Jake Vickers skrev:
Espen wrote:
Jake Vickers skrev:
Espen wrote:
Jake Vickers skrev:
Espen wrote:
Hi,
Im using centos 5 and qmailtoaster.
Everything worked fine untill jun 28 then i got bombed with
mails on the 28 i got 3461 on 29 i got 3041 today 30 i got 3152
and counting.
I tailed the smtp/current file and this shows all the time "
CHKUSER accepted null sender: from <::> remote
<smtp1.cessniq.com:unknown:80.248.34.120> rcpt <> : accepted null
sender always".
What does accepted null sender allways mean ?
The mails i get are "Delivery Status Notification (Failure)" they
are from postmaster@ different domains and they claim its sent by
"Linette" <[EMAIL PROTECTED]> a user that does not exist on
my server.
I did the open relay test over at
http://www.southcomputers.com/relaytest.php and there i get "
Congratulations! mail.dataen.com *Does not appear to be* an open
relay "
I realy need help here and yes i am a newb :-)
Do you run web services on this machine? It looks like the
messages are being sent from a rogue PHP script, or someone on
your network may have gotten a virus.
Do you have a "catchall" account defined, or are you deleting
those messages?
Yes ther is a webserver allso with joomla.
i have enabled the delete function instead of catch all.
If you recently added the delete option, go ahead and adjust your
/var/qmail/control/queuelifetime file to something like 600 for a
couple hours. This will clean out your queue. Just remember to set
it back when the queue is cleaned out.
What happened is a typical spam thing. Someone sent a message to
[EMAIL PROTECTED], with a fake return-to address. They do this
on purpose. It makes it harder to find out where the message
actually came from, and if the cicarderie address doesn't exist,
they're now using your machine to bounce the spam message to someone
else.
That should clear up your issue I imagine.
Thnx for the replys :-)
Ok i will change the queuelifetime.
The delete option has been enabled since yesterday.
how can i check the queue ? i did a "qmailctl queue" but that jus
gave me "messages in queue: 0" and "messages in queue but not yet
preprocessed: 0".
Then you have no messages in the queue. You're good. All those
messages have already been bounced/deleted.
I just noticed that
"CHKUSER accepted null sender: from <::> remote
<mailengine24.web2000.activeisp.com:unknown:213.188.134.30> rcpt <> :
accepted null sender always
CHKUSER accepted rcpt: from <::> remote
<mailengine24.web2000.activeisp.com:unknown:213.188.134.30> rcpt
<[EMAIL PROTECTED]> : found existing recipient
simscan:[5988]:CLEAN (1.30/12.00):0.7541s:Delivery failure
([EMAIL PROTECTED]):213.188.134.30::[EMAIL PROTECTED]:"
"found existing recipient" Does that mean [EMAIL PROTECTED] exists ?
thnx again.
---------------------------------------------------------------------
QmailToaster hosted by: VR Hosted <http://www.vr.org>
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
