Is my server sending spam ? (qmail question, lots of mails going out)
Hello All !
I'm posting hoping you can help me with my qmail server. It runs on Debian with Plesk 8.6 on top of it, and it is used by a small number of persons (less than 10 accounts) sending a normal amount of e-mail for a human being (I mean no lists, no commercial spam, just person to person e-mails). I've setup logwatch ( http://www.logwatch.org/ ) on my server to keep an eye on it, and also checked that there's no relay open with http://www.spamhelp.org/shopenrelay/ , so that part is ok. But logwatch tells me there's a lot of mail going out : a typical day would be like this: (that's from yesterday's qmail logs) Code:
Remote Server Responses: On the receiving end, that server got around 6800 e-mails (83% of spam in it) yesterday, filtered by spamassassin. And another bit of information: logwatchs lists all the remote addresses qmail has sent mail to. Here's the first few lines of the list, with the number of mails sent (I replaced the @ sign by _AT_ in the addresses below): Code:
Emails to Remote Server (Threshold of 2): Why is qmail sending these guys e-mails ? Are they answers (bounces, error codes or whatever) generated because of the spam coming in ? What can I check further to be sure these mails *aren't* spam relayed from my server ? Thanks for your help, Paul-Henri |
You can check qmail log files (usually located in /var/log/qmail/current and /var/log/qmail/smtpd/current) to see who is supposed to send mail to these addresses and from what IP.
Regards |
could always use one of the online Open Relay tests to check your server.
Odds are a lof of that failed outbound mail that is defered and clogging your queues is bounces from the spam to email addresses in your domain that do not exist. Your mail server is probably receiving and processing the messages rather than simply rejecting the messages when they arrive. Your mail server would them email out a ton of replies, this effect is sometimes called backscattter. Might want to configure your qmail server to reject that junk. http://www.jm-associates.com/admin/qmail_list_faq.html Quote:
|
Quote:
Thanks for your help and suggestions :) I checked my server for open-relayness, and it's OK on that side of the battle. Your suggestion about configuring qmail to reject that junk is a good idea, and seems to fit well my problem. I'll check the faq and links you gave me, thanks again. I'll also try to get a list of those outgoing mails with destination and subject appearing to understand more about what's going on. Paul-Henri |
Well... things aren't as easy as I thought : patching seems out of the way, for 2 reasons: all those patches require recompiling qmail, and I haven't got a compiler on my server (I guess it's like that for security reasons), and the other is that since it's a server with Plesk installed, I'm not sure if the version that Plesk uses isn't patched in some way or another, and I'd be reluctant to recompile a vanilla-qmail and replace the one used by Plesk (given the configuration tampering that I already saw that was made by Plesk).
I also looked at qmailtap, in order to get a copy of all the stuff that's sent by my server and have an idea of what's going out, but it's also a patch... sigh... Is there a way to configure qmail logs in order to have the subject of the outgoing mail written somewhere ? I have the destination in my maillog file, but it isn't enough to know if it's bounces or spam going out. Paul-Henri |
the last option in the list might be of interest..
Quote:
Sorry I am not familiar with qmail logging so I don't know if you can increase the detail level of your logs. I can't say that i have ever seen the mail subject in a MTA log file before though. Maybe this will help. http://qmail.jms1.net/logfiles.shtml |
I finally went around the problem by activating a DNSBL check at the smtp level, and that has dramatically decreased the spam I get: for the first time in years, I get more clean mail than spam mail... wow :)
I'm also looking into switching to Postfix for the same reasons as you did. I found an MTA comparison chart, btw: http://shearer.org/MTA_Comparison, quite helpful. Paul-Henri |
All times are GMT -5. The time now is 08:01 AM. |