Spam Bounce messages in queue

[timetrap]

qmail queue is filling up pretty quickly with bounce messages that it tries to deliver to non-existing spammer domains. while i have set up doublebounces to be deleted; this doesnt seem to help when the domain is invalid. i assume that since there is no immediate bounce message received from the remote host, qmail just keeps trying to send these messages as long as set in queuelifetime.

is there a way i can tweak the queue that it doesnt try send bounce messages more than once and than gives up on sending the bounce.

 

[thedaver]

Are you seeing that the incoming spam results from dictionary attacks against non-existing users?

If so, lookup the patch here for "chkuser"

http://www.interazioni.it/opensource/chkuser/

D.E.R. Management - IT Project Management Consulting

http://www.dermanagement.com/

 

[timetrap]

not really, mostly messages sent to common account names (admin, webmaster etc..) but also a few to old accounts no longer used that were exposed to robots ways back when people didnt't think much about posting email addresses on the web. so not on the scale of a dict attack.

i know of chkuser but i'd rather not deal with it for several reasons, a.) it requires vpopmail which i do not want to use and b.) it has some requirements on previous patches that would make me nervous. at this point i got a pretty stable system and would rather not patch anymore unless it's very simple & straightforward without any dependencies... (too much time spent troubleshooting new patches already )

it seems that since all bounces are sent with <> envelope FROM, that there should be a way to avoid queuing these forever. also, i believe server needs to return a temporary error for qmail-remote to queue these messages. so that would mean, these are all servers that do exit but don't sent EHLO or some other problem. correct me if i'm wrong?

 

[thedaver]

Another thing you can do is to put .qmail aliases in place for those formerly legit accounts and have them all deliver to a real account called something like "discard".

Then run a cron script to run (hourly)

root rm -f ~user/Maildir/new/*

You need to run it hourly if you're getting a lot of mail because the "rm" command has a limit on the number of files it can handle as parameters

That way you don't have so many bounces to accounts you can name specifically.

The chkuser patch will, obviously, spare you the dictionary attacks.

D.E.R. Management - IT Project Management Consulting

http://www.dermanagement.com/