Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to protect Exim from spammers? Today had someone sign up and spam the queue with a bunch of e-mails. I run CPanel and have it so Exim only allows so many per hour but the system hit a load of 4.0 from the queue being hit hard and loaded up to about 50k emails.

Is there a way to keep an account from loading the queue so high or in some way to better protect Exim from spammers?

share|improve this question
    
What do you mean by 'someone sign up and spam the que'? Sign up to what? Something on your website which allows people to send mail outbound? – EightBitTony Jun 25 '12 at 8:08
    
Web hosting accounts. – Tiffany Walker Jun 25 '12 at 14:54
up vote 1 down vote accepted

Have you checked out this option:

Percentage of email messages to queue and retry for delivery

This configuration option allows you to define how overages are handled when a domain exceeds the maximum number of emails allowed per hour. By default, additional messages are queued for delivery and sent in the next hour. This option is only available to the root user and to resellers that have root privileges. The configuration data for this option is stored in /var/cpanel/cpanel.config.

The value you configure here is compared against the value set in Max hourly emails to determine whether an outgoing message should be queued and resent later or discarded. For example, if you set this value to 125%, then once the domain reaches its hourly limit, Exim will queue any additional messages, up to 125% of the Max hourly emails value. Once the account reaches 125% of the Max hourly emails value, any additional outgoing messages are discarded.

You may use this feature to discard all outgoing messages once the domain has reached its limit by setting the The percentage of email messages (above the account’s hourly maximum) to queue and retry for delivery value to 100.

share|improve this answer

There are several things you need to consider implementing to fight spam.

  1. Implement password policy in WHM. This will force users to create difficult password instead of a dictionary word.

  2. Go to this location in WHM, Home »Server Configuration »Tweak Settings now change these values

2a. Max hourly emails per domain.

2b. The percentage of email messages (above the account’s hourly maximum) to queue and retry for delivery. (Minimum: 100; Maximum: 10,000).

2c. Maximum percentage of failed or deferred messages a domain may send per hour.

2d. Number of failed or deferred messages a domain may send before protections can be triggered.

2e. Restrict outgoing SMTP to root, exim, and mailman (FKA SMTP Tweak). Prevent “nobody” from sending mail.

  1. Also you can change the location of sendmail binary (/usr/sbin/sendmail) in system. This is used by PHP to send emails from different scripts. Also Root or any other command line tool might not be able to send emails directly without a proper user with authentication in Exim.

  2. Setup cPHulk in WHM to stop bruteforce attacks "Home »Security Center »cPHulk Brute Force Protection".

  3. also` Check csf LF_SCRIPT_ALERT option WARNING This option will notify you when a large amount of email is sent from a particular script on the server, helping track down spam scripts

To fix this error : ssh into the server and edit the csf configuration file

vi /etc/csf/csf.conf

search for LF_SCRIPT_ALERT = “0″

Change the value from “0″ to “1″ to fix the issue.

Don’t forget to restart the CSF

You may also get the following error :

Check exim for extended logging (log_selector) WARNING You should enable extended exim logging to enable easier tracking potential outgoing spam issues. Add:log_selector = +arguments +subject +received_recipients

FIX:

Edit the exim configuration file :

/etc/exim.conf

Change the value from “log_selector = +all” to the following :

log_selector = +arguments +subject +received_recipients

save and restart the CSF to get this resolved.`

CSF Settings Source Site

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.