Top Nav

Archive | QMail

Log Email Senders

Often hackers will use a compromised website to sent large amounts of spam email. On a shared server with many websites, it can be hard to tell which site and script is sending the spam. Here’s a procedure for Qmail that will (a) add a header with the script path and (b) create a log file of senders.

1. Create file at /var/qmail/bin/sendmail-wrapper with the following contents:

2. Set permissions on wrapper:

3. Move sendmail binary

4. Symlink the wrapper into place:

The log file will be create at /tmp/mail.send.

1

Disable Qmail Double Bounces

To cleanly handle double bounces:

1. Create a dot-qmail file at /var/qmail/mailnames/yourdomain.com/.qmail-doublebounce containing:

2. Route double bounces to this file:

0

Whitelist host on qmail install

To whitelist a host on a qmail install (qmailrocks in this case) do the following:

Edit /etc/tcp.smtp and add this line:

Replacing XXX.XXX.XXX. with the ip of the host to be whitelisted.

Next rebuild the cdb file with:

This first procedure prevents RBL checks on the host.

To whitelist a host or domain in spam assassin, edit vi /etc/mail/spamassassin/local.cf and add a line like this:

0

Easy Qmail Install

With a web browser go to http://lazyinstaller.net/pages/generator.xhtml and complete the form.

Copy/paste the generated script to a text file on the target server and make executable.

Edit the script and comment out the first echo line.

Run the script.

0