Tag Archives: sysadmin

IP Location

We rely on IP location for many things as sysadmins, like checking where that flood of logins to wordpress is coming from (China?!). Or even checking if a new order is coming from downtown Dubai or from the outskirts of Jakarta…

I usually use ip2location.com/demo/ and it works great from the browser. Recently however I noticed one of my colleagues using db-ip. They have a rest API. So I wrote this small wrapper, that needs plenty of fixes:
wget -qO- "http://api.db-ip.com/addrinfo?addr=${ADDR}&api_key=${KEY}"

Here’s a sample session:
$ ipinfo
{"address":"","country":"US","stateprov":"California","city":"San Francisco"}

Very simple, but seems enough if I want to check the IP location from the shell. Maybe I’ll add more features (if I need them!)

Similar Posts:

Tagged , , ,

Clearing the Queue

Talking about mail queues here. Especially when the queue gets filled with hundreds of thousands of spam emails.

Stop the MTA

The first thing you do is stop the MTA before it gets worse. On most Linux servers:
~: # /etc/init.d/exim stop # most WHM/cPanel based servers
~: # /etc/init.d/postfix stop # if you have postfix

Then check the queue

The commands to use are
~: # exim -bp
~: # mailq

I suggest keeping CTRL+C ready to stop the flow. If you have an infestation scrolling through the queue will take a very very long time.
But checking out the first few lines (pages) of the queue may reveal many things. For example, what user account is being exploited for sending out the spam. Sometimes that’s obvious, other times you may need to do some digging. Here’s a sample:

24h  1.1K 1VeKKb-00030t-42 <noreply@yahoo-inc.com>
        D alena@example.com
        D alenka@example.com
        D alepp@example.com
        D alerei@example.com

24h  1.1K 1VeKKb-00030u-5R <noreply@yahoo-inc.com>
        D alex@example.com
        D alex.b@example.com
        D alex.d@example.com
        D alex.f@example.com

24h  1.1K 1VeKKb-00030v-1R <noreply@yahoo-inc.com>
        D alex.t@example.com

The lines above are from an exim queue output. Obviously noreply@yahoo-inc.com is not an account on this server. Let’s find the username then clean up. A nice Exim utility is exigrep (basically it’s grep with exim ties!)
:~# exigrep 1VeKKb-00030t-42 /var/log/exim/mainlog
+++ 1VeKKb-00030t-42 has not completed +++
2013-11-08 21:18:14 1VeKKb-00030t-42 <= noreply@yahoo-inc.com H=(User) [XXX.XX.XX.XXX] P=esmtpa A=login:test@mydomain.com S=1193 T="Authenticate Your Email" from <noreply@yahoo-inc.com> for alena@example.com alenka@example.com alepp@example.com alerei@example.com [...]

2 things interest us here: the H=(User) [XXX.XX.XX.XXX] part tells us where that intruder is logging from (probably another exploited server, so it’s nice to alert the owners of that server as well. And A=login:test@mydomain.com tells us which user they are logged in as, so we can lock down that user, change their password, etc.

Cleaning up

Emptying the queue is usually an easy way out:
~: # postsuper -d ALL # for postfix
~: # exim -bp | exiqgrep -i | xargs exim -Mrm # for exim

A more subtle approach is needed when some of that mail in the queue is actually legit. If you checked out the queue earlier you might do something like the following:
~: # exiqgrep -i -f noreply@yahoo-inc.com | exim -Mrm # that will remove all mail sent by noreply@yahoo-inc.com

It’s a bit harder in postfix, here’s one recipe:
~: # mailq | tail +2 | awk 'BEGIN { RS = "" } { if ($7 == "noreply@yahoo-inc.com") print $1 }' | tr -d '*!' | postsuper -d -
remove the tail +2 | if that doesn’t work for you.

There are plenty of other things to check and do to fix your server when someone is abusing it to spam. Cleaning up is one way to start.

Ah, before I forget, here’s a link to a very nice cheatsheet for exim

Similar Posts:

Tagged , , , , ,