Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

GroupWise 8 SLES

So.. my email server's send queue is currently at 20,000+ emails and growing. Log files are full of this type of thing:

18:48:14 840 MSG 1401510 Converting message to SMTP: /mail/pidom/wpgate/gwialnx/send/xe666aee.401
18:48:14 376 MSG 1401512 Processing inbound message: /mail/pidom/wpgate/gwialnx/receive/92dd56e4.631
18:48:14 376 MSG 1401512 Sender: test@petrovis.net
18:48:14 376 MSG 1401512 Recipient: jabbundi@lycos.com
18:48:14 376 MSG 1401512 Recipient: jabc@myway.com
18:48:14 376 MSG 1401512 Recipient: jabdel@aol.com
18:48:14 376 MSG 1401512 Recipient: jabdmn@hotmail.com
18:48:14 376 MSG 1401512 Recipient: jabdolrahimi@aol.com
18:48:14 376 MSG 1401512 Recipient: jabdta@aol.com
18:48:14 376 MSG 1401512 Recipient: jabdulhamid@hotmail.com
18:48:14 376 MSG 1401512 Recipient: jabdulrazque@yahoo.com
18:48:14 376 MSG 1401512 Recipient: jabeardslee@aol.com
18:48:14 376 MSG 1401512 Recipient: jabedini@yahoo.com
18:48:14 376 MSG 1401512 Recipient: jabeebe@aol.com
18:48:14 376 MSG 1401512 Recipient: jabeef@aol.com
.......

Port 25 on the firewall is set up to allow connections only from our anti-spam provider (postini)

My question is, how do I find out where these messages are originating, and how do I stop them?

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

You let them get sent (just a few) then look at the email's "original text" if your server supports archiving mail. Look in the queue files if possible to see if you can actually read the mails before they get sent. I mean, depending on how important the mail server is, shut it down for a few minutes and note who connects to it when it comes online again. Even better, disallow use of it outside the domain. That will put an end to the issue for good.

share|improve this answer
    
Thanks.. I was able to see the originating IP's in the headers and block them at the firewall. –  Tom Studee Sep 7 '11 at 14:35
    
@TomStudee Even if you solved the problem, your solution is a bad solution. The next IP will exploit the same security hole. You have to secure your server to deny relaying. –  mailq Sep 7 '11 at 18:51
    
@mailq: I'm aware. We just moved to a cloud-based spam solution, and by block them at the firewall I meant block everyone that isn't in our providers IP range :) So no.. not a 'bad' solution. –  Tom Studee Sep 8 '11 at 22:17
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.