Other big problem ... Now with my email server

[albertux]

Really i don't know if the problem is my email server really, but now when i put the mailq command appears to!!! but to much !!! messages like this ...


317C31FDC00B 797 Tue Dec 15 15:01:42 www-data@www.domain.cl
(delivery temporarily suspended: host e.mx.mail.yahoo.com[67.195.168.230] refused to talk to me: 421 4.7.0 [TS01] Messages from 200.72.1.13 temporarily deferred due to user complaints - 4.16.55.1; see http://postmaster.yahoo.com/421-ts01.html)
adi_baneasa21@yahoo.com
adi_cel_mai_bun@yahoo.com
adi_cosoi@yahoo.com
adi_dragon2002@yahoo.com
adi_for_uuuuu@yahoo.com
adi_idai1985@yahoo.com
(delivery temporarily suspended: host mx1.mail.eu.yahoo.com[217.12.11.35] refused to talk to me: 421 4.7.0 [TS01] Messages from 200.72.1.13 temporarily deferred due to user complaints - 4.16.55.1; see http://postmaster.yahoo.com/421-ts01.html)
adi_croco@yahoo.co.uk
(host e.mx.mail.yahoo.com[67.195.168.230] refused to talk to me: 421 4.7.0 [TS01] Messages from 200.72.1.13 temporarily deferred due to user complaints - 4.16.55.1; see http://postmaster.yahoo.com/421-ts01.html)
adi_cavasdan@yahoo.it
adi_balau@yahoo.ro


Curiosly the IP in the ISPConfig machine is other 200.72.1.16 ... really i dont know what'sup with this .... but i work with the 200.72.1.13 machine with an internal alias with 200.72.1.16



How i can see the send emails ??? exist some kind of command like "mailq" but of sent e-mail


if i put some command like "tail -f /var/log/mail.log" the answers is toooo much bigger yet, but just one example, appears some like that:

Dec 15 15:14:55 www postfix/smtp[3550]: 3A1121FDC062: to=<curlylou@hotmail.co.uk>, relay=mx3.hotmail.com[65.55.37.120]:25, delay=1.1, delays=0.07/0.01/0.6/0.43, dsn=2.0.0, status=sent (250 <20091215181454.3A1121FDC062@www.domain.cl> Queued mail for delivery)



Again i need you help.

Thanks and greetings

[falko]

Please make sure that your server isn't blacklisted: http://mxtoolbox.com/blacklists.aspx

[albertux]

Thank you for your answers again .... in this moment the other email server is blocked no the ispconfig machine email server ... is very rare ???

Whell last night, again appear a lot of message with mailq and tail -f /var/log/mail.info or mail.err ... them i turn off the apache server in the ispconfig machine and the message dissapeared ...

Today a couple of hours ... the mailq report me some like 700 messages again, but i delete with postsuper -d ALL and so far i haven't more problems ....

But the real strange sitauation is the apache server ... maybe i have some kind of spammer software within a domain, but how i can see some like that ??? exist some tool for make a monitoring of just one domain in the ispconfig server ???


Some idea ???

Greeting

[albertux]

