habibzain Just husband, father and enthusiastic men about System Administration. Love to write short article about it. Perhaps can help and be useful for others.

How to check spamming Exim MTA Server

3 min read

check-spamming-on-server-which-has-Exim-MTA

Electronic mail spamming is the use of electronic messaging systems to send unsolicited messages (spam), especially advertising, as well as sending messages repeatedly on the same site. Here article will explain simply way check spamming in exim mail server. Can be used too in cPanel WHM, same base exim mail server.

It happens in many ways on a mail server. Spamming is one of the common and frequent problem in web hosting industry. Spamming can cause your server’s IPs blocked at different RBLs, if any accounts in your server sends multiple spam emails.

To check this, login into server as root.

Count Emails in Queue to Check Spamming

Easy step beginning investigate spamming in exim server is count mail queue.

exim -bpc

This command shows the total number of emails in the queue. If the count is high (>2000), the probability for spamming is also high.

Example

exim -bpc
52

List Emails with More Details

Exim print queue with more detail command is.

exim -bp

This command will give you a close look to the emails in the queue. It will give details like message IDsenderrecipientsize and age of mail. From this, the message ID is useful to find out the details like headerbody and log. That will discussed in detail later.

Example

exim -bp

44h 763 1VGaIo-0002ec-RM <[email protected]m> [email protected]

10h 5.9K 1VH6AW-0001Um-Rz <> *** frozen *** [email protected]

0m 502 1VHFNl-0003bf-GB <[email protected]m> [email protected]

0m 568 1VHFNl-0003bn-Tq <[email protected]m> [email protected]

# 1st field: Age (Eg : 44h)
# 2nd field: Size (Eg : 5.9K)
# 3rd field: Message ID (Eg : 1VGaIo-0002ec-RM)
# 4th field: Sender (Eg : [email protected])
# 5th field: Recipient (Eg : [email protected])

See also  cPanel Exim Commands CheatSheet

By using the ID we can analyse the header, body and the log information of emails in the queue.

exim -Mvh ID

This command displays the message header. From its output, we can check a lot of details about the email like; from address, to address, subject, date, script etc.

exim -Mvb ID

Displays the message body.

exim -Mvl ID

It displays the log of email. From this log, you can identify the user who created this emails and a lot more…

Spamming can occur in many ways. Here I am explaining some instances of spamming. It occurs mainly through vulnerable PHP scripts or by compromising the email account’s password.

Example: Spamming from PHP script

208P Received: from $user by server.ahostname.com with local (Exim 4.82)
(envelope-from <[email protected]>)
id 1YZUIE-00013s-Sp
for [email protected]; Sat, 21 Mar 2015 21:03:06 -0400
027T To: [email protected]
019 Subject: Hi there
091 X-PHP-Script: domain.com/templates/yoo_revista/warp/menus/page.php for "IP.Address"
023 X-Priority: 3 (Normal)

From the header itself, we can find out the email reputation. If you find “X-PHP-Script” in the email header, you can confirm that, those emails were sent out from a PHP script.

In the above example the emails were sent from PHP script.

(X-PHP-Script: domain.com/templates/yoo_revista/warp/menus/page.php).

In this case we have to check the scripts in the problematic account.

In this case, please make sure that you are using latest version of CMS (Eg; WordPress, Joomla etc), plugins and themes. 

Analyzing email count with sender

This’s very important while checking spamming. This command will sort out the email count with its sender name from the Exim mail queue. From this output we can analyse the email account who is sending large emails.

exim -bpr|grep "<"|awk {'print $4'}|cut -d"<" -f2|cut -d">" -f1|sort -n|uniq -c|sort -n
See also  Exim command remove emails queue specific Sender/Receiver – The “exiqgrep” usage

Example

See the example below:

root@EcLinux# exim -bpr|grep "<"|awk {'print $4'}|cut -d"<" -f2|cut -d">" -f1|sort -n|uniq -c|sort -n
3 [email protected]
1

Another way using “exiqgrep

exiqgrep -f sendername|grep "<"|wc -l

This command displays the total count of emails that sent by a particular user.

Example

root@EcLinux# exiqgrep -f [email protected]|grep "<"|wc -l
3

Similarly -r switch with exiqgrep is using for recipient.

root@EcLinux# exiqgrep -f recipient|grep "<"|wc -l

Refer this for more details >> count emails in Exim mail queue for a specific sender/receiver <<

Removing emails from queue

The exim command to remove emails from queue is;

root@EcLinux# exim -Mrm

To delete all emails from queue for a particular sender.

root@EcLinux# exim -bpr| grep sendername| awk '{print $3}'|xargs exim -Mrm

The “awk” part prints the messages IDs to remove. This will give to the input of “exim -Mrm” by using xargs function.

To remove all emails from the queue, here is a quick solution >> remove all emails from the queue <<

Frozen emails

The sender field must have the word “frozen“. To displays the total count of frozen emails in queue, we can use the following command.

root@EcLinux# exim -bp|grep frozen|wc -l

Removing frozen emails

root@EcLinux# exim -bp|grep frozen|awk {'print $3'}|xargs exim -Mrm

We can simply remove all frozen emails from the queue by using the “exiqgrep” command. Please refer the following link >> Quick way to remove all frozen emails from the email queue <<

root@EcLinux# exim -bp|exiqsumm

The above command will print the summary of emails in queue.

See also  Exim command remove emails queue specific Sender/Receiver – The “exiqgrep” usage

Example

root@EcLinux# exim -bp|exiqsumm
Count Volume Oldest Newest Domain
----- ------ ------ ------ ------
1 6041 11h 11h facebook.com
1 763 45h 45h interia.pl
---------------------------------------------------------------
2 6804 45h 11h TOTAL
exiwhat

It displays, what exim is doing right now. See the below example:

root@EcLinux# exiwhat
1923 daemon: -q1h, listening for SMTP on port 25 (IPv6 and IPv4) port 587 (IPv6 and IPv4) and for SMTPS on port 465 (IPv6 and IPv4)

that is some method to check spamming actifity in exim mail server.

Source : http://www.crybit.com/check-spamming-on-server-having-exim/

habibzain Just husband, father and enthusiastic men about System Administration. Love to write short article about it. Perhaps can help and be useful for others.

Leave a Reply

Your email address will not be published. Required fields are marked *

Never miss good article from us, get weekly updates in your inbox