[qmailtoaster] Mail receiving problem from other domains

2010-06-22 Thread Benedict Claver
Hi Team, Am having a problem receiving mails from outside my domain eg yahoo,hotmail,gmail,etc the logs in the /var/log/qmail/smtp/current shows the two errors as noted below for all mail sent from those domains. From my domain I can send mails successfully to other domains. I don't know

Re: [qmailtoaster] Mail receiving problem from other domains

2010-06-22 Thread Sérgio Rosa
do you have at line 8 of the clamd.conf #Example or Example Your clamAV is not running. That is your problem. Look at the logs of clamav, check if you have stalled socket of a previous run. On 22/06/2010 08:59, Benedict Claver wrote: Hi Team, Am having a problem receiving mails from

Re: [qmailtoaster] Mail receiving problem from other domains

2010-06-22 Thread Andreas Galatis
Hi Benedict, you should at least comment the line Example at the top of the file. That will show clamd that you configured the system according to your wishes. Andreas Am Tuesday 22 June 2010 09:59:09 schrieb Benedict Claver: Hi Team, Am having a problem receiving mails from outside my

Re: [qmailtoaster] Mail receiving problem from other domains

2010-06-22 Thread Benedict Claver
Line 8 was: Example and not #Example I have tried to comment thus reads #Example and am monitoring. Regards, Benedict From: Sérgio Rosa sergior...@awd.pt To: qmailtoaster-list@qmailtoaster.com Sent: Tue, June 22, 2010 11:32:20 AM Subject: Re: [qmailtoaster]

Re: [qmailtoaster] QTP website

2010-06-22 Thread Scott Hughes
On Jun 21, 2010, at 9:32 PM, David Milholen dmilho...@wletc.com wrote: On 6/17/2010 8:48 PM, Scott Hughes wrote: On 6/17/10 3:31 PM, Jake Vickers wrote: The QTP website is at least partially back online. More to follow as I get some time. Jake, Thanks for taking the time to get

[qmailtoaster] Attack?

2010-06-22 Thread Rafael Andrade
Hello list, I have a production server with qmailtoaster on centos running 2 years perfectly, recently the server stuck, with many messages in queue, i need to stop qmail, clean the queue and running qmail again, but i need a solution to fix this problem, any knows or can help? Thanks so

Re: [qmailtoaster] Attack?

2010-06-22 Thread senthil vel
Seems some one is spamming. Any one of your mail account might be compromised. The server is using port 587 to accept mails from local users? . /var/log/qmail/submission or /var/log/qmail/smtp will tell the truth. say for example, search for qeezajtze...@stargate5.com in above mentioned logs. So

RE: [qmailtoaster] Attack?

2010-06-22 Thread Anil Aliyan
This could happen if the client machine of a valid user is infected with some virus or Trojan which send mail using outlook settings. From: senthil vel [mailto:senthilv...@gmail.com] Sent: 22 June 2010 17:07 To: qmailtoaster-list@qmailtoaster.com Subject: Re: [qmailtoaster] Attack?

Re: [qmailtoaster] Attack?

2010-06-22 Thread Rafael Andrade
Look in /var/log/maillog Jun 22 09:02:10 net spamdyke[5028]: DENIED_RDNS_MISSING from: (unknown) to: anonym...@client.ind.br origin_ip: 189.2.134.108 origin_rdns: (unknown) auth: (unknown) Jun 22 09:02:11 net spamdyke[5024]: DENIED_RDNS_MISSING from: affectionatevb...@semagroup.sema.se to:

Re: [qmailtoaster] Attack?

2010-06-22 Thread senthil vel
Honestly, I am not using, spamdyke. Does spamtyke appends all the log to /var/log/maillog? also seems spamdyke is rejecting these mails. Is this current log? if so somebody still sending mails. Can't you get any information from /var/log/qmail/smtp/current regarding this? On Tue, Jun 22, 2010 at

Re: [qmailtoaster] Attack?

2010-06-22 Thread Rafael Andrade
Same time in /var/log/qmail/smtp/current show this log: @40004c20ae8b0e33b054 CHKUSER accepted null sender: from :: remote eslovenia.intralesc.sc.gov.br:unknown:200.192.66.25 rcpt : accepted null sender always @40004c20ae8c09af4944 tcpserver: status: 14/100 @40004c20ae8c09af5114

Re: [qmailtoaster] Attack?

