Peter Sparkes
2011-Jan-13 12:23 UTC
[Pkg-exim4-users] Pkg-exim4-users Digest, Vol 65, Issue 6
Thanks Peter, I will do some more checking Peter> Send Pkg-exim4-users mailing list submissions to > pkg-exim4-users at lists.alioth.debian.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.alioth.debian.org/mailman/listinfo/pkg-exim4-users > or, via email, send a message with subject or body ''help'' to > pkg-exim4-users-request at lists.alioth.debian.org > > You can reach the person managing the list at > pkg-exim4-users-owner at lists.alioth.debian.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Pkg-exim4-users digest..." > > > Today''s Topics: > > 1. Spam sent to user from user''s email address (Peter Sparkes) > 2. Re: Spam sent to user from user''s email address (Peter Gossner) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 13 Jan 2011 08:00:19 +0000 > From: Peter Sparkes<peter at didm.co.uk> > Subject: [Pkg-exim4-users] Spam sent to user from user''s email address > To: Pkg-exim4-users at lists.alioth.debian.org > Message-ID:<4D2EB113.9050809 at didm.co.uk> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Hi, > > My Exim4 users are getting spam sent to them which appear to come from there own email address. > > Assuming that these emails are originating from my exim server how do I, please, stop them > > Regards > > Peter > > > > > ------------------------------ > > Message: 2 > Date: Thu, 13 Jan 2011 21:45:59 +1030 > From: Peter Gossner<gossner at internode.on.net> > Subject: Re: [Pkg-exim4-users] Spam sent to user from user''s email > address > To: pkg-exim4-users at lists.alioth.debian.org > Cc: peter at didm.co.uk > Message-ID:<20110113214559.7be884a6gossner at internode.on.net@joni.tux> > Content-Type: text/plain; charset=US-ASCII > > On Thu, 13 Jan 2011 08:00:19 +0000 > Peter Sparkes<peter at didm.co.uk> wrote: > >> Hi, >> >> My Exim4 users are getting spam sent to them which appear to come >> from there own email address. >> >> Assuming that these emails are originating from my exim server how do >> I, please, stop them >> >> Regards >> >> Peter >> >> > The list will need some more info to help. > Meantime, unless you have a bad egg local user its unlikely that the mails are originating from YOUR server. > 1/ Check the mail headers and see if you can get a little more info. > 2/ Check /var/log/exim4/mainlog > Cross check against victims local mail address and times. > > > Once you have the originating SMTP server you can block it a number of ways. > here are two: > > 1/ create a file called: /etc/exim4/local_host_blacklist > [ man exim4_local_host_blacklist ] > its a simple list of IP addresses to deny access to > e.g. from Man page: > 192.168.10.0/24 > !172.16.10.128/26 > 172.16.10.0/24 > 10.0.0.0/8 > > Restart exim and your at least half way there. > You can append to that file anytime you like. > > 2/ set up an iptables rule to block to IP totally or only when using the SMTP port: > something like... > iptables -N EXIMDROPS > iptables -A EXIMDROPS -p tcp -s 123.456.789 -j REJECT > iptables -A INPUT -p tcp -m tcp --dport 25 -j EXIMDROP > Or use your favorite GUI tools > (there are many ways of skinning that cat, that is a rough example.) > > Install spamassassin or similar > apt-cache search spam > > >> _______________________________________________ >> Pkg-exim4-users mailing list >> Pkg-exim4-users at lists.alioth.debian.org >> http://lists.alioth.debian.org/mailman/listinfo/pkg-exim4-users > > --Pete (another one) > (local-debian-hints.u8) > :your fortune cookie: > > Debian Hint #21: If your Debian box is behind a slow network connection, > but you have access to a fast one as well, check out the apt-zip package. > > Peter Gossner<gossner at internode.on.net> > <pete.gossner at gmail.com> > > > > ------------------------------ > > _______________________________________________ > Pkg-exim4-users mailing list > Pkg-exim4-users at lists.alioth.debian.org > http://lists.alioth.debian.org/mailman/listinfo/pkg-exim4-users > > End of Pkg-exim4-users Digest, Vol 65, Issue 6 > ********************************************** >