Tag Info

Hot answers tagged

5

Does it mean that someone is using my username (MYEMAIL@example.com) to send spam? YES This log line was the proof of it. Aug 4 11:09:17 mail postfix/smtpd[71597]: 1AE3B7EC3D: client=unknown[59.88.35.206], sasl_method=PLAIN, sasl_username=MYEMAIL@example.com As you have permit_sasl_authenticated in main.cf, then you authorize anyone who knows your ...


4

Does the order of the rules actually matter? Yes it does. Denies should be first. Example Is there a more effective way to handle spammy requests than manually fail2ban can scan logs, and add IPs to many types of filtering systems that match defined patterns.


4

The log shows that someone has obtained the password for the mail account MYEMAIL@MYDOMAIN.COM and is using it to send SPAM through the server. The entry at time 11:09:17 shows a successful SASL authentication from IP address 59.88.35.206 with username MYEMAIL@MYDOMAIN.COM. The entry at 11:09:30 shows reception and queuing of a message with sender address ...


3

Run exim -bP log_file_path to get a templated log-file path; replace %s with main, and use that as the logfile to look at. (also %D for date, etc). If that really points to the same main.log file which you looked at, then use lsof, see if you have broken log-file rotation or something. If the file is the current log-file, the filesystem is not full, ...


2

Here is the normal mail flow inside of postfix when you relaying email. Client --- smtpd (receive) --- Queue Manager --- smtp (delivery) Parameter reject_unlisted_sender only help you block message in smtpd when postfix receiving email from client spammer. From the log you attached above, looks like the message already in queue, so the rejection won't ...


2

You might be able to do an strace to dump all running Apache processes to a file and then once the spam goes out, see if you can track down what was going on (such as by saving frequent dumps of server-status using mod_status if it's not obvious from the strace by looking at file paths). You could try something like the following - though note it may be ...


1

As root, you can use ps aux to show all the processes, and look for anything suspicious. You can also use find /path/to/cgi-bin -iname \*.php to look for attacker-introduced PHP scripts. But, it might not be seen by either of those things depending on what the attack is. If you suspect an attacker has control over your server, looking for the script is an ...


1

Not an expert here, it's been a very long time since I played with Exchange but I'll try to answer to the best of my ability. Lets discus the design for a second, why don't you route all traffic to EOP first and then to your in-premises Exchange servers? you're losing a good functionality there, it would definitely make things easier for you to control spam ...


1

According to the man page for sa-learn, this will be okay. If the messages you are learning from have already been filtered through SpamAssassin, the learner will compensate for this. In effect, it learns what each message would look like if you had run spamassassin -d over it in advance.


1

You should list all the domains you really don't care about in one "special" server stanza, and disable all logs for those domains: server { server_name www.sextoysnmore.org; access_log off; error_log /dev/null; }


1

In exchange 2010 you can rewrite some headers but not the "received" header. So the answer to your question is "you can't". At least natively with Exchange, maybe a third party program could do it... If Outlook Anywhere is not a option (as suggested by joeqwerty), I would say that you should force home users to pass trough a VPN to send corporate email. ...



Only top voted, non community-wiki answers of a minimum length are eligible