Spam Troubleshoot Guide for Exim Servers

[aneeshs]

Spam Troubleshoot Guide for Exim Servers
====================================

Spamming is the use of servers to send unsolicited messages (spam), especially advertising, as well as sending messages repeatedly on the same site. In a cPanel server, the default MTA (Mail Transfer Agent) is Exim. Exim have different command line options to identify the spamming.

1. Find the source path if from address is being forged.

Code: [Select]

echo -ne “What cpanel user: “; read p; cat /var/log/exim_mainlog | grep cwd | grep -v /var/spool | awk -F”cwd=” ‘{print $2}’ | awk ‘{print $1}’ | sort | uniq -c | sort -n | grep $p
2. Shows number of failed logins, the IP doing the failing, and how many different users were attempted to be logged into:

Code: [Select]

awk -F”ffff:” ‘/FAILED/ {IP[$NF]++;}END{ for ( host in IP ) print IP[host]” “host}’ /var/log/maillog | awk ‘{ if ( $1 > 99 ) print $0}’ | sort -nk1 | sed ‘s#]##’ > IPS; for IP in `awk ‘{print $2}’ IPS`; do echo -n $(grep $IP IPS); echo -n ” – Failed users: “; grep $IP /var/log/maillog | awk -F”user=” ‘/FAILED/ {print $2}’ | cut -d, -f1 | sort | uniq | wc -l; done
Output:
135 50.75.12.41 – Failed users: 3

3. Number of emails sent from all domains since the beginning of the log.

Code: [Select]

cat /var/log/exim_mainlog | grep "A\=<LOGIN>" | awk -F"A=<LOGIN>:" {'print $2'} | cut -f1 -d' ' | sort | uniq -c | sort -n | awk {'print $1, " unique emails sent by " , $2'}
4. Show the number of failed logins per IP (Check if the user is being brute forced).

Code: [Select]

grep FAILED /var/log/maillog |awk ‘{print $9}’ |sort -n|uniq -c |sort -n |tail -7
5. Hourly count of sent mail for a domain, by specifying the domain and date.

Code: [Select]

DOMAIN='<DOMAIN>';DATE='YYYY-MM-DD';o1=`for i in $(grep $DOMAIN /var/log/exim_mainlog|grep $DATE|egrep "A=fixed|A=<LOGIN>"|awk {'print $4'}|sort|uniq);do grep $i /var/log/exim_mainlog;done|grep -v "retry time not reached for any host"`;unset DOMAIN;unset DATE;o2=`echo "$o1"|awk {'print $2'}|cut -d: -f1|sort| uniq -c`;echo " COUNT HOUR";echo "$o2";unset o1;unset o2;
-DOMAIN : domain.com without www
-YYYY-MM-DD : Date like 2011-11-03
-LOGIN : dovecot_login / courier_login
Replace all instances of above terms with appropriate values.

6. Find the files that sends mail via phpMail.

Code: [Select]

find ./ -name \*.php -exec grep -l "mail(" {} \;
7. Delete mail in queue from a certain user.

Code: [Select]

for i in $(exim -bp|grep user@domain.com|grep -|grep @|awk {'print $3'});do exim -Mrm $i;done
8. Fix Shadow file permission.

If the user receives mail, but can not send and all settings are correct

Code: [Select]

find /home/<user>/etc -type f -name shadow -exec chmod 644 {} \;
9. Show user and number of connections to IMAP.

Code: [Select]

ps -ef |grep imap | awk ‘{print $1}’ | sort | uniq -c | sort -g -k 1 | tail
10. Number of emails sent per email address for a domain.

Code: [Select]

grep example.com /var/log/exim_mainlog | grep courier_login | awk -F"courier_login:" '{print $2}' | awk '{print $1}' | sort | uniq -c | sort -n
11. Show all the emails in queue by domain.

Code: [Select]

exim -bp | /usr/sbin/exiqsumm
12. Show you all the emails in queue by email account

Code: [Select]

exim -bp|awk 'NF>1{print $4}' | sort | uniq -c |sort -nk1
13. Force delivery of one message

Code: [Select]

exim -M <messageID>
14. View the log for the message.

Code: [Select]

exim -Mvl <messageID>
15. View the header of the message

Code: [Select]

exim -Mvh <messageID>
16. View the body of the message

Code: [Select]

exim -Mvb <messageID>
17. Remove message without sending any error message.

Code: [Select]

exim -Mrm <messageID>
18. Number of frozen mails in the queue

Code: [Select]

exim -bpr | grep frozen | wc -l
19. Deleting frozen Messages

Code: [Select]

exim -bpr | grep frozen | awk {'print $3'} | xargs exim -Mrm
OR

Code: [Select]

exiqgrep -z -i | xargs exim -Mrm
20. Check how many emails are in queue for domain.com:

Code: [Select]

exim -bp | grep ‘example.com>’
21. Top 50 domains using mail server sorted by different criteria.

Code: [Select]

eximstats -ne -nr /var/log/exim_mainlog
22. Show the IPs which are connected to server through port number 25.

Code: [Select]

netstat -plan | grep :25 | awk {‘print $5′} | cut -d: -f 1 | sort | uniq -c | sort -nk 1
23. Find “nobody” spamming (Only works when the spamming is going on).

Code: [Select]

ps -C exim -fH ewww | awk ‘{for(i=1;i<=40;i++){print $i}}’ | sort | uniq -c | grep PWD | sort -n
Sample result:
6 PWD=/
347 PWD=/home/sample/public_html/test
Count the PWD and if it is a large value check the files in the directory listed in PWD
(Ignore if it is / or /var/spool/mail /var/spool/exim)

24. Remove all mails from ‘<>’

Code: [Select]

exim -bp | grep “<>” | awk ‘{print $3}’ | xargs exim -Mrm