my domain is abc.cd.ef
my FQDN of mail server is z.abc.cd.ef
in my system, there is a user fedexexpressdelivery@z.abc.cd.ef is sending spam. but i cant find that user to disable it. pls tell me how !
thanks in advance !
- Zimbra Collaboration 9.0.0 now available. Read the release notes.
- Zimbra Collaboration 8.8.15 LTS now available. Read the release notes.
- Are you a Zimbra Developer? You can find some interesting stuff in our Official GitHub, Blog and the Community Github.
- Zimbra is Open Source! Read the FAQ. You can also contribute and build binary from source!
i'm in a big spam trouble ! pls help me !
i'm in a big spam trouble ! pls help me !
Did you look at any of the forum threads on this topic? How do you know that's the 'user' that's sending spam? The information you've posted doesn't actually give any details about the problem, you're going to have to look at the log files to determine what the problem actually is.
i'm in a big spam trouble ! pls help me !
i log in web mail of zimbra and that user is sending randomly thousand of emails. thats emails make my system crash !
ex : my domain is abc.cd.ef so my user email is : lananh@abc.cd.ef
but the email sending spam is fedexexpressdeliverry@z.abc.cd.ef . and z.abc.cd.ef is the FQDN of my mail server.
i cant find that user !
p.s: i searched but i cant find any solution
[quote user="10330phoenix"]Did you look at any of the forum threads on this topic? How do you know that's the 'user' that's sending spam? The information you've posted doesn't actually give any details about the problem, you're going to have to look at the log files to determine what the problem actually is.[/QUOTE]
ex : my domain is abc.cd.ef so my user email is : lananh@abc.cd.ef
but the email sending spam is fedexexpressdeliverry@z.abc.cd.ef . and z.abc.cd.ef is the FQDN of my mail server.
i cant find that user !
p.s: i searched but i cant find any solution
[quote user="10330phoenix"]Did you look at any of the forum threads on this topic? How do you know that's the 'user' that's sending spam? The information you've posted doesn't actually give any details about the problem, you're going to have to look at the log files to determine what the problem actually is.[/QUOTE]
i'm in a big spam trouble ! pls help me !
[quote user="lananhbin"]i log in web mail of zimbra and that user is sending randomly thousand of emails. thats emails make my system crash !
ex : my domain is abc.cd.ef so my user email is : lananh@abc.cd.ef[/QUOTE]I understand that.
[quote user="lananhbin"]but the email sending spam is fedexexpressdeliverry@z.abc.cd.ef . and z.abc.cd.ef is the FQDN of my mail server.
i cant find that user ![/QUOTE]You still haven't said how you know this 'user' is sending spam, where did you get that email address from? If you got this from the log files then you should see the IP address of the client that's submitting the email. If you have no user with that name on your ser then you've either got a compromised account or a spam bot on your network that's submitting mail through your server.
[quote user="lananhbin"]p.s: i searched but i cant find any solution[/QUOTE]There are plenty of solutions in the forums, I'd suggest you look at some of those threads that discuss 'compromised accounts' and try some of the suggestions you'll find. You will additionally need to look at your log files to find the source of this problem, merely repeating the suspected user name does not give enough information anyone to advise you - you're going to have to do some digging in the log files.
ex : my domain is abc.cd.ef so my user email is : lananh@abc.cd.ef[/QUOTE]I understand that.
[quote user="lananhbin"]but the email sending spam is fedexexpressdeliverry@z.abc.cd.ef . and z.abc.cd.ef is the FQDN of my mail server.
i cant find that user ![/QUOTE]You still haven't said how you know this 'user' is sending spam, where did you get that email address from? If you got this from the log files then you should see the IP address of the client that's submitting the email. If you have no user with that name on your ser then you've either got a compromised account or a spam bot on your network that's submitting mail through your server.
[quote user="lananhbin"]p.s: i searched but i cant find any solution[/QUOTE]There are plenty of solutions in the forums, I'd suggest you look at some of those threads that discuss 'compromised accounts' and try some of the suggestions you'll find. You will additionally need to look at your log files to find the source of this problem, merely repeating the suspected user name does not give enough information anyone to advise you - you're going to have to do some digging in the log files.
i'm in a big spam trouble ! pls help me !
i disconnect the network then i loged in my admin page. i can see the user send emails most. i cant find that user on my system. i didnt
i have some information.
there are few email from the ip : 101.221.201.127 send to my system.with:
sender : fedexexpressdeliverry@z.abc.cd.ef . it's the same name with the account sending spam on my system.
from host : unknown
origin domain : smtp-amavis:[127.0.0.1]:10024
that's all i have now. i cant find the local ip or user on my system sending mail !
if i'm under "spam bot" attract, what should i do ? i searched with keyword you gave but i still cant find any solution ! pls help me ! thanks
i have some information.
there are few email from the ip : 101.221.201.127 send to my system.with:
sender : fedexexpressdeliverry@z.abc.cd.ef . it's the same name with the account sending spam on my system.
from host : unknown
origin domain : smtp-amavis:[127.0.0.1]:10024
that's all i have now. i cant find the local ip or user on my system sending mail !
if i'm under "spam bot" attract, what should i do ? i searched with keyword you gave but i still cant find any solution ! pls help me ! thanks
i'm in a big spam trouble ! pls help me !
Hi,
The simple temporary solution (or call it a first aid :) ), just tell Zimbra to banned all mail sending from your FQDN instead of from your domain.
add the following line :
blacklist_from *@z.abc.cd.ef
and then save it (with :wq!, because this file is read-only) follow by :
The permanent solution : investigate your logs (start from /var/log/zimbra.log) and find out the origin (IP, sender, SASL login) of spam messages
The simple temporary solution (or call it a first aid :) ), just tell Zimbra to banned all mail sending from your FQDN instead of from your domain.
su - zimbra
vi /opt/zimbra/conf/salocal.cf.in
add the following line :
blacklist_from *@z.abc.cd.ef
and then save it (with :wq!, because this file is read-only) follow by :
zmmtactl restart && zmamavisdctl restart
The permanent solution : investigate your logs (start from /var/log/zimbra.log) and find out the origin (IP, sender, SASL login) of spam messages
i'm in a big spam trouble ! pls help me !
thanks vavai ! althrough i did the other way. I blocked the 101.221.201.127 , add more rules to my MTA ...and now (maybe) i solved my trouble . but i still cant find the compromised accounts :(
p.s: thanks phoenix so much :D
p.s: thanks phoenix so much :D
-
7310pyperdown
- Posts: 31
- Joined: Fri Sep 12, 2014 10:02 pm
i'm in a big spam trouble ! pls help me !
You need to look at your zimbra.log files, possibly going back a couple of days. If it's not in the current log you may need to look at zimbra.log.0, or zimbra.log.[1-4].gz
This fragment checks the log file, and counts the number of connections in each recorded timestamp minute ie
5 12:48 ignorant_user
32 12:53 ignorant_user
And so on.
zgrep -i "auth ok" /var/log/zimbra.log | awk -F"[ :]" '{print $3":"$4,$11;}' | uniq -c | sort -nr
This fragment checks the log file, and counts the number of connections in each recorded timestamp minute ie
5 12:48 ignorant_user
32 12:53 ignorant_user
And so on.
zgrep -i "auth ok" /var/log/zimbra.log | awk -F"[ :]" '{print $3":"$4,$11;}' | uniq -c | sort -nr
Who is online
Users browsing this forum: Google [Bot] and 9 guests