Spamming Fighting Tips & Tricks

Tip: 01
Check the queue status

#/opt/zimbra/libexec/zmqstat

OR

$mailq|grep ^[A-F0-9]|cut -c 42-80|sort |uniq -c|sort -n|tail

Tip: 02
First of all hold the queue

su - zimbra

/opt/zimbra/common/sbin/postsuper -h ALL

watch --interval=1 'tail -n1000 /var/log/auth.log | grep 'auth_zimbra:''

Tip: 03
check which user has compromised and used that email address for spamming

grep sasl_user /var/log/zimbra.log | sed 's/.*sasl_username=//g' | sort | uniq -c | sort -nr | head

Tip: 04
Finding originating IP using “From Address”

grep "from=<user1@domain.tld>" /var/log/zimbra.log | awk '{print $10}' |sort -nr -k 1 | sed -rn 's/.*\[//;s/\].*//p' | uniq -c | sort -nr -k 1

Tip: 05
Finding originating IP using Authentication.

grep sasl_user /var/log/zimbra.log | grep user1@domain.tld | awk '{print $7}' |sed -rn 's/.*\[//;s/\].*//p'  | sort -nr -k 1 | uniq -c |sort -nr -k 1

Tip: 06
Blacklist all these IPs on Zimbra

Create a file /opt/zimbra/conf/postfix_blacklist and add all the IPs in the following format

177.71.83.241    REJECT

191.37.158.10    REJECT

177.39.32.97     REJECT

177.53.74.33     REJECT

177.71.23.64     REJECT

postmap /opt/zimbra/conf/postfix_blacklist

zmprov mcf +zimbraMtaRestriction 'check_client_access lmdb:/opt/zimbra/conf/postfix_blacklist'

zmmtactl restart 

Tip: 07
Create below mentioned script and run as a root user

#vi removemail

#!/usr/bin/perl
$REGEXP = shift || die "no email-adress given (regexp-style, e.g. bl.*\@yahoo.com)!";
@data = qx</opt/zimbra/common/sbin/postqueue -p>;
for (@data) {
if (/^(\w+)(\*|\!)?\s/) {
$queue_id = $1;
}
if($queue_id) {
if (/$REGEXP/i) {
$Q{$queue_id} = 1;
$queue_id = "";
}
}
}
#open(POSTSUPER,"|cat") || die "couldn't open postsuper" ;
open(POSTSUPER,"|/opt/zimbra/common/sbin/postsuper -d -") || die "couldn't open postsuper" ;
foreach (keys %Q) {
print POSTSUPER "$_\n";
};
close(POSTSUPER);

#chmod +x removemail

#/root/removemail user1@spammer.com

OR

/opt/zimbra/common/sbin/postsuper -d ALL deferred

OR

Check and verify

/opt/zimbra/common/sbin/postqueue -p | egrep -v '^ *\(|-Queue ID-' \ | awk 'BEGIN { RS = "" } { if ($7 == "user1@domain.tld") print $1} ' | tr -d '*!'

and Delete

/opt/zimbra/common/sbin/postqueue -p | egrep -v '^ *\(|-Queue ID-' \ | awk 'BEGIN { RS = "" } { if ($7 == "user1@domain.tld")   print $1} ' \ | tr -d '*!' | /opt/zimbra/common/sbin/postsuper -d - 

Tip: 08
Requeue all mail

/opt/zimbra/common/sbin/postsuper -r ALL