Hi,
1. Block the IP address by iptables.
2. It needs clear the queue.
3. restart qmail.
I think fastest recovery all clear the queue.
Then you can inform to the users.
These are point.
Regards,
Noriyuki Hayashi
> This could come from a web injection stop the web server. And check if things
>
This could come from a web injection stop the web server. And check if things
still coming.
> Il giorno 7 gen 2019, alle ore 22:12, Tony White ha scritto:
>
> Hi,
> This how I would try to fix it first.
>
> If you have cli access then try this command to see the ip address
> that is
Hi,
This how I would try to fix it first.
If you have cli access then try this command to see the ip address
that is sending the emails.
watch SMTP log
tail -n 25 -f /var/log/qmail/smtp/current | tai64nlocal
OR
watch SUBMISSION log
tail -n 25 -f /var/log/qmail/submission/current |
Sounds suspicious for malware.
Check the logs (var/log/qmail/smtp/cur and the similar one for the
submission port) to see if email is coming from outside the system.
If it is not from outside the system, then I would go looking for some
sort of rogue running process (likely malware) which is
Thanks Eric Broch for your replay,
yes, the queue is continuing to fill up even after password reset!!
i reset password email and clear the queue qmHandle -D , but i see the log
contains many emails that send mail to the whole world
is there another queue where it allocates messages?
thanks
Clarification:
The queue is continuing to fill up even after password reset!?
If not:
I've used 'qmHandle -D' to delete all messages in the queue WITH THE
UNDERSTANDING THAT GOOD MESSAGES ARE DELETED AS WELL.
On 1/7/2019 12:15 AM, Giuseppe Perna wrote:
Hello,
qmailtoaster has a full
Hello,
qmailtoaster has a full tail,
qmHandle -L and qmHandle -l contains many emails that send mail to the
whole world.
I reset the password for these email addresses, but the queues still fill
up.
in qmlog -f send i see:
01-07 07:15:08 info msg 5012912: bytes 2911 from <#@[]> qp 16477 uid
