[Pkg-exim4-users] Pkg-exim4-users Digest, Vol 65, Issue 6

[Peter Sparkes]

Thanks Peter,

I will do some more checking

Peter

> Send Pkg-exim4-users mailing list submissions to
> 	pkg-exim4-users at lists.alioth.debian.org
>
> To subscribe or unsubscribe via the World Wide Web, visit
> 	http://lists.alioth.debian.org/mailman/listinfo/pkg-exim4-users
> or, via email, send a message with subject or body 'help' to
> 	pkg-exim4-users-request at lists.alioth.debian.org
>
> You can reach the person managing the list at
> 	pkg-exim4-users-owner at lists.alioth.debian.org
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of Pkg-exim4-users digest..."
>
>
> Today's Topics:
>
>     1. Spam sent to user from user's email address (Peter Sparkes)
>     2. Re: Spam sent to user from user's email address (Peter Gossner)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Thu, 13 Jan 2011 08:00:19 +0000
> From: Peter Sparkes<peter at didm.co.uk>
> Subject: [Pkg-exim4-users] Spam sent to user from user's email address
> To: Pkg-exim4-users at lists.alioth.debian.org
> Message-ID:<4D2EB113.9050809 at didm.co.uk>
> Content-Type: text/plain; charset=ISO-8859-1; format=flowed
>
> Hi,
>
> My Exim4 users are getting spam sent to them which appear to come from there own email address.
>
> Assuming that these emails are originating from my exim server how do I, please, stop them
>
> Regards
>
> Peter
>
>
>
>
> ------------------------------
>
> Message: 2
> Date: Thu, 13 Jan 2011 21:45:59 +1030
> From: Peter Gossner<gossner at internode.on.net>
> Subject: Re: [Pkg-exim4-users] Spam sent to user from user's email
> 	address
> To: pkg-exim4-users at lists.alioth.debian.org
> Cc: peter at didm.co.uk
> Message-ID:<20110113214559.7be884a6gossner at internode.on.net@joni.tux>
> Content-Type: text/plain; charset=US-ASCII
>
> On Thu, 13 Jan 2011 08:00:19 +0000
> Peter Sparkes<peter at didm.co.uk>  wrote:
>
>> Hi,
>>
>> My Exim4 users are getting spam sent to them which appear to come
>> from there own email address.
>>
>> Assuming that these emails are originating from my exim server how do
>> I, please, stop them
>>
>> Regards
>>
>> Peter
>>
>>
> The list will need some more info to help.
> Meantime, unless you have a bad egg local user its unlikely that the mails are originating from YOUR server.
> 1/ Check the mail headers and see if you can get a little more info.
> 2/ Check /var/log/exim4/mainlog
> 	Cross check against victims local mail address and times.
>
>
> Once you have the originating SMTP server you can block it a number of ways.
> here are two:
>
> 	1/ create a file called: /etc/exim4/local_host_blacklist
> 	[ man exim4_local_host_blacklist ]
> 	its a simple list of IP addresses to deny access to
> e.g. from Man page:
>         192.168.10.0/24
>         !172.16.10.128/26
>         172.16.10.0/24
>         10.0.0.0/8
>
> Restart exim and your at least half way there.
> You can append to that file anytime you like.
>
> 	2/ set up an iptables rule to block to IP totally or only when using the SMTP port:
> something like...
> 	iptables -N EXIMDROPS
> 	iptables -A EXIMDROPS -p tcp -s 123.456.789 -j REJECT
> 	iptables -A INPUT -p tcp -m tcp --dport 25 -j EXIMDROP
> Or use your favorite GUI tools
> (there are many ways of skinning that cat, that is a rough example.)
>
> Install spamassassin or similar
> apt-cache search spam
>
>
>> _______________________________________________
>> Pkg-exim4-users mailing list
>> Pkg-exim4-users at lists.alioth.debian.org
>> http://lists.alioth.debian.org/mailman/listinfo/pkg-exim4-users
>
> --Pete (another one)
> (local-debian-hints.u8)
> :your fortune cookie:
>
> Debian Hint #21: If your Debian box is behind a slow network connection,
> but you have access to a fast one as well, check out the apt-zip package.
>
> Peter Gossner<gossner at internode.on.net>
> <pete.gossner at gmail.com>
>
>
>
> ------------------------------
>
> _______________________________________________
> Pkg-exim4-users mailing list
> Pkg-exim4-users at lists.alioth.debian.org
> http://lists.alioth.debian.org/mailman/listinfo/pkg-exim4-users
>
> End of Pkg-exim4-users Digest, Vol 65, Issue 6
> **********************************************
>