Floods of Emails Coming In To /var/spool/mqueue

[Steven Stern]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 01/06/2008 03:11 PM, Robert L Cochran wrote:
| I have a server box running Fedora Core 2 which hasn't been updated
| since sendmail 8.12.11-4.6. It has two mailman lists running on it which
| are important to me. Also, over the last few years, I've set up 2-4
| email accounts which are hosted by the server for the convenience of
| guests who have stayed with us for vacations and so on. I haven't paid
| much attention to either mailman or the email accounts over the years --
| they didn't cause an overt problem until now. Today I finally started
| investigating why some of my posts to the mailing list were not coming
| back to me as expected, and discovered that my /var/spool/mqueue
| directory is monstrously bloated. Look at the '20668416' in the
| directory listing (although I'm not sure what that number means, except
| to indicate the directory has a lot of files in it):
|
| drwx------   2 root   mail   20668416 Jan  6 15:58 mqueue
|
| I deleted the folder and then recreated it with the same permissions.
| But I'm still getting floods of emails from somewhere. 279 in the past
| hour or so. They look like spam.
|
| How can I put a stop to these emails -- do I need procmail recipes? Can
| I configure sendmail to drop anything not coming in for a valid user? Or
| is it best to upgrade to the latest version of Fedora and work on
| tightening up processing of incoming emails? Is there any way of
| stopping the tidal wave of spam? What is a sensible approach to fixing
| this?

What are some of the messages in mqueue?

My bet is that you have a (1) bunch of dead/dying addresses in your
mailing list and (2) these are overwhelmingly reject messages for spam
delivered to non-existent spam on your server. Are you doing any spam
processing?

By the way, Fedora 2 is not longer updated and should not be considered
secure. You might put the effort into rebuilding the server before
installing antispam solutions or reconfiguring anything.


- --

~  Steve
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iD8DBQFHgUkmeERILVgMyvARAh2lAJ4u4roLmmTkzK2l1Xn4d5BOQYXHGwCfbPcQ
Wzls3CwRj6yckw0aFUCPQNM=
=+mDe
-----END PGP SIGNATURE-----