Atomicorp

Finally got this under control. Here is what my issues were: 1. Hacked user account - Scott helped me identify and I changed the password. 2. Too much spam coming into the server. added 2 more black lists to the one I already had in PLESK, and the spam stopped. 3. We had a ton of failure notices fil...

Thanks for the reply,

I have checked and verified that my locals, rcpthosts are configured correctly. I have also cleared out my /tmp folder.

Problem remains.

Hi scott, I have gone through the same process, however maybe I'm not smart enough to figure this out. I can see ip's that spams are coming from (they seem to be all over the place.) The from's on the mails are all spoofed. I am not seeing any pattern as far as smtp_auth in logs pointing to a specif...

Okay appears that my logs rotated last night... Old or New Logs don't show anyone logging in repeatedly over the course of the night... Yet, spams are still flowing in like crazy. I have confirmed in PLESK that poplock is disabled. I have smtp authorization on. I have set reject to all domains for m...

This morning, queue was back up to 25,000... Tried to check the logs, but nothing came up...

This is out of hand, is there any way to stop this?

Thank you! That showed me what user had been logging in at all hours of day and night even though they had an empty mailbox. I have notified the user that I have changed their password.

I'll continue to monitor my logs and reply back with results. Thank you again Scott.

-Seth-

I'm not sure I exactly understand the idea of poplocking. I will look into it while I await the next reply. Here is a sample of my /usr/local/psa/var/log/maillog Feb 19 11:06:18 netcomwest qmail-queue-handlers[2660]: starter: submitter[2662] exited normally Feb 19 11:06:18 netcomwest qmail: 12034479...

Thanks for the reply. I have been looking through the logs to try and find out which account may be compromised. But is seems that qmail doesn't log which user is sending mail? Is this correct? Is there any way to turn up the logging to show this? As far as white listing, all I have in my plesk whit...

Thanks for the Reply Scott! I did come across that page earlier, and that got me to where I am. the problem is as I mentioned above, there are no uid's listed, just invoked for bounce and invoked from network. This is why I'm lost, if I had a uid I feel I would be close to solving the mystery. What ...

Hello all, I have a hosted server running RHELS 4 and Plesk 8.2. We host mail for a number of domains, and suddenly our mail queue is filling with thousands of Failure Notice and SPAM emails each hour. I have used qmHandle to examine headers to try and find out which uid is sending the mails, howeve...