Someone's account has probably been compromised - what do the logs tell you?

 

TR

 

From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Nico Gazzano
Sent: Thursday, September 06, 2007 11:02 AM
To: Imail_Forum
Subject: [IMail Forum] Imail queue keeps flooding!!

 

I'm having a serious problem with my Imail server.  About 3 times in the
past two weeks I have had to go in and stop all imail services and delete
GSE, SMD, and VAC files in the spool directory because something is flooding
the queue, roughly 5k-6k messages in a matter of minutes.  

To bandage it up I run my sniffer and block the culprit IP on the perimeter.
More of a deterrent than a solid fix, but I can't find the cause of the
problem and I was wondering if someone can point me in the right direction.


I'm also looking into using and ISCSI SAN to hold my domains/users/spool
directories, has anyone implemented this and does it work well?

iMail setup is as follows:
    
    Installed on VMware Host
    using local user authentication.
    using local mailbox folders.
    relaying only allowed for specified IP addresses.
    no AV on server
    external barracuda spam filter
    Not using virtual domains
    



-Nico

Reply via email to