How to disable a user account that is spamming big time

[pgentoo]

Tzvook Wrote:

BeNe Wrote:

Code:

postsuper -d ALL

For more info

Code:

man postsuper

Greez BeNe

10X BeNe
It did the Job :-)
Hope it solved all the problems

It looks like you have your queue all cleaned up, but I figured i'd add a little more info to this thread.

Like I said before, I've had the same issue where a single users site was spamming the world... In this case my mail queue was backed up with outgoing messages from this user and i wanted to blow them all out of the queue without affecting anyone else. The command BeNe gave, although 100% effective in emptying the queue, will remove all messages from the queue, whether they are from this spamming user or not... This could delete valid messages to other users on your account that have not yet been delivered (for one reason or another).

To limit this delete to a specific user, I've used the following command to delete all mail to/from a perticular email address:

mailq |grep problemaccount@domain.com|tr -d '*!'|awk '/problemaccount@domain.com/ {print $1}' |postsuper -d -

I hope that helps you out in the future.

Cheers,
Jesse

[BeNe]

Quote:The command BeNe gave, although 100% effective in emptying the queue, will remove all messages from the queue, whether they are from this spamming user or not... This could delete valid messages to other users on your account that have not yet been delivered (for one reason or another).

Absolute correct! Because Tzvook did not say anything about a special User or something...

Quote:I hope that helps you out in the future.

Yes - i am sure it does! Thanks for the Info - not that people read my Post and also clean up there complete mailqueue.

Greez BeNe

[Tzvook]

Thank you both for this info
I did empty the queue completely as BeNe said, and I knew I'm deleting other mail too, but I had no choice as it crushed the server.
I'm not sure the REJECT thing help, as this user continue sending mail and the queue is being filled again, but at least I know now how to empty it only for that user.
Is there any other way to stop this user from sending mail ?
( I stoped all their forms processors, but it didn't solved the issue)

Again, thanks for the much needed help.

[rbtux]

Quote:you should search the source of the mails... maybe cronjob or website script gone mad..

trace the error... It must be a script with a mail()-like function. Is the mailqueue filled up with bounces or with mails to deliver? When there are mails to deliver you have to adjust your blocking...

[Tzvook]

rbtux Wrote:

Quote:you should search the source of the mails... maybe cronjob or website script gone mad..

trace the error... It must be a script with a mail()-like function. Is the mailqueue filled up with bounces or with mails to deliver? When there are mails to deliver you have to adjust your blocking...

Hi rbtux
Queue is full of bounces ... my server probably got into every blacklist on (virtual) earth :-(
The thing is that I removed every script in there that uses the mail() func and still lots of spam.

This VU2038 user is a main domain user (i.e. not a "real" email addresss ... so I guess it's password is the IspCP account password ) ... so I changed the password - the spammer may use the account from outside the server .... but since the postfix again crushed the server, I still can't see if it helped .... :-(

Oh boy .... this spammer kills me :-(

[rbtux]

please post some log entries or some mail headers of the bounces... Whitout more information I can't help you...

[joximu]

Hi Tzvook

so you have a name in the spam mails? if you stop all websites of this customer (rename the folder /var/www/virtual/domain-from-vu2038) - does it continue to spam to outside?

If No then you can enable the site again and have a look in the logfile to find entries that are special..

If Yes - hm...

/J