emails that attempt to kill mailscanner {Scanned}

[Jonathan Horne]

Hi richard, thanks for your reply.

 

personally, i dont have much mail traffic thru my server, i just have my one email domain, and an average day i process about 150 on a heavy day, 120 or so of which will be spam.  my server doesnt even hit a 1.0 load average.

 

i did install fail2ban, and i built some pretty effective regex to keep the repeaters from continually sending more spam to my server, but its these strange emails that try to kill mailscanner process that i see every day all day.  as i mentioned, they seem to be always high scoring spams anyway, i just wonder if there is malicious code in the emails that i doing this.   since my last /var/log/messages turn over, its happened 170 times.

 

thanks,

Jonathan
 



From: richard at fastnet.co.uk
To: mailscanner at lists.mailscanner.info
Subject: RE: emails that attempt to kill mailscanner {Scanned}
Date: Wed, 14 Aug 2013 10:27:23 +0000







This issue only happens to me when my server is over loaded. Once I gave it more CPU’s and RAM I’ve not had this problem again.
I find that running spamassassin as daemon and restarting that sometimes helps. The –U switch didn’t do anything for me. I’m using FreeBSD.
 
You should look at installing fail2ban or RBL’s on the MTA and check the server loan / swap information.
 
I do have a lot of mail coming my way, so I might be way off the mark here..
 
Rich


 


From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Ritchie P. Fraser
Sent: 14 August 2013 09:17
To: MailScanner discussion
Subject: RE: emails that attempt to kill mailscanner {Scanned}
 
At the end of the first line in /usr/sbin/MailScanner… like so…
 
#!/usr/bin/perl -I/usr/lib/MailScanner -U
 
Ritchie
 
From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Martin Hepworth
Sent: 13 August 2013 19:38
To: MailScanner discussion
Subject: Re: emails that attempt to kill mailscanner {Scanned}
 
You need to put the -U at the first line on the MailScanner perl script

On Tuesday, 13 August 2013, Jonathan Horne wrote:


hmmm, its only some emails, not all of them (and its always emails that i would never accept anyway, high scoring spam).  
 
taking a look at hte mailscanner.conf file, i dont see offhand where to add a -U.  any tips?
 
jonathan
 




Date: Tue, 13 Aug 2013 17:06:50 +0100
Subject: Re: emails that attempt to kill mailscanner
From: maxsec at gmail.com
To: mailscanner at lists.mailscanner.info

this problem is normally caused by config issues, like not having the -U switch set in the main MailScanner executable.



-- 
Martin Hepworth, CISSP
Oxford, UK
 

On 13 August 2013 16:28, Jonathan Horne <jonathanmhorne at outlook.com> wrote:


i didnt try it yet... but if i set the number of attempts to 0 what will happen? i would like to just delete these emails immeidately, i dont see a need to retry it after 5 minutes.
 
if 0 is not the right way to accomplish this, what is the correct way to dump emails that attempt to kill the process?
 
thanks,
jonathan

--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website!
 

-- MailScanner mailing list mailscanner at lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website!


-- 
-- 
Martin Hepworth, CISSP
Oxford, UK

-- 
This message has been scanned for viruses and 
dangerous content by MailScanner, and is 
believed to be clean. 
-- MailScanner mailing list mailscanner at lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20130814/77268f16/attachment.html