Re: [vchkpw] qmail+vpopmail on redhat 7.3 server gets very busy
Tom you hit it right. My problem is tones of doublebounces of spam from forged return and bad addresses. I do not have doublebounceto file under /var/qmail/control/ How do I set it up and what should be in it, to have doublebounces go to that file instead of [EMAIL PROTECTED] forwarding them to postmaster? I will create .qmail-doublebounce and put # in /var/qmail/alias/.qmail-doublebounce to delete all doublebounces Thanks, Sam - Original Message - From: Tom Collins [EMAIL PROTECTED] To: vchkpw@inter7.com Sent: Friday, November 04, 2005 1:59 AM Subject: Re: [vchkpw] qmail+vpopmail on redhat 7.3 server gets very busy On Nov 3, 2005, at 7:38 PM, Sam wrote: @4000436ab0a417e5a724 info msg 116176: bytes 2174 from [EMAIL PROTECTED] qp 20947 uid 501 Looks like doublebounce messages. What do you have in /var/qmail/control/doublebounceto? I've set my server to have doublebounce in that file, and then put # in /var/qmail/alias/.qmail-doublebounce. That way doublebounces are just deleted -- 99.9% of them are crap and not worth looking at (e.g., spam from forged return addresses). -- Tom Collins - [EMAIL PROTECTED] QmailAdmin: http://qmailadmin.sf.net/ Vpopmail: http://vpopmail.sf.net/ You don't need a laptop to troubleshoot high-speed Internet: sniffter.com
RE: [vchkpw] qmail+vpopmail on redhat 7.3 server gets very busy
Hi, Run the commands: #Echo doublebounce /var/qmail/control/doublebounceto #echo # /var/qmail/alias/.qmail-doublebounce In this way doublebounces will go to the user doublebounce, who's .qmail file has nothing in it and so the mail will fall into a black hole. I think this is what Tom is getting at. Andrew. -Original Message- From: Sam [mailto:[EMAIL PROTECTED] Sent: 04 November 2005 14:50 To: vchkpw@inter7.com Subject: Re: [vchkpw] qmail+vpopmail on redhat 7.3 server gets very busy Tom you hit it right. My problem is tones of doublebounces of spam from forged return and bad addresses. I do not have doublebounceto file under /var/qmail/control/ How do I set it up and what should be in it, to have doublebounces go to that file instead of [EMAIL PROTECTED] forwarding them to postmaster? I will create .qmail-doublebounce and put # in /var/qmail/alias/.qmail-doublebounce to delete all doublebounces Thanks, Sam - Original Message - From: Tom Collins [EMAIL PROTECTED] To: vchkpw@inter7.com Sent: Friday, November 04, 2005 1:59 AM Subject: Re: [vchkpw] qmail+vpopmail on redhat 7.3 server gets very busy On Nov 3, 2005, at 7:38 PM, Sam wrote: @4000436ab0a417e5a724 info msg 116176: bytes 2174 from [EMAIL PROTECTED] qp 20947 uid 501 Looks like doublebounce messages. What do you have in /var/qmail/control/doublebounceto? I've set my server to have doublebounce in that file, and then put # in /var/qmail/alias/.qmail-doublebounce. That way doublebounces are just deleted -- 99.9% of them are crap and not worth looking at (e.g., spam from forged return addresses). -- Tom Collins - [EMAIL PROTECTED] QmailAdmin: http://qmailadmin.sf.net/ Vpopmail: http://vpopmail.sf.net/ You don't need a laptop to troubleshoot high-speed Internet: sniffter.com ** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. allpay.net Limited, Fortis et Fides, Whitestone Business Park, Whitestone, Hereford, HR1 3SE. Telephone: 0870 243 3434, Fax: 0870 243 6041. Website: www.allpay.net Email: [EMAIL PROTECTED] **
Re: [vchkpw] qmail+vpopmail on redhat 7.3 server gets very busy
On Thursday 03 November 2005 07:38 pm, Sam wrote: I noticed that one local user which I created when I installed qmail and before installing vpopmail, was getting lots of messages from qmail under /home/user/Maildir. what do your logs say about this? (Hint: if you had some of those messages you recently deleted around, they would certainly help ;) The directory was /home/user/Maildir/new was full of thousands of messages in this format: 12345678999.16207.qmail ,S=14766 yea, that's how qmail formats the filename, that is not helpful. When I tried to go in the directory to read one of the messages, the computer would hang. That is why I decided to delete the directory. Now my qmail log shows: @4000436ab0a416ec08cc new msg 116203 @4000436ab0a416ee27c4 info msg 116203: bytes 2061 from [EMAIL PROTECTED] qp 20944 uid 507 @4000436ab0a417e5a724 info msg 116176: bytes 2174 from [EMAIL PROTECTED] qp 20947 uid 501 those are double bounces, you can tell because of ther [EMAIL PROTECTED] envelope sender. I do not know what the messages are about and where they are going . /var/spool/mail has nothing in it. Under vpopmail I have [EMAIL PROTECTED] The qmail.domain.com is the local machine It took the system more than