qmail-remove-0.95.tar.gz<\/a> [9.19 KiB]<\/p>\nBasic things you should know<\/strong>
\n[*]Where are the mail stored ?
\nUsually, for a mail like hello@mydomain.com you ll find the emails in \/var\/qmail\/mailnames\/mydomain.com\/hello\/Maildir\/new or \/cur. You can view their content with nano or vi or any text editor, and read them from your linux console, given they do not contains too much html gibberish.<\/p>\n[*]Where is the queue stored ?
\nThe queue, is the as it sounds to be, \u201call the mails that have not been yet delivered\u201d (delivered to a local user or to a remote user(not hosted on your mail server))<\/p>\n
Delivering the queue to the local users is not a big process, but delivering it to remote destination, well, might give a hard time to qMail sometimes ! (as for any other mail system of course)
\nSo, the queue is physically stored in folders within \/var\/qmail\/queue\/ Let\u2019s not bother with the details of all folders in that path, for the moment, we dont care.<\/p>\n
<\/p>\n
[*]Why is my qmail getting crazy ?
\nBack in the good old times, people were nice, internet was new, and the trees were green. Nowaday, a lot of companies or a**holes are also present on internet and gives nightmares to many admins.
\nOne of the nightmare is called SPAM Of course, there are many counters against spammer today, theirs servers IPs are marked as *bad*, anti spam software
\nare sold and used in every companies, etc\u2026 But there is still a way for them, they can take advantage of your mailsystem to deliver their spam .<\/p>\n
How do they do that ?
\nVery easy. Really. They just have to know some of your domain names, for example : @niceguy.com they dont want to know what user you have under this domain name, they wont send any email
\nto contact@niceguy.com or info@niceguy.com ! no, they will send 10000 emails to imsurethisemaildoesnotexist@niceguy.com and your qmail will generate a \u201cFailure notice\u201d, with the original content of the email, and try to send back a mail saying : I\u2019m sorry, this user does not exists !<\/p>\n
Well, here\u2019s the trick, your qmail is only relying on the fact that the bad guy who sent you this email, wrote nicely a \u201creply to\u201d header in all these 10000 emails. But the bad guy, instead of that, wrote 10000 emails of people he want to spam all over the earth. And your qmail system is now spamming all these 10000 people telling them \u201cI\u2019m sorry, this user does not exists !\u201d and here the content of your email\u2026
\nSee ? you become the spammer ! you ll be marked as a bad guy on the internet in no time if you dont react fast ! So, let\u2019s shield yourself !<\/p>\n
STOP THE BOUNCE !
\nFirst thing we\u2019ll do, if you agree, is to stop that good old bouncing system (failure notice) We re going to create a \u201ccatch all\u201d adress on your server, so, just create a mail called catchall@niceguy.com (replace niceguy.com by a domain hosted by your server of course\u2026 ) Now, using a terminal, go into the folder \/var\/qmail\/mailnames\/niceguy.com\/catchall\/ and enter that command<\/p>\n
\n
echo ‘#’ >.qmail<\/div>\n<\/div>\n
this will just create a text file called \u201c.qmail\u201d and with just a # as a content. This sets a rule for qmail, a rule that say, any mails coming for catchall@niceguy.com must be deleted immedialty, period. We have our catcher ! Now, we have two possibilities, either your using Plesk and all you have to do is to login to it, I Have Plesk so go to your domain list and check them all;
\nclick on Group Operations and Scroll down to Preferences.
\nFor the \u2018Mail to nonexistent user\u2019 option click the \u2018Switch on\u2019 radio button.
\nThen click the \u2018Forward to address\u2019 radio button and put catchall@niceguy.com in the box.
\nNow, you just scroll down and click OK .
\nAnd that\u2019s it for the first part.<\/p>\n
You should do this part wether or not your having problem, cause believe me, you re going to have problems one day or the other if you dont follow that procedure. Too bad it turns off the good old bouncing system, telling people around the world \u201cAh, maybe you mistyped the email\u201d. That was a pretty good idea, until the spammers came to the internet world, now, it s just a threat to have such an option activated on any mail system.<\/p>\n
I don\u2019t Have Plesk
\nWell, you ll have to write the rules yourself then
\nin every<\/p>\n
\n
\/var\/qmail\/mailnames\/domain.com\/
\n\/var\/qmail\/mailnames\/domain2.com\/
\n\/var\/qmail\/mailnames\/niceguy.com\/
\n\/var\/qmail\/mailnames\/123.com\/<\/div>\n<\/div>\n
etc.. you ll have to create a file named .qmail-default with the following content : &catchall@niceguy.com you can do so by typing the following command<\/p>\n
\n
echo “&catchall@niceguy.com” > \u00a0\/var\/qmail\/mailnames\/domain2.com\/.qmail-default<\/div>\n<\/div>\n
This set the following rule for qmail : If you dont find such a user on the server, then just forward the mail to catchall@niceguy.com<\/p>\n
One may ask, hey, why dont we just put a .qmail-default with # as a content, like that the mail wont be forwarded to any catchall adress, and will just be dropped. Well, this is what a qmail expert told me when i asked him: Quote: If you reject emails they may still bounce back to your server depending on where they appear to be sent from. If someone is spoofing your IP and that is why were they bounced to you in the first place they will come back one final time. So, i dont know if that qmail guru is right or not, but i made the choice to believe him, and use the magic catchall technique !<\/p>\n
So, if you followed that simple guide, your server should be fine now\u2026 or not\u2026 Setting these rules just made the forecoming spam attack harmless to your server, but what if your mail queue is already full ?
