Delete mail queue In Qmail - Revision history

Biswajit: /* Objective */

2013-02-18T13:04:29Z

Objective

← Older revision		Revision as of 13:04, 18 February 2013
Line 3:		Line 3:
	==Objective==		==Objective==

	Sometimes we get spam issue with Qmail. In that case thousands of mail will be in queue.		Sometimes we get spam issue with Qmail. The Spammer is able to get the account's password and continuously Relay mails to whole world via this Server . In that case thousands of mail will be in queue.


	== Methodology for Detection and permanent fix ==		== Methodology for Detection and permanent fix ==

Biswajit at 13:02, 18 February 2013

2013-02-18T13:02:12Z

← Older revision		Revision as of 13:02, 18 February 2013
Line 1:		Line 1:
			[[category:Qmail]]

	==Objective==		==Objective==

	Sometimes we get spam issue with Qmail. In that case thousands of mail will be in queue.		Sometimes we get spam issue with Qmail. In that case thousands of mail will be in queue.


			== Methodology for Detection and permanent fix ==

			# First Find the Queue status
			# Then find out who is spamming
			# Then find out what account is Compromised .
			# Then Change the password for that account or delete the account if not required .
			# Then delete all the mails which has been generated by this spammer
			# Check the log for no more successful attempts of that spammer.
			# Check the Damage done in the reputation of outgoing IP via mxtools.com
			# Possibly , if there are multiple IP's available change the outgoing IP

			==Process ==

	First stop qmail		First stop qmail
Line 34:		Line 50:
	Change password for it first and delete mail in queue.		Change password for it first and delete mail in queue.

	You can delete mail from queue using ~~defference~~ option to from qmHandle -h (help)		You can delete mail from queue using different option to from qmHandle -h (help)

	For example		For example

Subhash: Created page with "==Objective== Sometimes we get spam issue with Qmail. In that case thousands of mail will be in queue. First stop qmail vim /etc/inittab SV:123456:respawn:/command/svsc..."

2013-02-18T12:48:16Z

Created page with "==Objective== Sometimes we get spam issue with Qmail. In that case thousands of mail will be in queue. First stop qmail vim /etc/inittab SV:123456:respawn:/command/svsc..."

New page

==Objective==

Sometimes we get spam issue with Qmail. In that case thousands of mail will be in queue.

First stop qmail

vim /etc/inittab

SV:123456:respawn:/command/svscanboot

# out above line end of file

init q

For get help of qmHandle

qmHandle -h

To know which user account has been compromised. this command shows which user sending maximum mail.

qmHandle -l |grep From:|sort|uniq -c|sort -nr|head

Or can use below for same purpose

qmHandle -l|less

get message ID

qmHandle -m'message ID'|less

Please check in header file which user account compromised.

Change password for it first and delete mail in queue.

You can delete mail from queue using defference option to from qmHandle -h (help)

For example

qmHandle -h'Subject: limited offer'

above command will delete all messages in queue that have Subject: limited offer

'''Note:->''' Please never apply above commands before stop qmail(mentioned above).