[qmailtoaster] @yahoo.com.tw
Hello All, I seem to have gotten hit by some kind of attack and am trying to figure out how to stop it. I have over 14,000 emails that are going to yahoo.com.tw email addresses. Any Idea how i can get this stopped? Thanks q
Re: [qmailtoaster] @yahoo.com.tw
What do the logs look like? On 10/2/07, Kyle Quillen [EMAIL PROTECTED] wrote: Hello All, I seem to have gotten hit by some kind of attack and am trying to figure out how to stop it. I have over 14,000 emails that are going to yahoo.com.tw email addresses. Any Idea how i can get this stopped? Thanks q - QmailToaster hosted by: VR Hosted http://www.vr.org - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
Re: [qmailtoaster] @yahoo.com.tw
Well I think I found out where these came from. One of my customers setup a microsoft server that is an open relay and it was relaying mail through me. I shut them down but I have a feeling it is going to take a while for these emails to flush out of the queue. Or i could just clear the queue all together. Which i really don't want to do. I looked at the logs and was seeing alot of these emails coming from one ip which as it turns out they were an open relay. Any suggestions on getting these emails out of queue quicker? I set the queue lifetime down to 3000. Thanks q On 10/2/07, Erik A. Espinoza [EMAIL PROTECTED] wrote: What do the logs look like? On 10/2/07, Kyle Quillen [EMAIL PROTECTED] wrote: Hello All, I seem to have gotten hit by some kind of attack and am trying to figure out how to stop it. I have over 14,000 emails that are going to yahoo.com.tw email addresses. Any Idea how i can get this stopped? Thanks q - QmailToaster hosted by: VR Hosted http://www.vr.org - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
Re: [qmailtoaster] @yahoo.com.tw
You could use qmHandle to remove them based on source or destination. I believe it is a part of the qmailtoaster-plus suite. You could also use MAXCONNIP=3 or some sane limit in tcp.smtp to prevent flooding on a regular basis. It should, at the very minimum, throttle how many times a misconfigured open relay could send through your server. Erik On 10/2/07, Kyle Quillen [EMAIL PROTECTED] wrote: Well I think I found out where these came from. One of my customers setup a microsoft server that is an open relay and it was relaying mail through me. I shut them down but I have a feeling it is going to take a while for these emails to flush out of the queue. Or i could just clear the queue all together. Which i really don't want to do. I looked at the logs and was seeing alot of these emails coming from one ip which as it turns out they were an open relay. Any suggestions on getting these emails out of queue quicker? I set the queue lifetime down to 3000. Thanks q On 10/2/07, Erik A. Espinoza [EMAIL PROTECTED] wrote: What do the logs look like? On 10/2/07, Kyle Quillen [EMAIL PROTECTED] wrote: Hello All, I seem to have gotten hit by some kind of attack and am trying to figure out how to stop it. I have over 14,000 emails that are going to yahoo.com.tw email addresses. Any Idea how i can get this stopped? Thanks q - QmailToaster hosted by: VR Hosted http://www.vr.org - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] - QmailToaster hosted by: VR Hosted http://www.vr.org - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
Re: [qmailtoaster] @yahoo.com.tw
well the qmHandle is working but when I run through and delete messages i get the following error when i run a qmailctl start supervise: fatal: unable to acquire send/supervise/lock: temporary failure supervise: fatal: unable to acquire send/supervise/lock: temporary failure Not sure what that is doing. Thanks q On 10/2/07, Erik A. Espinoza [EMAIL PROTECTED] wrote: You could use qmHandle to remove them based on source or destination. I believe it is a part of the qmailtoaster-plus suite. You could also use MAXCONNIP=3 or some sane limit in tcp.smtp to prevent flooding on a regular basis. It should, at the very minimum, throttle how many times a misconfigured open relay could send through your server. Erik On 10/2/07, Kyle Quillen [EMAIL PROTECTED] wrote: Well I think I found out where these came from. One of my customers setup a microsoft server that is an open relay and it was relaying mail through me. I shut them down but I have a feeling it is going to take a while for these emails to flush out of the queue. Or i could just clear the queue all together. Which i really don't want to do. I looked at the logs and was seeing alot of these emails coming from one ip which as it turns out they were an open relay. Any suggestions on getting these emails out of queue quicker? I set the queue lifetime down to 3000. Thanks q On 10/2/07, Erik A. Espinoza [EMAIL PROTECTED] wrote: What do the logs look like? On 10/2/07, Kyle Quillen [EMAIL PROTECTED] wrote: Hello All, I seem to have gotten hit by some kind of attack and am trying to figure out how to stop it. I have over 14,000 emails that are going to yahoo.com.tw email addresses. Any Idea how i can get this stopped? Thanks q - QmailToaster hosted by: VR Hosted http://www.vr.org - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] - QmailToaster hosted by: VR Hosted http://www.vr.org - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
