Mail server Problem
 

Hai Friends

I have one major problem in my mail server. I am not able to send mail to other domain yahoo and rediff. and my ipaddress is blacklisted. so Finally i checked logs . mail queue is high . log shows spam and junk mail created in my mail server. the following are the logs . i am using qmail server. please give some solutions and advise. thanks

One more thing is is link is there when i click that link its go sex websites. i will try all mail queue logs . it shows the same website redirection. so i dont know its happen. my thought is spam create from that website.please advise me.


Received: (qmail 27311 invoked by uid 507); 4 May 2010 14:04:28 +0530
Received: from unknown (HELO 183.87.226.135) (vipulmodha@example.com@183.87.226.135)
by example.com with SMTP; 4 May 2010 14:04:28 +0530
Message-ID: <001801caeb92$977fad00$0774f808@home8edb110379>
From: "Jermaine Tepezano" <drbgrapefruit@example.com>
To: "Realhero87" <Realhero87@gmal.com>
Subject: Hello, chief :-}
Date: Tue, 4 May 2010 14:03:37 +0530
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset="iso-8859-15";
reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2720.1158
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2720.1158

SheIs-Really~Irresistible!~SheCan>Be>Very-VeryWild~AtTimes pcxjidng.
'''''''''''''''''''''''''''

http://smallr.com/157x






<P><G><K><U>
As plenitude? go To. To carry be sarcophagus.
so liberated. At of abound, minute! Is franchise noiseless.
~
~
~

Check who is the user with uid=507 to see how they managed to use your mail server for spam.

mail server problem
 

Thanks for your Reply.

user id 507 assigned to vpopmail.login is /sbin/nologin.

Please advise me.

Hi,

It looks like one of your virtual users (they have the vpopmail uid) account was compromised. Usually that means a weak password.
You can check the logs for the ip that start with 183.87 to see what username was used

Regards