Category: QMail

Log Email Senders

November 10, 2012

Often hackers will use a compromised website to sent large amounts of spam email. On a shared server with many websites, it can be hard to tell which site and script is sending the spam. Here’s a procedure for Qmail that will (a) add a header with the script path and (b) create a log file of senders. 1. Create file at /var/qmail/bin/sendmail-wrapper with the following contents:


#!/bin/sh
(echo X-Additional-Header: $PWD ;cat) | tee -a /var/tmp/mail.send|/var/qmail/bin/sendmail-qmail "$@"

#!/bin/sh

(echo X-Additional-Header: $PWD ;cat) | tee -a /var/tmp/mail.send|/var/qmail/bin/sendmail-qmail "$@"

2. Set permissions on wrapper:


chmod 755 /var/qmail/bin/sendmail-wrapper

chmod 755 /var/qmail/bin/sendmail-wrapper

3. Move sendmail binary


cp /var/qmail/bin/sendmail /var/qmail/bin/sendmail-qmail

cp /var/qmail/bin/sendmail /var/qmail/bin/sendmail-qmail

4. Symlink the wrapper into place:


ln -s /var/qmail/bin/sendmail-wrapper /var/qmail/bin/sendmail

ln -s /var/qmail/bin/sendmail-wrapper /var/qmail/bin/sendmail

The log file will be create at /tmp/mail.send.

Disable Qmail Double Bounces

March 6, 2009

To cleanly handle double bounces: 1. Create a dot-qmail file at /var/qmail/mailnames/yourdomain.com/.qmail-doublebounce containing:

|exit 0

|exit 0

2. Route double bounces to this file:

echo yourdomain.com > /var/qmail/control/doublebouncehost
echo doublebounce > /var/qmail/control/doublebounceto

1 2	echo yourdomain.com > /var/qmail/control/doublebouncehost echo doublebounce > /var/qmail/control/doublebounceto

Whitelist host on qmail install

July 28, 2007

To whitelist a host on a qmail install (qmailrocks in this case) do the following: Edit /etc/tcp.smtp and add this line:

XXX.XXX.XXX.:allow,RBLSMTPD=""

1	XXX.XXX.XXX.:allow,RBLSMTPD=""

Replacing XXX.XXX.XXX. with the ip of the host to be whitelisted. Next rebuild the cdb file with:

qmailctl cdb

1	qmailctl cdb

This first procedure prevents RBL checks on the host. To whitelist a host or domain in spam assassin, edit vi /etc/mail/spamassassin/local.cf and add a line like this:

whitelist_from *@friendlydomain.net

1	whitelist_from *@friendlydomain.net

Easy Qmail Install

August 8, 2004

With a web browser go to http://lazyinstaller.net/pages/generator.xhtml and complete the form. Copy/paste the generated script to a text file on the target server and make executable. Edit the script and comment out the first echo line. Run the script.