2010-06-22 Thread senthil vel
message posted from /var/log/qmail/smtp/current doesnot having any information regarding this issue Step 1. #qmailctl queue it will show the mails in queue. Say for example, i am pasting the output you have posted in first mail. 21 Jun 2010 22:45:02 GMT #3087267 1435 anonym...@client.ind.br

Re: [qmailtoaster] Attack?

2010-06-22 Thread Rafael Andrade
cat /var/log/qmail/smtp/* | grep -i prittyg...@yahoo.com.br (empty) cat /var/log/qmail/submission/* | grep -i prittyg...@yahoo.com.br (empty) :( still showing in maillog: Jun 22 10:59:33 net spamdyke[16032]: DENIED_RDNS_MISSING from: (unknown) to: anonym...@metalservice.ind.br origin_ip:

[qmailtoaster] Re: Attack?

2010-06-22 Thread Eric Shubert
Rafael Andrade wrote: Look in /var/log/maillog Jun 22 09:02:10 net spamdyke[5028]: DENIED_RDNS_MISSING from: (unknown) to: anonym...@client.ind.br origin_ip: 189.2.134.108 origin_rdns: (unknown) auth: (unknown) Jun 22 09:02:11 net spamdyke[5024]: DENIED_RDNS_MISSING from:

[qmailtoaster] Re: Attack?

2010-06-22 Thread Eric Shubert
senthil vel wrote: message posted from /var/log/qmail/smtp/current doesnot having any information regarding this issue Step 1. #qmailctl queue it will show the mails in queue. Say for example, i am pasting the output you have posted in first mail. 21 Jun 2010 22:45:02 GMT #3087267 1435

[qmailtoaster] Re: Attack?

2010-06-22 Thread Eric Shubert
senthil vel wrote: Not sure what is going on.. Some other spamdyke gurus may help. How many mails are there in the queue now? If the mail queue is still large, use qmail-remove to remove the mails in the queue. If qmail remove is not installed, please follow this. *Install Qmail-Remove*

Re: [qmailtoaster] Attack?

2010-06-22 Thread Rafael Andrade
[r...@net metalservice.ind.br]# qmailctl queue | wc -l 86325 :( [r...@net metalservice.ind.br]# qmailctl queue | head -n 50 messages in queue: 40591 messages in queue but not yet preprocessed: 15 22 Jun 2010 15:46:19 GMT #2467164 1456 anonym...@metalservice.ind.br remote

Re: [qmailtoaster] Re: Attack?

2010-06-22 Thread senthil vel
Hi Eric, In linux and administration works, there are many paths to a single destination. Thanks for pointing the smartest way. Hi Rafael, cat /var/log/qmail/smtp/* | grep -i prittyg...@yahoo.com.br (empty) cat /var/log/qmail/submission/* | grep -i prittyg...@yahoo.com.br (empty)

[qmailtoaster] Re: Attack?

2010-06-22 Thread Eric Shubert
Rafael Andrade wrote: [r...@net metalservice.ind.br]# qmailctl queue | wc -l 86325 :( [r...@net metalservice.ind.br]# qmailctl queue | head -n 50 messages in queue: 40591 messages in queue but not yet preprocessed: 15 22 Jun 2010 15:46:19 GMT #2467164 1456 anonym...@metalservice.ind.br

Re: [qmailtoaster] Re: Attack?

2010-06-22 Thread Rafael Andrade
[r...@net ~]# qmlog -nl -g anonym...@metalservice smtp | grep CHKUSER accepted sender 06-22 14:57:16 CHKUSER accepted sender: from anonym...@metalservice.ind.br:: remote mail.metalservice.ind.br:unknown:127.0.0.2 rcpt : sender accepted Only show one entry. :( Eric Shubert escreveu: Rafael

[qmailtoaster] Re: Attack?

2010-06-22 Thread Eric Shubert
I'm guessing then that they call came from a single submission. ? What are the rest of the messages in the smtp log right after that one? # qmlog -lc anonym...@metalservice smtp will take you right to it in the smtp log. Also, they came from 127.0.0.2. That looks suspicious. Perhaps your apache

[qmailtoaster] Error while restarting qmail

2010-06-22 Thread Amit Dalia
Hi Everyone, I'm getting below error when I'm restarting qmail.  ./run: line 4: /usr/bin/envconv: No such file or directory Qmail is working fine. Regards, Amit

Re: [qmailtoaster] Re: Attack?