\nand those new rules are nice, but they dont care of the current queue !<\/p>\n
Empty the queue now<\/p>\n
Very important : Before going any further, stop the qmail service on your server,<\/p>\n
The guy who created qmail, as good as this system may or may not be, though you would do everything with nano and vi, and provided very few admin tools to effectively work with it..
\nWell, there is \/var\/qmail\/bin\/qmail-qstat that will tell you how big is your queue, and maybe if your an expert, you\u2019ll tell me that qmail is fantastic and anything can be done easily with it, but this post is not for expert, if you re an expert, I really wonder why you stumble on that post<\/p>\n
So, let say your queue is full of thousand of emails . I\u2019m just going to tell you how to empty it (nothing will be lost, just moved to another folder, so qmail is clean again) you have to install that qmail-remove i attached to that post you drop it in \/tmp on your server and you type this<\/p>\n
\n
tar xvfz qmail-remove-0.95.tar.gz
\ncd qmail-remove-0.95
\nmake
\nmake install<\/div>\n<\/div>\n
If that does not work, maybe you dont have \u201cmake\u201d, on debian, a \u201capt-get install\u201d make could do the trick.<\/p>\n
Ok, now you ve got qmail-remove on your system, and you have two choices
\n[*]Choice 1
\nEmpty everything, and start a new life for your server, deleting all the mails that are in the queue, maybe your users wont like that, and maybe they already don\u2019t like you because the mail system is completely crashed since hours or day because of that spam attack. If you go with this choice, just know that all your mails wont be actually deleted, they ll just be moved to the folder \/var\/qmail\/queue\/yanked\/ all the emails are stored in 3 parts<\/p>\n
\/var\/qmail\/queue\/info\/21321321
\n\/var\/qmail\/queue\/local\/21321321
\n\/var\/qmail\/queue\/mess\/21321321<\/p>\n
and qmail-remove will move all these 3 parts in the folder yanked, renaming them to<\/p>\n
\/var\/qmail\/queue\/yanked\/21321321.info
\n\/var\/qmail\/queue\/yanked\/21321321.local
\n\/var\/qmail\/queue\/yanked\/21321321.mess (the real mail content is in that file)<\/p>\n
Code to empty the whole queue (use with care) :<\/p>\n
\n
qmail-remove -r -n 10 -p “”<\/div>\n<\/div>\n
-r tells qmail-remove to remove the mail (moving it to the folder yanked)
\n-n 10 tells qmail-remove to analyse the 10 first bytes of the emails
\n-p \u201c\u201d tells qmail-remove to only remove those mails that contains \u201c\u201d which is true for all the mails<\/p>\n
[*]Choice 2
\nMaybe it wont be necessary to empty everything, and you can start by removing all the mails that contains the words Failure notice
\nHere\u2019s the code :<\/p>\n
\n
qmail-remove -r -n 512 -i -p “Subject: Failure Notice”<\/div>\n<\/div>\n
-i is to ignore case<\/p>\n
if you deleted(moved to yanked) some mails you would like to put back in the mailbox of some of your users, you ll have to find them in the yanked folder, find the XXXXX.mess ones, and move them to the folder of your user \/var\/qmail\/mailnames\/niceguy.com\/contact\/Maildir\/new\/<\/p>\n
I\u2019ll probably update this post later to tell you about qmHandle, basically, it s a viewer of your queue, that allows you do to many things qmail should give you the tools to do with a native installation. If you have any correction, additionnal informations, or else, please create an account on this forum(i m pretty sure the activation email will end in your spam folder cause i m not using a real SMTP server behing this forum, it s only using the basic unix mail command to send mail)<\/p>\n
Thanks for reading, and i hope this helped some of you guys and gals !<\/p>\n
miracl<\/p>\n","protected":false},"excerpt":{"rendered":"
Hello All, If you re having problems with bounce on qmail, if you re desperate about qmail getting crazy with thousands of email, then, let me tell you, that your quest ends here! The tools that will be used in this \u201ckind of tutorial\u201d are included right here :<\/p>\n
qmHandle: a tool to handle and […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/875"}],"collection":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=875"}],"version-history":[{"count":2,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/875\/revisions"}],"predecessor-version":[{"id":877,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/875\/revisions\/877"}],"wp:attachment":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=875"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=875"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=875"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}