Spam Attack slowing postfix

Discussion in 'Installation/Configuration' started by azteca2137, Jul 28, 2010.

  1. azteca2137

    azteca2137 Member

    Some spammer is trying to send mails thru my mail server, according to the logs the mails are not going thru, but my outgoing valid emails are taking too many time to go (for example: I have been trying to send an email of 600kb and it can't get out since an hour) :mad:

    is there something I could do so my valid emails go faster? or I'm stuck until the attack finish?

    Thanks in advance
     
  2. fishtenors

    fishtenors New Member

    I had a similar issue where one of my user's password had been compromised, and some spammer was using the account to blast messages through my server. See what's in the queue with:

    #postqueue -p

    There is a great Perl script called pfdel that I used to clear out the queue:

    http://www.ustrem.org/en/articles/postfix-queue-delete-en/

    Save that script somewhere, and then add execute permissions:

    #chmod +x /some/path/pfdel

    Execution of the script is really simple. Usage: pfdel <email_address>:

    #/some/path/pfdel [email protected]

    If you are running Postfix with SASL, run:

    #cat /var/log/mail.log | grep sasl

    to see if you have any user that is authenticating at a higher rate than normal. That is how I was able to identify the hijacked account. Hope that helps!
     
  3. azteca2137

    azteca2137 Member

    Thank you for your reply, however that is not the case, the spam is not going thru my server, my server is blocking all of it and the queue is empty, but the server is just realy slow for send valid emails.

    Any idea, I'm running Fedora 7, ISPConfig 2.2.32
     
  4. till

    till Super Moderator Staff Member ISPConfig Developer

  5. azteca2137

    azteca2137 Member

    Thanks for your reply Till, but there are too many IP's, however it seems that the spam stopped about half hour ago and the server is running normally again (let's hope that stay that way)

    I am interested in the route command for blocking IP's, is blocked before making the request to the postfix?

    Thanks again for your help Till and fishtenors :D
     

Share This Page