Similar Posts:
- None Found
Email Tracking
Most email clients can request a return receipt. One way to set this up in Thunderbird for example is to go to “Preferences > Advanced > General > Return Receipts …” and check the “When sending messages, always request a return receipt”
The problem with this approach is that when the person you’re emailing has set his email client to reject that request (or does that manually every time), you will not get a receipt back. And honestly speaking there is no way to force that. Now there are some services out there that promise to track your mail when that’s read, and those rely on embedding a transparent gif that will call home when the message is opened. I tried a few of these services: the free ones did not deliver (or seemed too shady for my taste) and the paid ones did not look too good either. So I cooked up a quick solution that I can use when needed (like when I’m tracking my brother on his honeymoon trip *evil grin*)
The code is below, pretty self explanatory. You will need a transparent gif/png. That’s easy too 😉
Edit: Looks like some services are not so bad. Checkout bananatag and YesWare Email Tracking
Similar Posts:
Clearing the Queue
Talking about mail queues here. Especially when the queue gets filled with hundreds of thousands of spam emails.
Stop the MTA
The first thing you do is stop the MTA before it gets worse. On most Linux servers:
~: # /etc/init.d/exim stop # most WHM/cPanel based servers
~: # /etc/init.d/postfix stop # if you have postfix
Then check the queue
The commands to use are
~: # exim -bp
~: # mailq
I suggest keeping CTRL+C ready to stop the flow. If you have an infestation scrolling through the queue will take a very very long time.
But checking out the first few lines (pages) of the queue may reveal many things. For example, what user account is being exploited for sending out the spam. Sometimes that’s obvious, other times you may need to do some digging. Here’s a sample:
24h 1.1K 1VeKKb-00030t-42 <noreply@yahoo-inc.com>
D alena@example.com
D alenka@example.com
D alepp@example.com
D alerei@example.com
24h 1.1K 1VeKKb-00030u-5R <noreply@yahoo-inc.com>
D alex@example.com
D alex.b@example.com
D alex.d@example.com
D alex.f@example.com
24h 1.1K 1VeKKb-00030v-1R <noreply@yahoo-inc.com>
D alex.t@example.com
[...]
The lines above are from an exim queue output. Obviously noreply@yahoo-inc.com is not an account on this server. Let’s find the username then clean up. A nice Exim utility is exigrep (basically it’s grep with exim ties!)
:~# exigrep 1VeKKb-00030t-42 /var/log/exim/mainlog
+++ 1VeKKb-00030t-42 has not completed +++
2013-11-08 21:18:14 1VeKKb-00030t-42 <= noreply@yahoo-inc.com H=(User) [XXX.XX.XX.XXX] P=esmtpa A=login:test@mydomain.com S=1193 T="Authenticate Your Email" from <noreply@yahoo-inc.com> for alena@example.com alenka@example.com alepp@example.com alerei@example.com [...]
2 things interest us here: the H=(User) [XXX.XX.XX.XXX] part tells us where that intruder is logging from (probably another exploited server, so it’s nice to alert the owners of that server as well. And A=login:test@mydomain.com tells us which user they are logged in as, so we can lock down that user, change their password, etc.
Cleaning up
Emptying the queue is usually an easy way out:
~: # postsuper -d ALL # for postfix
~: # exim -bp | exiqgrep -i | xargs exim -Mrm # for exim
A more subtle approach is needed when some of that mail in the queue is actually legit. If you checked out the queue earlier you might do something like the following:
~: # exiqgrep -i -f noreply@yahoo-inc.com | exim -Mrm # that will remove all mail sent by noreply@yahoo-inc.com
It’s a bit harder in postfix, here’s one recipe:
~: # mailq | tail +2 | awk 'BEGIN { RS = "" } { if ($7 == "noreply@yahoo-inc.com") print $1 }' | tr -d '*!' | postsuper -d -
remove the tail +2 | if that doesn’t work for you.
There are plenty of other things to check and do to fix your server when someone is abusing it to spam. Cleaning up is one way to start.
Ah, before I forget, here’s a link to a very nice cheatsheet for exim