Re: Floods of Emails Coming In To /var/spool/mqueue

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 01/06/2008 03:11 PM, Robert L Cochran wrote:
| I have a server box running Fedora Core 2 which hasn't been updated
| since sendmail 8.12.11-4.6. It has two mailman lists running on it which
| are important to me. Also, over the last few years, I've set up 2-4
| email accounts which are hosted by the server for the convenience of
| guests who have stayed with us for vacations and so on. I haven't paid
| much attention to either mailman or the email accounts over the years --
| they didn't cause an overt problem until now. Today I finally started
| investigating why some of my posts to the mailing list were not coming
| back to me as expected, and discovered that my /var/spool/mqueue
| directory is monstrously bloated. Look at the '20668416' in the
| directory listing (although I'm not sure what that number means, except
| to indicate the directory has a lot of files in it):
|
| drwx------ 2 root mail 20668416 Jan 6 15:58 mqueue
|
| I deleted the folder and then recreated it with the same permissions.
| But I'm still getting floods of emails from somewhere. 279 in the past
| hour or so. They look like spam.
|
| How can I put a stop to these emails -- do I need procmail recipes? Can
| I configure sendmail to drop anything not coming in for a valid user? Or
| is it best to upgrade to the latest version of Fedora and work on
| tightening up processing of incoming emails? Is there any way of
| stopping the tidal wave of spam? What is a sensible approach to fixing
| this?

What are some of the messages in mqueue?

My bet is that you have a (1) bunch of dead/dying addresses in your
mailing list and (2) these are overwhelmingly reject messages for spam
delivered to non-existent spam on your server. Are you doing any spam
processing?

By the way, Fedora 2 is not longer updated and should not be considered
secure. You might put the effort into rebuilding the server before
installing antispam solutions or reconfiguring anything.


- --

~ Steve
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iD8DBQFHgUkmeERILVgMyvARAh2lAJ4u4roLmmTkzK2l1Xn4d5BOQYXHGwCfbPcQ
Wzls3CwRj6yckw0aFUCPQNM=
=+mDe
-----END PGP SIGNATURE-----

--
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list

Relevant Pages

  • Re: spam
    ... I read through the pages and the logic for that list and found it interesting that he/they rely on self removing to clear out the occasional or "innocent" spammers from those that are robots and continue to spam, many without even knowing they are. ... I did not see any evidence that this was the case, and unlike my customer who was listed on several of the lists, your ip seems to only have been listed on this one site. ... If there is no activity in your Exchange monitor then I suspect either a rouge SMTP server on the SBS or one of the workstations. ...
    (microsoft.public.windows.server.sbs)
  • Re: Double messages
    ... Hehe, Karl kinda has a history on this list, it's not that everyone is unfriendly to everyone. ... No other lists have this problem. ... So it must be a problem at Fedora or a more complex problem. ... directly from the Fedora email server to mine. ...
    (Fedora)
  • Re: Anti-Spam ideas for usenet/list harvested email addresses
    ... > on mailing lists that only accepted email from the list servers I was on ... Spam is bad not only because it takes a lot of bandwidth, ... > up a safe list to see if the user accepts email from that server. ...
    (Debian-User)
  • Re: blacklisting by SORBS
    ... > ISP has been added to the SORBS blacklist as a source of spam. ... similar) to check to see which of the many lists is blocking that IP ... OB fedora: the postfix in fedora works just find to keep outsiders ...
    (Fedora)
  • Re: Anti-Spam ideas for usenet/list harvested email addresses
    ... Of course my real email will get spam because jacob is ... email that went out to usenet or mailing lists. ... > come from a server with reverse DNS of murphy.debian.org). ...
    (Debian-User)