Now appers this message with tail -f /var/log/syslog |grep postfix

Dec 16 16:01:04 www postfix/smtpd[31586]: 0410 82 f3 12 92 f2 51 33 54|c3 b3 1f 94 45 21 58 47 .....Q3T ....E!XG
Dec 16 16:01:04 www postfix/smtpd[31586]: Read 1024 chars: ?ADAAMAAwADIAMAA0ADMAMAAtADAAMAAwADAALQA
Dec 16 16:01:04 www postfix/smtpd[31586]: read from 7F114A7A1840 [7F114A7BB500] (5 bytes => -1 (0xFFFFFFFFFFFFFFFF))
Dec 16 16:01:04 www postfix/smtpd[31586]: read from 7F114A7A1840 [7F114A7BB500] (5 bytes => 5 (0x5))
Dec 16 16:01:04 www postfix/smtpd[31586]: 0000 17 03 01 04 ....
Dec 16 16:01:04 www postfix/smtpd[31586]: 0004 - <SPACES/NULLS>
Dec 16 16:01:04 www postfix/smtpd[31586]: read from 7F114A7A1840 [7F114A7BB505] (1056 bytes => -1 (0xFFFFFFFFFFFFFFFF))
Dec 16 16:01:04 www postfix/smtpd[31586]: read from 7F114A7A1840 [7F114A7BB505] (1056 bytes => 1056 (0x420))
Dec 16 16:01:04 www postfix/smtpd[31586]: 0000 1d dc b3 96 cc 99 8e 92|32 5b fe d9 e0 c3 5b 63 ........ 2[....[c
Dec 16 16:01:04 www postfix/smtpd[31586]: 0010 6e 77 3c db 88 c0 9c 8b|51 a2 9b a4 42 18 d7 6d nw<..... Q...B..m
Dec 16 16:01:04 www postfix/smtpd[31586]: 0020 65 30 64 9e c7 d4 91 dd|07 5e f3 e8 81 66 98 79 e0d..... .^...f.y
Dec 16 16:01:04 www postfix/smtpd[31586]: 0030 a1 d3 93 d5 7d 25 0d 60|b8 88 78 38 c7 91 82 4a ....}%.` ..x8...J
Dec 16 16:01:04 www postfix/smtpd[31586]: 0040 d9 47 00 83 e8 00 22 01|df b4 29 c9 49 73 5a fc .G....". ..).IsZ.
Dec 16 16:01:04 www postfix/smtpd[31586]: 0050 4d 6e 9c 98 84 dc 03 c3|a4 46 ed 52 99 db 0e fe Mn...... .F.R....
Dec 16 16:01:04 www postfix/smtpd[31586]: 0060 ad ab 4b 30 19 8c 85 59|38 0b 2b 14 24 51 05 f1 ..K0...Y 8.+.$Q..
Dec 16 16:01:04 www postfix/smtpd[31586]: 0070 e0 f1 cd 7d 0f 9e 1f cc|18 b0 44 8c 34 81 56 23 ...}.... ..D.4.V#
Dec 16 16:01:04 www postfix/smtpd[31586]: 0080 ae 5a d3 62 29 2a a1 fd|b0 6a bc f8 90 63 cf ed .Z.b)*.. .j...c..
Dec 16 16:01:04 www postfix/smtpd[31586]: 0090 ed fa c5 e3 b2 86 89 3e|f1 af df 3b 47 1e ee 5f .......> ...;G.._
Dec 16 16:01:04 www postfix/smtpd[31586]: 00a0 d2 b0 3b e4 83 23 00 14|62 64 69 03 25 32 cb 41 ..;..#.. bdi.%2.A
Dec 16 16:01:04 www postfix/smtpd[31586]: 00b0 36 db 43 cd f9 f0 4a fe|8f 63 5d 7d 4d 00 81 87 6.C...J. .c]}M...
Dec 16 16:01:04 www postfix/smtpd[31586]: 00c0 20 29 ba 2b dc 2e 3c b8|94 d8 01 73 94 85 58 13 ).+..<. ...s..X.
Dec 16 16:01:04 www postfix/smtpd[31586]: 00d0 40 93 57 0b 3a 1a cc 61|c3 11 b8 26 15 43 a2 e8 @.W.:..a ...&.C..
Dec 16 16:01:04 www postfix/smtpd[31586]: 00e0 c6 da 45 31 ad 57 09 2e|1d 2a a6 68 48 03 e7 5b ..E1.W.. .*.hH..[
Dec 16 16:01:04 www postfix/smtpd[31586]: 00f0 c2 32 3e 9d 9f 7d b9 cd|09 e6 bf 5e e3 b1 6e 25 .2>..}.. ...^..n%
Dec 16 16:01:04 www postfix/smtpd[31586]: 0100 41 73 78 d3 d2 1d 5a 36|57 ba 7a b9 3c 26 37 ae Asx...Z6 W.z.<&7.
Dec 16 16:01:04 www postfix/smtpd[31586]: 0110 20 f1 ff f8 7a 10 fa a5|90 96 4a 5a 54 cf ca 5f ...z... ..JZT.._
Dec 16 16:01:04 www postfix/smtpd[31586]: 0120 cb fb 8a d1 60 37 7c cd|eb c9 fb 4c 2b 7e f5 e0 ....`7|. ...L+~..
Dec 16 16:01:04 www postfix/smtpd[31586]: 0130 a6 03 1d e5 3f 32 80 04|1c 17 29 b1 09 41 c8 d2 ....?2.. ..)..A..
Dec 16 16:01:04 www postfix/smtpd[31586]: 0140 6f 40 8c 39 22 c6 c9 18|06 51 4b 01 f3 3b c6 4d o@.9"... .QK..;.M
Dec 16 16:01:04 www postfix/smtpd[31586]: 0150 07 a8 9a a3 4b b6 36 80|1b 4e c8 5b ad ea 7e 5d ....K.6. .N.[..~]
Dec 16 16:01:04 www postfix/smtpd[31586]: 0160 b0 2d 72 d3 84 a3 8c 88|76 6e 28 cc 15 ab 51 0a .-r..... vn(...Q.
Dec 16 16:01:04 www postfix/smtpd[31586]: 0170 09 31 9d 38 a2 04 53 bc|84 fd cf 46 2d f3 26 11 .1.8..S. ...F-.&.
Dec 16 16:01:04 www postfix/smtpd[31586]: 0180 94 bd 14 3e 7a 7d e5 e6|90 69 6e 03 36 2c f8 e3 ...>z}.. .in.6,..
Dec 16 16:01:04 www postfix/smtpd[31586]: 0190 7e 00 85 2a 60 73 0a 0f|88 c7 1c 2b 33 50 da b2 ~..*`s.. ...+3P..
Dec 16 16:01:04 www postfix/smtpd[31586]: 01a0 4e 30 a0 2e de b3 87 5b|d9 1c 59 7a 5b aa 50 f8 N0.....[ ..Yz[.P.
Dec 16 16:01:04 www postfix/smtpd[31586]: 01b0 a1 dc 7f b0 69 14 90 58|f1 20 10 8b 1c 93 06 5d ....i..X . .....]
Dec 16 16:01:04 www postfix/smtpd[31586]: 01c0 58 eb de 0c e8 0d 33 db|dc fa 90 e0 a0 37 53 e5 X.....3. .....7S.
Dec 16 16:01:04 www postfix/smtpd[31586]: 01d0 38 54 92 91 28 7e 8d 71|28 50 37 65 87 fd 44 e7 8T..(~.q (P7e..D.
Dec 16 16:01:04 www postfix/smtpd[31586]: 01e0 98 3d 23 6a 30 a6 2b 1e|cc b8 fd db 1a 11 eb 1d .=#j0.+. ........
Dec 16 16:01:04 www postfix/smtpd[31586]: 01f0 ea 8b 18 1d ed 01 ea a0|07 50 29 4e ac c7 fe ab ........ .P)N....
Dec 16 16:01:04 www postfix/smtpd[31586]: 0200 67 53 ce f2 cd 8e 6d ae|ac 96 52 b0 af de 88 c9 gS....m. ..R.....
Dec 16 16:01:04 www postfix/smtpd[31586]: 0210 0d b9 8d 10 d7 c1 cc 20|50 71 e4 b4 c3 d2 a0 bd ....... Pq......
Dec 16 16:01:04 www postfix/smtpd[31586]: 0220 a4 9e 34 35 2b a6 74 bd|72 a3 2b 95 e1 03 c1 5c ..45+.t. r.+....\
Dec 16 16:01:04 www postfix/smtpd[31586]: 0230 dc 02 35 0a b0 fd 3b a7|e5 87 a2 dc f4 d4 50 c9 ..5...;. ......P.
Dec 16 16:01:04 www postfix/smtpd[31586]: 0240 da 9b 8a d8 f9 4c fd 8e|be 00 f6 3b 9b 2c a7 e6 .....L.. ...;.,..
Dec 16 16:01:04 www postfix/smtpd[31586]: 0250 13 3f 8f 8d a0 8c 28 e1|5f aa fc 17 dd 48 02 05 .?....(. _....H..
Dec 16 16:01:04 www postfix/smtpd[31586]: 0260 46 f5 95 3f 4d 86 2a bb|c1 1e d4 f0 62 d9 43 0c F..?M.*. ....b.C.
Dec 16 16:01:04 www postfix/smtpd[31586]: 0270 1e c9 71 4f 5b fa 70 56|e2 5e 31 4d 25 8b c5 c7 ..qO[.pV .^1M%...
Dec 16 16:01:04 www postfix/smtpd[31586]: 0280 40 1c a6 6a 45 6e 9f 9a|65 2f 0e 75 d4 9a 76 e5 @..jEn.. e/.u..v.
Dec 16 16:01:04 www postfix/smtpd[31586]: 0290 2f da b7 72 33 1d d1 a3|d6 fe e0 5f a5 8e ef a9 /..r3... ..._....
Dec 16 16:01:04 www postfix/smtpd[31586]: 02a0 12 ae e3 57 39 90 b1 b4|ce 63 74 d7 42 42 54 39 ...W9... .ct.BBT9
Dec 16 16:01:04 www postfix/smtpd[31586]: 02b0 b1 f3 af 08 f5 05 0d b4|d9 2d 4b fe 54 e5 b5 06 ........ .-K.T...
Dec 16 16:01:04 www postfix/smtpd[31586]: 02c0 1a 6d 7d 43 52 35 4f 22|56 6c 9b 69 5b 49 00 60 .m}CR5O" Vl.i[I.`
Dec 16 16:01:04 www postfix/smtpd[31586]: 02d0 f8 01 72 be 17 53 b1 41|bd c0 80 6f 7e c8 91 55 ..r..S.A ...o~..U
Dec 16 16:01:04 www postfix/smtpd[31586]: 02e0 08 7a 7e 7b 4f 55 16 50|62 9c fe c7 1c 41 65 f9 .z~{OU.P b....Ae.
Dec 16 16:01:04 www postfix/smtpd[31586]: 02f0 e0 b9 22 62 a9 0c ec 84|86 03 f4 a9 49 45 d5 29 .."b.... ....IE.)
Dec 16 16:01:04 www postfix/smtpd[31586]: 0300 c1 1d 30 09 08 53 86 14|d7 f2 0a 77 fe c0 25 1c ..0..S.. ...w..%.
Dec 16 16:01:04 www postfix/smtpd[31586]: 0310 f9 74 0a d5 9d b3 ef c4|56 57 e3 d2 35 fd bf d6 .t...... VW..5...
Dec 16 16:01:04 www postfix/smtpd[31586]: 0320 75 c9 09 dc 7d 88 c7 7a|d0 82 9c 40 15 cc 41 8d u...}..z ...@..A.
Dec 16 16:01:04 www postfix/smtpd[31586]: 0330 95 fd 17 1a d7 68 1b d4|d0 02 46 8e 12 75 4e 52 .....h.. ..F..uNR
Dec 16 16:01:04 www postfix/smtpd[31586]: 0340 81 b3 fa c8 a4 1a fb 3b|c4 ab 8c 22 7e b9 6a 00 .......; ..."~.j.
Dec 16 16:01:04 www postfix/smtpd[31586]: 0350 6c d7 b9 8e f4 3e 03 c7|dc 55 17 ba 8e 60 7c a8 l....>.. .U...`|.
Dec 16 16:01:04 www postfix/smtpd[31586]: 0360 9e f6 ce 79 75 aa 79 1f|97 25 26 b9 0c 97 04 15 ...yu.y. .%&.....
Dec 16 16:01:04 www postfix/smtpd[31586]: 0370 4b 3a e9 6f e6 f4 7c 81|cf 13 c3 c2 bc 35 6b 2d K:.o..|. .....5k-
Dec 16 16:01:04 www postfix/smtpd[31586]: 0380 ba 2c cb fd fa c6 2a b6|d3 df 4f 0b fd 4a 35 da .,....*. ..O..J5.
Dec 16 16:01:04 www postfix/smtpd[31586]: 0390 57 ae 11 ba 4d d1 0b 2d|6e c8 8d f6 27 79 dc 95 W...M..- n...'y..
Dec 16 16:01:04 www postfix/smtpd[31586]: 03a0 3c 55 bd 1c e9 fc a9 85|8e 1e 2b 5c b1 cb 35 31 <U...... ..+\..51
Dec 16 16:01:04 www postfix/smtpd[31586]: 03b0 80 b9 83 7a 52 f3 41 4c|6d 8a c0 68 f5 5f a4 ea ...zR.AL m..h._..
Dec 16 16:01:04 www postfix/smtpd[31586]: 03c0 64 a4 9e 45 d0 95 e8 35|3f 73 0c 20 2d 59 1a 28 d..E...5 ?s. -Y.(
Dec 16 16:01:04 www postfix/smtpd[31586]: 03d0 5d d4 7f fe b0 ed c0 13|74 4b 6e c2 97 ba 50 75 ]....... tKn...Pu
Dec 16 16:01:04 www postfix/smtpd[31586]: 03e0 aa 09 38 11 b7 e6 61 b8|74 95 32 2d 5e 67 02 0c ..8...a. t.2-^g..
Dec 16 16:01:04 www postfix/smtpd[31586]: 03f0 ac 17 3c 2d 70 c4 44 b5|cf 1c c3 8b 7c 44 2a fb ..<-p.D. ....|D*.
Dec 16 16:01:04 www postfix/smtpd[31586]: 0400 3c d8 a2 da a4 12 b8 65|75 ac fd c9 10 e2 70 e3 <......e u.....p.
Dec 16 16:01:04 www postfix/smtpd[31586]: 0410 ad 7d 90 19 50 fd 17 f5|45 ae 70 2e 42 fd 72 49 .}..P... E.p.B.rI

and a while ago i have like 40 postfix proccess runing ¿? for that reason i'm restart the postfix

[falko]

Maybe one of your web applications has a security hole and is abused by spammers...
This might help you: http://www.howtoforge.com/how-to-log...tect-form-spam

[albertux]

Originally Posted by falko

Maybe one of your web applications has a security hole and is abused by spammers...
This might help you: http://www.howtoforge.com/how-to-log...tect-form-spam

i found information about this message and is something about the ssl, but is a normal isn't a real problem just the log for ssl conections


thanks