Hey LQ.

I don't know what to do, I know how to block and delete pretty much every other type of abuse.

I run a server with 500+ shared hosting clients and reseller clients and it was just blocked because of email spam.

I can keep on top of all other abuse (people trying to do dos attacks etc) but the one thing I can't get my head around is email spamming.

Any one have any information on how to stop people spamming emails from my server? This is really urgent.

Thanks.

I assume that one (or several) of the client installs acts as
an open relay; check out who produces the traffic, and then
look at their e-Mail configuration.

This is a cPanel server. Where would I check who is using the most mail traffic?

Sorry, I can't answer that - I never used cPanel; hope some of our
other members have, and will be able to shed light.

Thanks for your help anyway.

Really hope someone can help, I'm getting screwed with this.

Still looking for someone to help, please if anyone has any information I will appreciate it.

Okay...since you asked sooooo nicely - how about (long shot) mailsnarf? It's part of the dsniff package, a collection of nifty tools for all things network sniffing

Also, try this

to listen to the smpt port, granted, it will give you quite a bit to look at...but you will find out what time the spam is being pushed out...

Luck!

Thor

You will need to start by examining your log files. Undoubtedly there will be some indication of the spam messages and the user account from which they are originating. I don't mean to sound harsh, but I think you are also learning a really valuable lesson in the down side of the "install this gui application and go" without fully understanding the underlying how and why things work. Something in your system has clearly become compromised and you are responsible for it. The problem is that it is likely one of your customer's (?) hosted sites and / or mail servers. The problem could be a cracked password, SQL inejection, or a PWN of a process. Web stack applications are typically one of the most compromised systems, largely due to poorly written PHP or other script.