2010-06-22 Thread Rafael Andrade
Look my tcp.smtp 192.168.1.:allow,RELAYCLIENT=,BADMIMETYPE=,BADLOADERTYPE=M,CHKUSER_RCPTLIMIT=120,CHKUSER_WRONGRCPTLIMIT=10,DKVERIFY=DEGIJKfh,QMAILQUEUE=/var/qmail/bin/simscan,DKQUEUE=,DKSIGN=/var/qmail/control/domainkeys/%/private,NOP0FCHECK=1

[qmailtoaster] Re: Attack?

2010-06-22 Thread Eric Shubert
Your 192.168.1. subnet is an open relay. I'd shut that down, at least for the time being. What's coming from there? What's in your smtp log that corresponds to the messages in the queue? That should give an indication of where they're coming from. Roundcube had some security issues at one

[qmailtoaster] Re: Error while restarting qmail

2010-06-22 Thread Eric Shubert
Amit Dalia wrote: Hi Everyone, I'm getting below error when I'm restarting qmail. ./run: line 4: /usr/bin/envconv: No such file or directory Qmail is working fine. Regards, Amit Which run file is it coming from? # find /var/qmail/supervise -name run -exec grep -H envconf {} \; Please

[qmailtoaster] Re: Error while restarting qmail

2010-06-22 Thread Amit Dalia
Hi Eric, The command you mentioned doesn't give any output. Also I noticed if I do qmailctl restart it doesn't give any error. But if I manually stop and then start qmail it gives the same error. Regards, Amit At Wednesday, 23-06-2010 on 0:56 Eric Shubert wrote: Amit Dalia wrote: Hi

[qmailtoaster] Re: Error while restarting qmail

2010-06-22 Thread Amit Dalia
Hi Eric, When I manually checked run file all supervise folder, I found below output in authlib folder run file: #!/bin/sh rm -rf ./env/*; cat /etc/courier/authlib/authdaemonrc | /usr/bin/envconv exec /usr/bin/envdir ./env/ \ /usr/libexec/courier-authlib/authdaemond 21 Is this where error is

[qmailtoaster] Re: Error while restarting qmail

2010-06-22 Thread Eric Shubert
Oops - I had a typo. It's envconv, not envconf. That's part of several scripts: # find /var/qmail/supervise -name run -exec grep -H envconv {} \; /var/qmail/supervise/pop3-ssl/run:cat /etc/courier/pop3d-ssl | /usr/bin/envconv /var/qmail/supervise/imap4-ssl/run:cat /etc/courier/imapd-ssl |

Re: [qmailtoaster] Re: Attack?

2010-06-22 Thread Rafael Andrade
Now my new tcp.smtp and qmailctl cdb done. 192.168.1.:allow,BADMIMETYPE=,BADLOADERTYPE=M,CHKUSER_RCPTLIMIT=120,CHKUSER_WRONGRCPTLIMIT=10,DKVERIFY=DEGIJKfh,QMAILQUEUE =/var/qmail/bin/simscan,DKQUEUE=,DKSIGN=/var/qmail/control/domainkeys/%/private,NOP0FCHECK=1

[qmailtoaster] Re: Error while restarting qmail

2010-06-22 Thread Amit Dalia
Thanks Eric, That solved the problem. Regards, Amit At Wednesday, 23-06-2010 on 1:19 Eric Shubert wrote: Oops - I had a typo. It's envconv, not envconf. That's part of several scripts: # find /var/qmail/supervise -name run -exec grep -H envconv {} \; /var/qmail/supervise/pop3-ssl/run:cat

[qmailtoaster] Re: Error while restarting qmail

2010-06-22 Thread Eric Shubert
Which did you choose to do? Amit Dalia wrote: Thanks Eric, That solved the problem. Regards, Amit At Wednesday, 23-06-2010 on 1:19 Eric Shubert wrote: Oops - I had a typo. It's envconv, not envconf. That's part of several scripts: # find /var/qmail/supervise -name run -exec

[qmailtoaster] Maildrop question

2010-06-22 Thread Scott Hughes
I have a .mailfilter file set up to filter my QMT-list emails into a QMT folder. Most emails go in there just fine, but some do not. I think it is because of the difference in the 'To:' line. Here is the part of the .mailfilter file in question:

[qmailtoaster] Re: Maildrop question

2010-06-22 Thread Eric Shubert
Scott Hughes wrote: I have a .mailfilter file set up to filter my QMT-list emails into a QMT folder. Most emails go in there just fine, but some do not. I think it is because of the difference in the 'To:' line. Here is the part of the .mailfilter file in question:

Re: [qmailtoaster] Re: Attack?

