How do I Eliminate spam email not meant for any of our users?

[Durrill]

In qmail, we are receiving thousands upon thousands of emails (likely dictionairy attacks) that are all sitting in queue, waiting to be delivered. How do I set it up so that I can determine what the delivering address is, and if that address does not exist amongst our users, then throw it into /dev/null or something, instead of letting it wait in the queue.... I don't want to send bounce backs either.

Our mail queue usually reaches to about 2GB+ before the server crashes. There must be a way to do this, please point out EXACTLY what I need to do.

 

[slylos]

2 utilities - SpamAssassin + Qmail-Scanner with the 'st' patch . . .

 

[thedaver]

Alternatively, you can let qmail do this for you by configuring a .qmail-default file for your domain(s). Use this to "deliver" locally the dictionary attack email when they don't match a real local/virtual address.

THEN, make a cron job that purges the "new" email in that dummy account every 15 minutes.

Dummy account is "deleteme@example.com"

.qmail-default contains
deleteme@example.com

cron then deletes (assuming a Maildir)
/home/deleteme/Maildir/new/*

You need to delete fairly frequently if you're under heavy attack since the "rm" command can only handle a file list of a few thousand items....

D.E.R. Management - IT Project Management Consulting

http://www.dermanagement.com/

 

[Durrill]

Excellent!

We setup a spam account and a simple cron that forcefully removes the contents of it's new directory every few minutes. That should keep it under control for now, until we can figure out how to setup / configure SpamAssassin and QmailScanner.

Thanks

 

[timmd1968]

I would love to have this too. Currently my .qmail-default (located /var/qmail/alias) has the following:

| /var/qmail/bin/fastforward -d /etc/aliases.cdb

Where would I put this dummy account? (i.e. on the next line, the 1st line, ect..)

Other then creating the home directory for this account is there any thing else I would need to do?

Do I have to restart qmail then?

Thanks,

Timm

 

[thedaver]

Timmd;
I'm not that familiar with fastforward, but if your current system is accepting delivery for unknown accounts, then yes, you would add the deleteme user below your current entry. If you find that this doesn't help, you may need to look into whether fastforward is reading other config files or whether there is more configurable behavior to be had there.

You should not need to restart anything, qmail reads this file for virtually every delivery made to the domain. Obviously restart if you make changes to the fastforward .cdb file.

D.E.R. Management - IT Project Management Consulting

http://www.dermanagement.com/