mail server | /var/logs/paulooi.log https://logs.paulooi.com Systems Admin, Web Development and etc Tue, 25 Mar 2014 01:49:58 +0000 en-US hourly 1 How to Disallow or Rate Limit Web Server Mail in Exim https://logs.paulooi.com/how-to-disallow-or-rate-limit-web-server-mail-in-exim.php https://logs.paulooi.com/how-to-disallow-or-rate-limit-web-server-mail-in-exim.php#respond Tue, 25 Mar 2014 01:49:58 +0000 http://systems.takizo.com/?p=1666 Recently one of the apache webserver’s vhost was compromise and allow spammer to use the script to perform massive outgoing email spam. As usual, due to un-patch WordPress’s engine from a user on the web server. Ended up the “hacker”...

The post How to Disallow or Rate Limit Web Server Mail in Exim first appeared on /var/logs/paulooi.log.]]> Recently one of the apache webserver’s vhost was compromise and allow spammer to use the script to perform massive outgoing email spam. As usual, due to un-patch WordPress’s engine from a user on the web server. Ended up the “hacker” been using the PHP’s mail() function sending a massive 100k++ outgoing email to email provider such as yahoo mail and gmail.

There were a lot email queue in Exim’s queue, due to the blockage from recipient server. Unfortunately WordPress doesn’t have SMTP setting for outgoing email notification, it has to rely on third party plugins.

Here is what we implement on SMTP MTA to deny/rate limit outgoing from PHP’s mail() function.

On Exim config file, before hitting ACL configuration, place this config for non-smtp setting


acl_not_smtp = acl_check_not_smtp

After “begin acl” section, place this config 


acl_check_not_smtp:

  deny
        senders = www@domain.com
        message = sorry server is offline

  deny
        ratelimit = 20 / 1h / strict / $sender_address_domain
        senders = *@domain.com
        message = sorry server is offline

  accept

The first rule is totally deny anything from apache’s vhost. It means non of the apache’s vhost can send outgoing email with PHP mail() function. If you are not comfortable with this. Can try on the second rules, which is rate limit the outgoing email, which can help to eliminate the massive outgoing email happened on apache web server UID.

Have fun controlling and fight with the spam 😉

The post How to Disallow or Rate Limit Web Server Mail in Exim first appeared on /var/logs/paulooi.log.]]> https://logs.paulooi.com/how-to-disallow-or-rate-limit-web-server-mail-in-exim.php/feed 0 exim, playing with mail queue in server https://logs.paulooi.com/exim-playing-with-mail-queue-in-server.php https://logs.paulooi.com/exim-playing-with-mail-queue-in-server.php#respond Mon, 21 Jul 2008 06:05:11 +0000 http://systems.takizo.com/?p=215 there are over thousand emails queue in our mail server, even though I have configured email frozen more than 10 days automatically delete/remove, but it seem like doesn’t work as expected. here is the work around if you plan to...

The post exim, playing with mail queue in server first appeared on /var/logs/paulooi.log.]]> there are over thousand emails queue in our mail server, even though I have configured email frozen more than 10 days automatically delete/remove, but it seem like doesn’t work as expected.

here is the work around if you plan to do it manually.

start with listing email queue in the server, by using the command exim -bp, it will list all the email currently queue in the server. but my only concern is frozen email in the server, which I would like to manually clean it from the queue. let try something here,

exim -bp | grep frozen

18d 24K 1JhiI4-00096B-OW <> *** frozen ***
18d 2.3K 1JhiII-00097Y-8s <> *** frozen ***
16d 2.8K 1JhiKM-0009AL-9M <> *** frozen ***
15d 2.3K 1JhiLO-0009Bs-EF <> *** frozen ***
15d 2.5K 1JhiLS-0009Bx-O2 <> *** frozen ***
12d 2.7K 1JhiNm-0009S5-AQ <> *** frozen ***
10d 3.3K 1JhiPv-0009aN-Vu <> *** frozen ***
10d 24K 1JhiQ9-0009as-4R <> *** frozen ***

There are the emails currently queue in the server, and now you might want to check why did the email was queue in the server by exim -Mvl

2008-04-02 15:58:52 Received from <> H=(xxx.xxx.net) [202.76.234.132] P=esmtp S=2143 id=20080402075613.8287E22E8BB@xxx.xxx.net
2008-04-02 15:58:52 routing failed for rsvundet_2002@xxxx.com.my: User account not exist
*** Frozen (delivery error message)

If you want to remove all the email from queue more than 18 days, try this command;

exim -bp | grep 18d | awk ‘{ print $3 }’ | xargs exim -Mrm

Message 1JhiI4-00096B-OW has been removed
Message 1JhiII-00097Y-8s has been removed
Message 1JhiKM-0009AL-9M has been removed
Message 1JhiLO-0009Bs-EF has been removed
Message 1JhiLS-0009Bx-O2 has been removed
Message 1JhiNm-0009S5-AQ has been removed

some usefull queue commands:

-bp : Queue email in Server
-bpc : Count Queue email in Server
-M : Force delivery
-Mar : Add recipient
-Meb : Edit message body
-Mes : Edit sender
-Mf : Freeze message
-Mg : Give up (and bounce message)
-Mmad : Mark all recipients as delivered
-Mmd : Mark recipient as delivered
-Mrm : Remove message (no bounce)
-Mt : Thaw message
-Mvb : View message body
-Mvh : View message header
-Mvl : View message log

enjoy and happy cleaning queue email!

Links

Exim Cheat Sheet by bratthemad
Last update: 20080721

The post exim, playing with mail queue in server first appeared on /var/logs/paulooi.log.]]> https://logs.paulooi.com/exim-playing-with-mail-queue-in-server.php/feed 0