Thanks everyone that gave me advice. I seem to be back up and running
again, and not relaying for bad people ;-)
It appears that the main issue was that my account credentials were
compromised for a 1 month period, which loaded my system up with so much
spam things would not function. This made the rest of it look very bad.
mailq showed the issue best, and all the messages in the
/var/lib/courier/msgs showed a successful auth for my user.
By setting esmtpd to force auth, I could quiet the squall.. until I got all
the old queues moved out and fresh new ones put in.
working on deleteing the old junk and reclaiming my drive space may take a
day or more.. and my system is bogged down while that takes place.. but I
should get a few gigs back.
Nick
On Tue, Aug 20, 2013 at 9:29 AM, Nick Ellson <nickolas.ell...@gmail.com>wrote:
> Found it, and yup, it shows authenticated.. so courier was not the relay..
> my password got owned.. it's been changed.
>
>
> gubbie /var/lib/courier/msgs.foo # cat ./64/D1487564
> Received: from habmpq ([181.66.48.149])
> (AUTH: LOGIN gr...@nickellson.com)
> by nickellson.com with ESMTPA; Wed, 12 Jun 2013 18:54:16 -0700
> id 000000000016B2CC.51B92649.00001CA1
> Date: Thu, 13 Jun 2013 03:49:14 -0700
> From: "Wzu Us" <gr...@nickellson.com>
> Subject:
> To: ewheele...@yahoo.com, kannankanna...@yahoo.com,
> russellbow...@yahoo.com
> Mime-Version: 1.0
> Content-Type: text/plain; charset=us-ascii
> Content-Transfer-Encoding: 7bit
>
> http://www.mplouzaki.gr/benign.html?f
>
>
>
> On Tue, Aug 20, 2013 at 5:32 AM, Matus UHLAR - fantomas <uh...@fantomas.sk
> > wrote:
>
>> On 20.08.13 05:18, Nick Ellson wrote:
>> >gubbie /var/lib/courier/msgq.foo/137108 # cat C1487564.1371088460
>> >sgr...@nickellson.com
>> >fdns; habmpq ([181.66.48.149])
>> >e
>> >t
>> >M000000000016B2CC.51B92649.00001CA1
>> >rewheele...@yahoo.com
>>
>> yes, here it looks like spam. But I meant the headers from D* file, most
>> probably D1487564
>>
>> --
>> Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
>> Warning: I wish NOT to receive e-mail advertising to this address.
>> Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
>> Despite the cost of living, have you noticed how popular it remains?
>>
>>
>> ------------------------------------------------------------------------------
>> Introducing Performance Central, a new site from SourceForge and
>> AppDynamics. Performance Central is your source for news, insights,
>> analysis and resources for efficient Application Performance Management.
>> Visit us today!
>>
>> http://pubads.g.doubleclick.net/gampad/clk?id=48897511&iu=/4140/ostg.clktrk
>> _______________________________________________
>> courier-users mailing list
>> courier-users@lists.sourceforge.net
>> Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users
>>
>
>
------------------------------------------------------------------------------
Introducing Performance Central, a new site from SourceForge and
AppDynamics. Performance Central is your source for news, insights,
analysis and resources for efficient Application Performance Management.
Visit us today!
http://pubads.g.doubleclick.net/gampad/clk?id=48897511&iu=/4140/ostg.clktrk
_______________________________________________
courier-users mailing list
courier-users@lists.sourceforge.net
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users
