0

I don't know how to detect if qmail has been hijacked

I looked and saw a bunch of

Dec 23 14:10:57 qmail: 1261606257.101924 starting delivery 36: msg 8423008 to remote [email protected] Dec 23 14:10:57 qmail: 1261606257.630379 starting delivery 22: msg 8421857 to remote [email protected]

load is at 20 think spammer is sending mail through the server?

What can I do to try and stop it, or read the mail to see where its coming from? If its a php form or pop account.

1
  • What kind of logging is available? SMTP logging? MTA logging? Have you run the equivalant of netstat to look at current network connections?
    – joeqwerty
    Dec 24, 2009 at 0:16

1 Answer 1

1

/var/qmail/bin/qmail-qstat

or better

/var/qmail/bin/qmail-qread

will be the starting point.

Then locate a SPAM message ID and search for a file with that name in /var/qmail/queue (find /var/qmail/queue -iname ).

Find common characteristic to all SPAM (say IP/Subject, From, Auth information etc.) and use qmHandle to remove emails from queue and take steps to make sure that SPAM stop coming.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .