Spam Protection: Alert when there are spammers sending email from your server
For a few recent days we experienced that someone hacked into one of our accounts and use it to send spam massively. We immediately change that account (and all others)’ password and apply higher security protection. But to be sure that we know if any problems sooner (before the server is blacklisted by Google mail, Yahoo mail and other ISPs), we are worrying about how to monitor number of emails currently in queue, if that is abnormal then we know immediately to take action. We got this script from http://crazyadmins.com/viewtopic.php?f=15&t=55 to monitor mail queue, if that goes higher than 20 emails at a time.
#!/bin/bash # Script from www.crazyadmins.com to alert admin about larger mail queue # Save the file as eximqueue.sh ######### Edit here ########## _mail_user=your@mail.com # Set this to your email id to receive alerts on mail queue _limit=200 # Set the limit here ############################## clear; _result="/tmp/eximqueue.txt" _queue="`exim-bpc`" if [ "$_queue" -ge "$_limit" ]; then echo "Current queue is: $_queue" > $_result echo "Summary of Mail queue" >> $_result echo "`exim -bp | exiqsumm`" >> $_result mail -s "Number of mails on `hostname` : $_queue" $_mail_user < $_result cat $_result fi rm -f $_result
The script does not work for us at first time. There for it to work in cron mode we need to add
TERM=linux export TERM
Also to change every command instances to include /usr/sbin/ (otherwise it will report command not found)
Finally it looks like below
#!/bin/bash TERM=linux export TERM # Script from www.crazyadmins.com to alert admin about larger mail queue # Save the file as eximqueue.sh ######### Edit here ########## _mail_user=your@mail.com # Set this to your email id to receive alerts on mail queue _limit=200 # Set the limit here ############################## clear; _result="/tmp/eximqueue.txt" _queue="`/usr/sbin/exim-bpc`" if [ "$_queue" -ge "$_limit" ]; then echo "Current queue is: $_queue" > $_result echo "Summary of Mail queue" >> $_result echo "`/usr/sbin/exim -bp | /usr/sbin/exiqsumm`" >> $_result mail -s "ALERT: Number of mails on `hostname` : $_queue" $_mail_user < $_result cat $_result fi rm -f $_result
Set up this to run each minute and we feel better now. Hope that will save you sometime too.
Comments