LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Server (https://www.linuxquestions.org/questions/linux-server-73/)
-   -   qmail related issue (https://www.linuxquestions.org/questions/linux-server-73/qmail-related-issue-864004/)

aliabbass 02-21-2011 04:56 AM

qmail related issue
 
there is qmail server in my office. Yesterday some of the users received mails from mailer-daemon and postmaster.those mails when checked from the logs showed some unknown ip instead of the server ip. we came to know after checking that those were viruses. One of the account receiving mail was configured in that user's gmail account as fetcher and gmail when received those mails it simply blocked it. Now this issue has been reported previously also.Can someone tell that why there are mails being sent to users from postmaster and mailer-daemon and what can we do to stop mailer-daemon and postmaster to send these mails. there is also firewall working with the qmail

never say never 02-21-2011 06:26 AM

If I am reading your post right, the mail you are receiving from "Mailer Daemon" and "Postmaster", are not from your machine, but rather from other machines. It could be generated by the other server for your mail account, or it could be what is known as Backscatter. Backscatter is where mail is sent out with your address as the From. When it is not delivered, poorly configured mail servers will send the rejected e-mail back to the address in the "From" thus delivering the payload.

It is yet another method to get someone to open spam or Virus laden mail.

In order to protect your users the server should be doing spam checking, virus scanning, and taking other measures to ensure e-mail is properly addresses, does not contain a virus, and is not spam.

You need to look at tools like Maia Mailguard, which uses a fork of Amavisd, SpamAssassin, Clam AV, as well as various other checks to prevent spam and viruses from reaching your users mailboxes.

aliabbass 02-21-2011 11:52 PM

Quote:

Originally Posted by never say never (Post 4265753)
If I am reading your post right, the mail you are receiving from "Mailer Daemon" and "Postmaster", are not from your machine, but rather from other machines. It could be generated by the other server for your mail account, or it could be what is known as Backscatter. Backscatter is where mail is sent out with your address as the From. When it is not delivered, poorly configured mail servers will send the rejected e-mail back to the address in the "From" thus delivering the payload.

It is yet another method to get someone to open spam or Virus laden mail.

In order to protect your users the server should be doing spam checking, virus scanning, and taking other measures to ensure e-mail is properly addresses, does not contain a virus, and is not spam.

You need to look at tools like Maia Mailguard, which uses a fork of Amavisd, SpamAssassin, Clam AV, as well as various other checks to prevent spam and viruses from reaching your users mailboxes.

thanks


All times are GMT -5. The time now is 02:43 PM.