SPAM ON MY SERVER! Please help

[skim]

Hello,,,

I have a web server that has about 50domains of different companies.. I have noticed the dramatic increase in spam to my clients emails ? does anyone here have that problem? spam assasin is not powerful enough to delete incoming mail ? any solutions ? please help

 

[poke]

What is your SpamAssasin set to?

If you feel like your server is sending spam, setup an SPF record.. do a search on this forum please..

 

[skim]

not sure if my server is sending out spam... but this spam coming in is driving everyone nuts... any ideas?

we were thinking of creating each domain with it's own ip // do you think that would help ?

 

[poke]

A couple things i can think of...

Are your domains using reverse dns?

Also more importantly, most attacks are within your own server. I'd audit your clients and make sure any "shady" looking clients aren't abusing.

 

[skim]

what do you mean by

Are your domains using reverse dns?

I am pretty sure... none of my clients are the cause of all this spam

any suggestions on the audit process?

im thinking someone is using our send mail to send spam?

like looping? if that makes anysense

have tons of failed messages as well....

 

[poke]

Originally posted by skim
what do you mean by

Are your domains using reverse dns?

I am pretty sure... none of my clients are the cause of all this spam

Actually, are you providing reverse DNS as this is really out of the client's control? This of course wouldn't be for shared hosting.

 

[skim]

i am using a vps with

10gigs and unmetered bandwith

not dedicated but shared i guess ?

approx 50domains

 

[skim]

there are some emails on the clients websites // that is a bad idea ?

BOTS COMING BY TO PICK UP emails ?

 

[poke]

okay, sorry about my rubbage, I'm sure most of your domains are on the same IP...

Also, what version of SpamAssasin are you using, 3.0.4 or 3.1?

 

[skim]

i am not to sure. but i got a plesk upgrade not to long ago...

8

 

[mhutchings]

If you know how to access your server by command line, type "rrpm -q spamassassin" to figure out what version of spamassassin you are using.

 

[mhutchings]

And yes, "generally speaking" emails displayed openly on a users site is bad. You may want to try to encode them somehow or take other steps to protect them. A search on google should help with that.

 

[skim]

awesome thank you..

and ill get that spam version for you

 

[skim]

Originally posted by poke
okay, sorry about my rubbage, I'm sure most of your domains are on the same IP...

Also, what version of SpamAssasin are you using, 3.0.4 or 3.1?

i am using spamassassin 3.1

 

[dramirez]

Hi, I'm also with the insufficient spamassassin syndrome. I have (rpm -qa):

psa-spamassassin-8.0.0-rhel4.build80060331.13
spamassassin-3.0.4-1.el4

on a Red Hat Enterprise 4 box runnning Plesk 8.0 .

How can I do better than putting a "7" (or any score) on the weight setting, and a "delete all" ? I wish I can put extra filtering (rules du jour or similar) but am afraid of molesting Plesk...

Any recommendations ?

 

[atomicturtle]

A real easy improvement is to add in razor, dcc and pyzor to the box. Restarting spamassassin will detect and use them automatically, so no additional configuration is needed. All 3 are available in my archive now (add the [atomic] channel, yum install razor-agents dcc pyzor, restart spamd)

I'm maintaining some SA tuning information on my Project Gamera page, which is relevant to any SA configuration (PSA, PG, etc):
http://www.atomicrocketturtle.com/Joomla/content/view/77/29/