Re: [qmailtoaster] @yahoo.com.tw
Whoops, should have mentioned that you had to shut down qmail first, then start it back up. Before you start things back up make sure you kill all qmail deamons, such as qmail-send or qmail-smtpd. Erik On 10/2/07, Kyle Quillen [EMAIL PROTECTED] wrote: well the qmHandle is working but when I run through and delete messages i get the following error when i run a qmailctl start supervise: fatal: unable to acquire send/supervise/lock: temporary failure supervise: fatal: unable to acquire send/supervise/lock: temporary failure Not sure what that is doing. Thanks q On 10/2/07, Erik A. Espinoza [EMAIL PROTECTED] wrote: You could use qmHandle to remove them based on source or destination. I believe it is a part of the qmailtoaster-plus suite. You could also use MAXCONNIP=3 or some sane limit in tcp.smtp to prevent flooding on a regular basis. It should, at the very minimum, throttle how many times a misconfigured open relay could send through your server. Erik On 10/2/07, Kyle Quillen [EMAIL PROTECTED] wrote: Well I think I found out where these came from. One of my customers setup a microsoft server that is an open relay and it was relaying mail through me. I shut them down but I have a feeling it is going to take a while for these emails to flush out of the queue. Or i could just clear the queue all together. Which i really don't want to do. I looked at the logs and was seeing alot of these emails coming from one ip which as it turns out they were an open relay. Any suggestions on getting these emails out of queue quicker? I set the queue lifetime down to 3000. Thanks q On 10/2/07, Erik A. Espinoza [EMAIL PROTECTED] wrote: What do the logs look like? On 10/2/07, Kyle Quillen [EMAIL PROTECTED] wrote: Hello All, I seem to have gotten hit by some kind of attack and am trying to figure out how to stop it. I have over 14,000 emails that are going to yahoo.com.tw email addresses. Any Idea how i can get this stopped? Thanks q - QmailToaster hosted by: VR Hosted http://www.vr.org - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] - QmailToaster hosted by: VR Hosted http://www.vr.org - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] - QmailToaster hosted by: VR Hosted http://www.vr.org - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
Re: [qmailtoaster] @yahoo.com.tw
OK Got that now i can do that what should be the string that I use to delete all those messages in queue. i am using the command qmHandle -sf '[EMAIL PROTECTED]' do i need to lose the quotes? thanks q On 10/2/07, Erik A. Espinoza [EMAIL PROTECTED] wrote: Whoops, should have mentioned that you had to shut down qmail first, then start it back up. Before you start things back up make sure you kill all qmail deamons, such as qmail-send or qmail-smtpd. Erik On 10/2/07, Kyle Quillen [EMAIL PROTECTED] wrote: well the qmHandle is working but when I run through and delete messages i get the following error when i run a qmailctl start supervise: fatal: unable to acquire send/supervise/lock: temporary failure supervise: fatal: unable to acquire send/supervise/lock: temporary failure Not sure what that is doing. Thanks q On 10/2/07, Erik A. Espinoza [EMAIL PROTECTED] wrote: You could use qmHandle to remove them based on source or destination. I believe it is a part of the qmailtoaster-plus suite. You could also use MAXCONNIP=3 or some sane limit in tcp.smtp to prevent flooding on a regular basis. It should, at the very minimum, throttle how many times a misconfigured open relay could send through your server. Erik On 10/2/07, Kyle Quillen [EMAIL PROTECTED] wrote: Well I think I found out where these came from. One of my customers setup a microsoft server that is an open relay and it was relaying mail through me. I shut them down but I have a feeling it is going to take a while for these emails to flush out of the queue. Or i could just clear the queue all together. Which i really don't want to do. I looked at the logs and was seeing alot of these emails coming from one ip which as it turns out they were an open relay. Any suggestions on getting these emails out of queue quicker? I set the queue lifetime down to 3000. Thanks q On 10/2/07, Erik A. Espinoza [EMAIL PROTECTED] wrote: What do the logs look like? On 10/2/07, Kyle Quillen [EMAIL PROTECTED] wrote: Hello All, I seem to have gotten hit by some kind of attack and am trying to figure out how to stop it. I have over 14,000 emails that are going to yahoo.com.tw email addresses. Any Idea how i can get this stopped? Thanks q - QmailToaster hosted by: VR Hosted http://www.vr.org - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] - QmailToaster hosted by: VR Hosted http://www.vr.org - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] - QmailToaster hosted by: VR Hosted http://www.vr.org - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
