Hallo All, Seems I am under some 1

[BIS]

Hallo All,

Seems I am under some sort of dictionary attack.

# qmailctl stat
/service/qmail-send: up (pid 468) 24026 seconds
/service/qmail-send/log: up (pid 469) 24026 seconds
/service/qmail-smtpd: up (pid 470) 24026 seconds
/service/qmail-smtpd/log: up (pid 475) 24026 seconds
/service/qmail-pop3d: up (pid 477) 24026 seconds
/service/qmail-pop3d/log: up (pid 478) 24026 seconds messages in queue: 46632 messages in queue but not yet preprocessed: 0

I have a ton of messages in the queue. I have tried

qmailctl flush
qmailctl doqueue

Both inform me that

Sending ALRM signal to qmail-send.

But after this nothing happens. Could anyone enlighten me as to how I can flush this queue?


Many thanks for any ideas you might provide me.

 

[thedaver]

BIS, bummer man.
I cleaned up one of these for a customer a few months ago. Not a big deal, but not fun...

Here's my methodology:
1) get your hands on two queue mgt tools:
(may need to compile)

http://www.linuxmagic.com/opensource/qmail/qmail-remove/

http://sourceforge.net/projects/qmhandle

2) shutdown all qmail services, just makes it easier.
3) Do a little grepping in /var/qmail/queue/mess/* to find a string that you think is representative of the messages that are fouling your queue
4) Trying running qmail-remove (with qmail offline!) (remember to DELETE!)
5) You should see the queue decreased afterwards.

Notes: There are cases where qmailctl will not properly shut down the qmail-send daemons in this case, you should "ps waux" for them to assure that they are off, otherwise use "svc -d" and then even "killall qmail-send" to rid them from your process tree. Otherwise, my experience is that the qmail-remove program doesn't delete as expected. Not erroneously, just not at all or not enough.

I'd be delighted to chat with you offline, my friend.
Best of luck!
Dave.




D.E.R. Management - IT Project Management Consulting

http://www.dermanagement.com/

 

[thedaver]

Also, be sure that you've disabled your double-bouncing and that your anti-virus engine is moving virii to quarantine or /dev/null without ANY further email being processed on that message. Otherwise, the attack will potentially continue to fill your queue.





D.E.R. Management - IT Project Management Consulting

http://www.dermanagement.com/

 

[thedaver]

Oh, and sorry. The qmail-remove instructions should have a few caveats:

1) Choose matching strings as uniquely as you can to the spam. Don't choose stuff in headers, use it from content and forecast where you might overlap with legitimate content.

2) Run this several times for the various strings. Don't try to get 99% on the first run, chip away. Runs faster, stays sharper on the string matching criteria.

You probably thought of that, but it's worth putting in the thread for others.

D.E.R. Management - IT Project Management Consulting

http://www.dermanagement.com/

 

[BIS]

thedaver,

Thank you!

I don't know why, but I had completely forgotten about qmail-remove and qmHandle.

Anyway,
Cleared out about 45000 mails from yahoo.com.tw and yahoo.com.hk

All is good now.

Thanks again.