Editing Delete mail queue In Qmail

[[category:Qmail]]

==Objective==

Sometimes we get spam issue with Qmail. The Spammer is able to get the account's password and continuously Relay mails to whole world via this Server . In that case thousands of mail will be in queue.

== Methodology for  Detection and permanent fix  == 

# First Find the Queue status 
# Then find out who is spamming 
# Then find out what account is Compromised . 
# Then Change the password for that account or delete the account if not required .
# Then delete all the mails which has been generated by this spammer
# Check the log for no more successful attempts of that spammer.
# Check the Damage done in the reputation of outgoing IP via mxtools.com 
# Possibly , if there are multiple IP's available change the outgoing IP 

==Process ==

First stop qmail 

vim /etc/inittab 

 SV:123456:respawn:/command/svscanboot

 # out above line end of file

 init q

For get help of qmHandle

 qmHandle -h


To know which user account has been compromised. this command shows which user sending maximum mail.

 qmHandle -l |grep From:|sort|uniq -c|sort -nr|head

Or can use below for same purpose

 qmHandle -l|less

get message ID 

 qmHandle -m'message ID'|less

Please check in header file which user account compromised.

Change password for it first and delete mail in queue.

You can delete mail from queue using different option to from qmHandle -h (help)

For example

 qmHandle -h'Subject: limited offer'

above command will delete all messages in queue that have Subject: limited offer


'''Note:->'''  Please never apply above commands before stop qmail(mentioned above).