I'm using roundcube webmail as well. Anyway I had already blacklisted 127.0.0.1 in my spamdyke configuration and it worked.
Thanks. Amit Dalia -----Original Message----- From: Eric Shubert [mailto:[email protected]] Sent: 13 September 2013 06:42 To: [email protected] Subject: [qmailtoaster] Re: SPAM Emails generating from server On 09/12/2013 05:20 AM, Amit wrote: > Please find below SMTP log. > > 2013-09-12 17:08:05.533459500 CHKUSER relaying rcpt: from > <[email protected]::> remote > <User:unknown:127.0.0.1> rcpt <[email protected] > <mailto:[email protected]>> : client allowed to relay > 2013-09-12 17:08:05.533460500 policy_check: remote > [email protected] > <mailto:[email protected]> -> remote > [email protected] <mailto:[email protected]> (UNAUTHENTICATED > SENDER) > 2013-09-12 17:08:05.533461500 policy_check: policy allows transmission > 2013-09-12 17:08:05.579302500 CHKUSER relaying rcpt: from > <[email protected]::> remote > <User:unknown:127.0.0.1> rcpt <[email protected] > <mailto:[email protected]>> : client allowed to relay > 2013-09-12 17:08:05.579305500 policy_check: remote > [email protected] > <mailto:[email protected]> -> remote > [email protected] <mailto:[email protected]> (UNAUTHENTICATED SENDER) > 2013-09-12 17:08:05.579306500 policy_check: policy allows transmission > 2013-09-12 17:08:05.581583500 CHKUSER relaying rcpt: from > <[email protected]::> remote > <User:unknown:127.0.0.1> rcpt <[email protected] > <mailto:[email protected]>> : client allowed to relay > 2013-09-12 17:08:05.581585500 policy_check: remote > [email protected] > <mailto:[email protected]> -> remote > [email protected] <mailto:[email protected]> (UNAUTHENTICATED > SENDER) > 2013-09-12 17:08:05.581586500 policy_check: policy allows transmission > 2013-09-12 17:08:05.663348500 CHKUSER relaying rcpt: from > <[email protected]::> remote > <User:unknown:127.0.0.1> rcpt <[email protected] > <mailto:[email protected]>> : client allowed to relay > 2013-09-12 17:08:05.663352500 policy_check: remote > [email protected] > <mailto:[email protected]> -> remote > [email protected] <mailto:[email protected]> (UNAUTHENTICATED > SENDER) > 2013-09-12 17:08:05.663353500 policy_check: policy allows transmission > > > Such spam emails are getting generated from server. > Where do I look for source of the same? What will happen if I > blacklist > 127.0.0.1 IP in spamdyke? > > Regards, > > Amit I would configure your squirrelmail to authenticate in /etc/squirrelmail/config_local.php: # these are added so SM authenticates, # eliminating need for 127.: line in /etc/tcprules.d/tcp.smtp file $smtpServerAddress = 'localhost'; $smtpPort = 587; $smtp_auth_mech = 'login'; and restart httpd: # service httpd restart Then remove the 127. line from /etc/tcprules.d/tcp.smtp file, and rebuild the cdb file: # qmailctl cdb This will keep any rogue process on your host from using QMT as an open relay. See if this fixes things, and we can go from there. -- -Eric 'shubes' --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
