HI Eric:
Yup we changed passwords and did all the restarts. Turns out when I
cleared the queue I neglected to clear the 'bounce' folder. Looks like
those are the files applying themselves to other user's emails.
I just went through deleted everything in the bounce folder - that
should put a stop to the failure notices.
Jeff
On 5/12/2017 10:41 PM, Eric Broch wrote:
First off, I'd simply change the offending user's password and restart
qmail and dovecot. This will stop the spammer.
I'll have to give the rest some thought.
On 5/12/2017 8:28 PM, Jeff Koch wrote:
Hi Eric or List - maybe you can help with this puzzle.
We had an email account user whose username and password got to a
spammer. The spammer then sent out thousands of spams from our email
server using our user's credential. We caught the situation midway.
To stop the spamming we disabled the user's SMTP access stopped qmail
and then deleted everything from the all the queue folders.
We are now getting numerous failure notices from the server's
MAILER-DAEMON (which is odd because we had cleared the qmail queue)
and they are being attached to emails that were not the spam and sent
to user's that never did the spamming. We can't understand why this
is happening since after having stopped qmail and cleared the queue
there should have been nothing in the pipeline trying to be sent and
if there was a bounce-back it should have gone to the user whose
credentials were used originally to send out the spam.
Any ideas? Is email in the process of making multiple attempts at
sending being stored or queued outside of the qmail queue?
Jeff
--
Eric Broch
White Horse Technical Consulting (WHTC)
