2010 15:50:15 GMT #2470591 1459
<[email protected]>
remote [email protected]
22 Jun 2010 15:53:22 GMT #2450535 1465
<[email protected]>
local [email protected]
remote [email protected]
22 Jun 2010 15:56:32 GMT #2506264 1452
<[email protected]>
local [email protected]
remote [email protected]
22 Jun 2010 15:53:25 GMT #2448971 1457
<[email protected]>
local [email protected]
remote [email protected]
22 Jun 2010 15:43:26 GMT #2465278 1458
<[email protected]>
remote [email protected]
22 Jun 2010 15:38:51 GMT #2462702 1459
<[email protected]>
remote [email protected]
As i can delete all msgs to [email protected] using
qmail-remove ( syntax ? )
Thanks so much again
I think that
# qmHandle -tf "[email protected]"
will clean them out. I think you should do
# qmailctl stop
first, then start qmail back up when qmHandle completes.
Then you need to find out which account is being used to authenticate.
# qmlog -nl -g anonym...@metalservice smtp \
> | grep "CHKUSER accepted sender" | head -n10
This will show you the first 10 occurrences of messages that were
submitted with that user id. You should see something like:
06-07 02:58:23 CHKUSER accepted sender: from
<[email protected]:??...@???????:> ...
The ??...@??????? part is the account name that was used to
authenticate. Change that password, and you should no longer get more
spam messages from this spammer.
Then re-do the qmHandle command again to clean out any messages that
came in since the first time you ran it.
I'm presuming here that you have only one account/pw that's been
compromised. You might want to do something like
# qmlog -nl -g anonym...@metalservice smtp \
> | grep "CHKUSER accepted sender" | grep -v "??...@???????"
That will spit out any other account names that might have been used.
If there was only one compromised account, this command will return
nothing.
---------------------------------------------------------------------------------
Qmailtoaster is sponsored by Vickers Consulting Group
(www.vickersconsulting.com)
Vickers Consulting Group offers Qmailtoaster support and installations.
If you need professional help with your setup, contact them today!
---------------------------------------------------------------------------------
Please visit qmailtoaster.com for the latest news, updates, and packages.
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
