Tag Info

New answers tagged

1

According to the man page for sa-learn, this will be okay. If the messages you are learning from have already been filtered through SpamAssassin, the learner will compensate for this. In effect, it learns what each message would look like if you had run spamassassin -d over it in advance.


0

I had the same problem. This even resulted in getting my IP's blacklisted. My host recommended me to add pyxsoft anti malware plugin on the WHM. It detected the infected files in wordpress, the spam stopped when I deleted those files but they kept coming back every day. So I had to delete them everytime. Then I consulted my host again and they ...


3

Run exim -bP log_file_path to get a templated log-file path; replace %s with main, and use that as the logfile to look at. (also %D for date, etc). If that really points to the same main.log file which you looked at, then use lsof, see if you have broken log-file rotation or something. If the file is the current log-file, the filesystem is not full, ...


0

As you are using exim, it is likely you are running some distribution of Linux. If so, you can used iptables to block outgoing connections to port 25. In your case, you may want to drop the connections so that they will stick around for a while. Monitor the system with netstat -antp | grep :25 to determine a process is trying to send a message. Then you ...


1

As root, you can use ps aux to show all the processes, and look for anything suspicious. You can also use find /path/to/cgi-bin -iname \*.php to look for attacker-introduced PHP scripts. But, it might not be seen by either of those things depending on what the attack is. If you suspect an attacker has control over your server, looking for the script is an ...


2

You might be able to do an strace to dump all running Apache processes to a file and then once the spam goes out, see if you can track down what was going on (such as by saving frequent dumps of server-status using mod_status if it's not obvious from the strace by looking at file paths). You could try something like the following - though note it may be ...


2

Here is the normal mail flow inside of postfix when you relaying email. Client --- smtpd (receive) --- Queue Manager --- smtp (delivery) Parameter reject_unlisted_sender only help you block message in smtpd when postfix receiving email from client spammer. From the log you attached above, looks like the message already in queue, so the rejection won't ...


1

Not an expert here, it's been a very long time since I played with Exchange but I'll try to answer to the best of my ability. Lets discus the design for a second, why don't you route all traffic to EOP first and then to your in-premises Exchange servers? you're losing a good functionality there, it would definitely make things easier for you to control spam ...


1

You should list all the domains you really don't care about in one "special" server stanza, and disable all logs for those domains: server { server_name www.sextoysnmore.org; access_log off; error_log /dev/null; }


4

Does the order of the rules actually matter? Yes it does. Denies should be first. Example Is there a more effective way to handle spammy requests than manually fail2ban can scan logs, and add IPs to many types of filtering systems that match defined patterns.


-1

Sounds like you were basically running an open relay and after a while, some spam bot found it and started launching emails through it. Theres a couple of Postfix settings to close your server down. One is the permitted networks option. I usually only permit local 'known' networks and then add any other network ranges to the local list that I need. The ...


5

Does it mean that someone is using my username (MYEMAIL@example.com) to send spam? YES This log line was the proof of it. Aug 4 11:09:17 mail postfix/smtpd[71597]: 1AE3B7EC3D: client=unknown[59.88.35.206], sasl_method=PLAIN, sasl_username=MYEMAIL@example.com As you have permit_sasl_authenticated in main.cf, then you authorize anyone who knows your ...


4

The log shows that someone has obtained the password for the mail account MYEMAIL@MYDOMAIN.COM and is using it to send SPAM through the server. The entry at time 11:09:17 shows a successful SASL authentication from IP address 59.88.35.206 with username MYEMAIL@MYDOMAIN.COM. The entry at 11:09:30 shows reception and queuing of a message with sender address ...


1

In exchange 2010 you can rewrite some headers but not the "received" header. So the answer to your question is "you can't". At least natively with Exchange, maybe a third party program could do it... If Outlook Anywhere is not a option (as suggested by joeqwerty), I would say that you should force home users to pass trough a VPN to send corporate email. ...



Top 50 recent answers are included