Sending lots of spam from Plesk server

[Richard_Markink]

Hello,

I have a Plesk v12.0.18_build1200140606.15 os_CentOS 6 server. using postfix
And Lots of spam is send from my server.
I tried: http://kb.odin.com/en/114845 but with no results.

on the moment the /var/log/maillog file is over 5,5GB
and the /var/log/maillog.processed is over 7,2GB and splitted into multiple .gz files

what can i do to find the source of the problem and stop it ?

 

[UFHH01]

Is this a daily log file size? Or don't you use logrotate on a daily basis for mail - logs?

What are the results from the suggestions at the KB - article ?

 

[Richard_Markink]

If i look in the /var/log/maillog file there are only records(16.000.000) from one day.

In the /var/tmp/mail.send i create in this articel remains empty. when i run
zgrep -c 'sasl_method=LOGIN' /usr/local/psa/var/log/maillog* then "1" is the only thing i see.

running
zgrep 'sasl_method=LOGIN' /usr/local/psa/var/log/maillog* | awk '{print $9}' | sort | uniq -c | sort -nr
results in:
1 sasl_username=[email protected]
this email adres is of a other admin who has sended a testmail.

 

[UFHH01]

Hello Richard_Markink,

you have a wait a while, before you can actually see results in the /var/tmp/mail.send file. You then should use the command:

grep X-Additional /var/tmp/mail.send | grep `cat /etc/psa/psa.conf | grep HTTPD_VHOSTS_D | sed -e 's/HTTPD_VHOSTS_D//' `​

... for results.

If there are still no results in that newly created temp - mail.send - file, you will have to investigate the enormous log - file and paste some suspicious log - entries, in order to get some suggestions, how you might solve your issue.


You should as well investigate the domain - specific apache and nginx logs ( /var/www/vhosts/system/YOURDOMAIN_OR_SUBDOMAIN.COM/logs ) , in order to compair activities, which try to send mails over websites and/or scripts.

 

[Richard_Markink]

I will try it again,

i have cleand the postfix log (have abackup) en flushed the que. no new mails are comming on the moment so i have to wait i think.
I checked the domain specific logs already. nothing abnormal find in here.

i will wait for the next hours and see what happens

 

[Sergey L]

Actually in Plesk 12.0 you shall be able to use outgoing mail limits http://download1.parallels.com/Plesk/Doc/en-US/online/plesk-administrator-guide/71349.htm#
At the very least your server won't be blacklisted and you will know which account was involved in sending it