Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I don't know how to detect if qmail has been hijacked

I looked and saw a bunch of

Dec 23 14:10:57 qmail: 1261606257.101924 starting delivery 36: msg 8423008 to remote ysacy2966@prima.net.ar Dec 23 14:10:57 qmail: 1261606257.630379 starting delivery 22: msg 8421857 to remote ogiqar6234@rima-tde.net

load is at 20 think spammer is sending mail through the server?

What can I do to try and stop it, or read the mail to see where its coming from? If its a php form or pop account.

share|improve this question
    
What kind of logging is available? SMTP logging? MTA logging? Have you run the equivalant of netstat to look at current network connections? –  joeqwerty Dec 24 '09 at 0:16

1 Answer 1

/var/qmail/bin/qmail-qstat

or better

/var/qmail/bin/qmail-qread

will be the starting point.

Then locate a SPAM message ID and search for a file with that name in /var/qmail/queue (find /var/qmail/queue -iname ).

Find common characteristic to all SPAM (say IP/Subject, From, Auth information etc.) and use qmHandle to remove emails from queue and take steps to make sure that SPAM stop coming.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.