one hour to delete the /home/user/Maildir/new directory and /home/user/Maildir/tmp and left /home/user/Maildir/cur. Now the server is working fine, but qmail did not recreate the new and tmp directories again. it's not supposed to. -Jeremy Ok, but why qmail was writing to that directory? Thank you All for your help. Sam because double bounces get delivered to postmaster by default. If your 'defaultdomain' (which defaults to the contents of the 'me' file) is in locals, it delivers to there. My guess is you have, in ~alias/.qmail-postmaster, a line like user, and user has a maildir. Please show us the full, *unedited* output of qmail-showctl and we can assist you further. -Jeremy -- Jeremy Kitchen ++ [EMAIL PROTECTED] In the beginning was The Word and The Word was Content-type: text/plain -- The Word of Bob. pgp7clxlvKZtD.pgp Description: PGP signature
Re: [vchkpw] qmail+vpopmail on redhat 7.3 server gets very busy
Hi, The command #Echo doublebounce /var/qmail/control/doublebounceto worked. As for the second command #echo # /var/qmail/alias/.qmail-doublebounce Nothing happened. I do not know why, but I installed it using #touch .qmail-doublebounce then I put# and saved. It is working now. Thank you All. Sam - Original Message - From: Andrew Hodgson [EMAIL PROTECTED] To: vchkpw@inter7.com Sent: Friday, November 04, 2005 10:04 AM Subject: RE: [vchkpw] qmail+vpopmail on redhat 7.3 server gets very busy Hi, Run the commands: #Echo doublebounce /var/qmail/control/doublebounceto #echo # /var/qmail/alias/.qmail-doublebounce In this way doublebounces will go to the user doublebounce, who's .qmail file has nothing in it and so the mail will fall into a black hole. I think this is what Tom is getting at. Andrew. -Original Message- From: Sam [mailto:[EMAIL PROTECTED] Sent: 04 November 2005 14:50 To: vchkpw@inter7.com Subject: Re: [vchkpw] qmail+vpopmail on redhat 7.3 server gets very busy Tom you hit it right. My problem is tones of doublebounces of spam from forged return and bad addresses. I do not have doublebounceto file under /var/qmail/control/ How do I set it up and what should be in it, to have doublebounces go to that file instead of [EMAIL PROTECTED] forwarding them to postmaster? I will create .qmail-doublebounce and put # in /var/qmail/alias/.qmail-doublebounce to delete all doublebounces Thanks, Sam - Original Message - From: Tom Collins [EMAIL PROTECTED] To: vchkpw@inter7.com Sent: Friday, November 04, 2005 1:59 AM Subject: Re: [vchkpw] qmail+vpopmail on redhat 7.3 server gets very busy On Nov 3, 2005, at 7:38 PM, Sam wrote: @4000436ab0a417e5a724 info msg 116176: bytes 2174 from [EMAIL PROTECTED] qp 20947 uid 501 Looks like doublebounce messages. What do you have in /var/qmail/control/doublebounceto? I've set my server to have doublebounce in that file, and then put # in /var/qmail/alias/.qmail-doublebounce. That way doublebounces are just deleted -- 99.9% of them are crap and not worth looking at (e.g., spam from forged return addresses). -- Tom Collins - [EMAIL PROTECTED] QmailAdmin: http://qmailadmin.sf.net/ Vpopmail: http://vpopmail.sf.net/ You don't need a laptop to troubleshoot high-speed Internet: sniffter.com ** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. allpay.net Limited, Fortis et Fides, Whitestone Business Park, Whitestone, Hereford, HR1 3SE. Telephone: 0870 243 3434, Fax: 0870 243 6041. Website: www.allpay.net Email: [EMAIL PROTECTED] **
Re: [vchkpw] qmail+vpopmail on redhat 7.3 server gets very busy
I noticed that one local user which I created when I installed qmail and before installing vpopmail, was getting lots of messages from qmail under /home/user/Maildir. what do your logs say about this? (Hint: if you had some of those messages you recently deleted around, they would certainly help ;) The directory was /home/user/Maildir/new was full of thousands of messages in this format: 12345678999.16207.qmail ,S=14766 When I tried to go in the directory to read one of the messages, the computer would hang. That is why I decided to delete the directory. Now my qmail log shows: @4000436ab0a416ec08cc new msg 116203 @4000436ab0a416ee27c4 info msg 116203: bytes 2061 from [EMAIL PROTECTED] qp 20944 uid 507 @4000436ab0a41733b08c starting delivery 194354: msg 116203 to local [EMAIL PROTECTED] @4000436ab0a41734fc94 status: local 1/10 remote 14/20 @4000436ab0a417e397cc new msg 116176 @4000436ab0a417e5a724 info msg 116176: bytes 2174 from [EMAIL PROTECTED] qp 20947 uid 501 @4000436ab0a41821c9ac starting delivery 194355: msg 116176 to local [EMAIL PROTECTED] @4000436ab0a418232554 status: local 2/10 remote 14/20 @4000436ab0a41824e68c delivery 194354: success: did_0+1+0/qp_20947/ @4000436ab0a418278a54 