Talking about mail queues here. Especially when the queue gets filled with hundreds of thousands of spam emails.
Stop the MTA
The first thing you do is stop the MTA before it gets worse. On most Linux servers:
~: # /etc/init.d/exim stop # most WHM/cPanel based servers
~: # /etc/init.d/postfix stop # if you have postfix
Then check the queue
The commands to use are
~:Â # exim -bp
~:Â # mailq
I suggest keeping CTRL+C ready to stop the flow. If you have an infestation scrolling through the queue will take a very very long time.
But checking out the first few lines (pages) of the queue may reveal many things. For example, what user account is being exploited for sending out the spam. Sometimes that’s obvious, other times you may need to do some digging. Here’s a sample:
24h 1.1K 1VeKKb-00030t-42 <noreply@yahoo-inc.com>
D alena@example.com
D alenka@example.com
D alepp@example.com
D alerei@example.com
24h 1.1K 1VeKKb-00030u-5R <noreply@yahoo-inc.com>
D alex@example.com
D alex.b@example.com
D alex.d@example.com
D alex.f@example.com
24h 1.1K 1VeKKb-00030v-1R <noreply@yahoo-inc.com>
D alex.t@example.com
[...]
The lines above are from an exim queue output. Obviously noreply@yahoo-inc.com is not an account on this server. Let’s find the username then clean up. A nice Exim utility is exigrep (basically it’s grep with exim ties!)
:~# exigrep 1VeKKb-00030t-42 /var/log/exim/mainlog
+++ 1VeKKb-00030t-42 has not completed +++
2013-11-08 21:18:14 1VeKKb-00030t-42 <= noreply@yahoo-inc.com H=(User) [XXX.XX.XX.XXX] P=esmtpa A=login:test@mydomain.com S=1193 T="Authenticate Your Email" from <noreply@yahoo-inc.com> for alena@example.com alenka@example.com alepp@example.com alerei@example.com [...]
2 things interest us here: the H=(User) [XXX.XX.XX.XXX] part tells us where that intruder is logging from (probably another exploited server, so it’s nice to alert the owners of that server as well. And A=login:test@mydomain.com tells us which user they are logged in as, so we can lock down that user, change their password, etc.
Cleaning up
Emptying the queue is usually an easy way out:
~:Â # postsuper -d ALL # for postfix
~:Â # exim -bp | exiqgrep -i | xargs exim -Mrm # for exim
A more subtle approach is needed when some of that mail in the queue is actually legit. If you checked out the queue earlier you might do something like the following:
~:Â # exiqgrep -i -f noreply@yahoo-inc.com | exim -Mrm # that will remove all mail sent by noreply@yahoo-inc.com
It’s a bit harder in postfix, here’s one recipe:
~:Â # mailq | tail +2 | awk 'BEGIN { RS = "" } { if ($7 == "noreply@yahoo-inc.com") print $1 }' | tr -d '*!' | postsuper -d -
remove the tail +2 | if that doesn’t work for you.
There are plenty of other things to check and do to fix your server when someone is abusing it to spam. Cleaning up is one way to start.
Ah, before I forget, here’s a link to a very nice cheatsheet for exim