2010-06-22 Thread David Milholen
On 06/22/2010 01:43 PM, Eric Shubert wrote: I'm guessing then that they call came from a single submission. ? What are the rest of the messages in the smtp log right after that one? # qmlog -lc anonym...@metalservice smtp will take you right to it in the smtp log. Also, they

Re: [qmailtoaster] Re: Attack?

2010-06-22 Thread Rafael Andrade
The problem continues :( The queue is full of messages again Rafael Andrade escreveu: Now my new tcp.smtp and qmailctl cdb done. 192.168.1.:allow,BADMIMETYPE=,BADLOADERTYPE=M,CHKUSER_RCPTLIMIT=120,CHKUSER_WRONGRCPTLIMIT=10,DKVERIFY=DEGIJKfh,QMAILQUEUE

[qmailtoaster] Re: Error while restarting qmail

2010-06-22 Thread Amit Dalia
Hi Eric, I'm using Dovecot. And I prefer touch /var/qmail/supervise/authlib/down. Regards, Amit At Wednesday, 23-06-2010 on 1:56 Eric Shubert wrote: Which did you choose to do? Amit Dalia wrote: Thanks Eric, That solved the problem. Regards, Amit At Wednesday, 23-06-2010 on 1:19

[qmailtoaster] qtp-backup issue

2010-06-22 Thread David Milholen
When I run qtp-backup I do not get an email saying its completed and I also do not see the postmaster account and some of the other accounts on any of my domains. When a restore is complete the domains argue about not having a postmaster account. I view them in admin-toaster and where the

Re: [qmailtoaster] Re: Maildrop question

2010-06-22 Thread Scott Hughes
On 6/22/10 3:45 PM, Eric Shubert wrote: Scott Hughes wrote: I have a .mailfilter file set up to filter my QMT-list emails into a QMT folder. Most emails go in there just fine, but some do not. I think it is because of the difference in the 'To:' line. Here is the part of the .mailfilter

[qmailtoaster] Re: Error while restarting qmail

2010-06-22 Thread Eric Shubert
That's the safe way. ;) Has anyone who is running dovecot IMAP and POP3 remove the courier-authlib-toaster package? Would someone like to try it to see if anything breaks? (Please don't try this on a production host) -- -Eric 'shubes' Amit Dalia wrote: Hi Eric, I'm using Dovecot. And I

[qmailtoaster] Re: Attack?

2010-06-22 Thread Eric Shubert
You need to track a message back to the smtp log, and see which user account was used to submit it. Then change that password. If you're having trouble with that, show us some of the queue again, and we'll go from there. Rafael Andrade wrote: The problem continues :( The queue is full of

[qmailtoaster] Re: qtp-backup issue

2010-06-22 Thread Eric Shubert
David Milholen wrote: When I run qtp-backup I do not get an email saying its completed and I also do not see the postmaster account and some of the other accounts on any of my domains. When a restore is complete the domains argue about not having a postmaster account. I view them in

Re: [qmailtoaster] Re: Error while restarting qmail

2010-06-22 Thread Finn Buhelt
Hi Eric. Yes, I have removed courier-authlib-toaster and courier-imap-toaster when I installed Dovecot some months ago - no problemo - I think Amit was the contributor of the way to install. Regards, Finn - Original Message - From: Eric Shubert e...@shubes.net To:

[qmailtoaster] Re: Maildrop question * SOLVED *

2010-06-22 Thread Scott Hughes
On 6/22/10 3:45 PM, Eric Shubert wrote: Scott Hughes wrote: I have a .mailfilter file set up to filter my QMT-list emails into a QMT folder. Most emails go in there just fine, but some do not. I think it is because of the difference in the 'To:' line. Here is the part of the .mailfilter

Re: [qmailtoaster] Re: qtp-backup issue

2010-06-22 Thread David Milholen
On 6/22/2010 5:10 PM, Eric Shubert wrote: David Milholen wrote: When I run qtp-backup I do not get an email saying its completed and I also do not see the postmaster account and some of the other accounts on any of my domains. When a restore is complete the domains argue about not having a