status: local 1/10 remote 14/20 @4000436ab0a4182a7854 end msg 116203 I do not know what the messages are about and where they are going . /var/spool/mail has nothing in it. Under vpopmail I have [EMAIL PROTECTED] The qmail.domain.com is the local machine It took the system more than one hour to delete the /home/user/Maildir/new directory and /home/user/Maildir/tmp and left /home/user/Maildir/cur. Now the server is working fine, but qmail did not recreate the new and tmp directories again. it's not supposed to. -Jeremy Ok, but why qmail was writing to that directory? Thank you All for your help. Sam - Original Message - From: Jeremy Kitchen [EMAIL PROTECTED] To: vchkpw@inter7.com Sent: Wednesday, November 02, 2005 10:31 PM Subject: Re: [vchkpw] qmail+vpopmail on redhat 7.3 server gets very busy
Re: [vchkpw] qmail+vpopmail on redhat 7.3 server gets very busy
On Nov 3, 2005, at 7:38 PM, Sam wrote: @4000436ab0a417e5a724 info msg 116176: bytes 2174 from [EMAIL PROTECTED] qp 20947 uid 501 Looks like doublebounce messages. What do you have in /var/qmail/control/doublebounceto? I've set my server to have doublebounce in that file, and then put # in /var/qmail/alias/.qmail-doublebounce. That way doublebounces are just deleted -- 99.9% of them are crap and not worth looking at (e.g., spam from forged return addresses). -- Tom Collins - [EMAIL PROTECTED] QmailAdmin: http://qmailadmin.sf.net/ Vpopmail: http://vpopmail.sf.net/ You don't need a laptop to troubleshoot high-speed Internet: sniffter.com
Re: [vchkpw] qmail+vpopmail on redhat 7.3 server gets very busy
Remo, I noticed that one local user which I created when I installed qmail and before installing vpopmail, was getting lots of messages from qmail under /home/user/Maildir. It took the system more than one hour to delete the /home/user/Maildir/new directory and /home/user/Maildir/tmp and left /home/user/Maildir/cur. Now the server is working fine, but qmail did not recreate the new and tmp directories again. Vpopmail and the domain accounts that I am using are installed under /home/vpopmail. Any ideas why and what qmail was doing? Thanks, Sam - Original Message - From: Remo Mattei [EMAIL PROTECTED] To: vchkpw@inter7.com Sent: Monday, October 31, 2005 11:04 AM Subject: Re: [vchkpw] qmail+vpopmail on redhat 7.3 server gets very busy did u check your kernel? there are some hackers that may exploit your server check your /tmp directory if you are also running apache and see if you see some hidden directories, etc.. just my 2 cents. Remo - Original Message - From: Sam To: vchkpw@inter7.com Sent: Sunday, October 30, 2005 18:01 Subject: [vchkpw] qmail+vpopmail on redhat 7.3 server gets very busy Hi, We have vpopmail version 5.2.1 with qmail 1.03 + mysql 3.23 on Redhat 7.3. It was running fine for the past 3 years until now. Lately the server at random gets slow and very busy and could not be accessed until restarted with a hard reset. The only thing I can think of is rebuilding the system. Any ideas as to why this is happening? Thanks, Sam
Re: [vchkpw] qmail+vpopmail on redhat 7.3 server gets very busy
On Wednesday 02 November 2005 06:37 pm, Sam wrote: Remo, I noticed that one local user which I created when I installed qmail and before installing vpopmail, was getting lots of messages from qmail under /home/user/Maildir. what do your logs say about this? (Hint: if you had some of those messages you recently deleted around, they would certainly help ;) It took the system more than one hour to delete the /home/user/Maildir/new directory and /home/user/Maildir/tmp and left /home/user/Maildir/cur. Now the server is working fine, but qmail did not recreate the new and tmp directories again. it's not supposed to. -Jeremy -- Jeremy Kitchen ++ [EMAIL PROTECTED] In the beginning was The Word and The Word was Content-type: text/plain -- The Word of Bob. pgp2NqVVS2oE5.pgp Description: PGP signature
Re: [vchkpw] qmail+vpopmail on redhat 7.3 server gets very busy
did u check your kernel? there are some hackers that may exploit your server check your /tmp directory if you are also running apache and see if you see some hidden directories, etc.. just my 2 cents. Remo - Original Message - From: Sam To: vchkpw@inter7.com Sent: Sunday, October 30, 2005 18:01 Subject: [vchkpw] qmail+vpopmail on redhat 7.3 server gets very busy Hi, We have vpopmail version 5.2.1 with qmail 1.03 + mysql 3.23 on Redhat 7.3. It was running fine for the past 3 years until now. Lately the server at random getsslow and verybusy and could not be accessed until restarted with ahard reset. The only thing I can think of is rebuilding the system. Any ideas as to why this is happening? Thanks, Sam
