groomy
Verified User
Hello, I want to delete the list of messages waiting in ssh, if someone could help me.
thank you
thank you
cd /var/spool
mv exim exim.old
mkdir -p exim/input
mkdir -p exim/msglog
mkdir -p exim/db
chown -R mail:mail exim
/sbin/service exim restart
Then delete the old spool:
rm -rf exim.old
exim -bp | exiqgrep -i | xargs exim -Mrm
1VqTxg-0007LL-DW-H
mail 8 12
<>
1386707480 0
-ident mail
-received_protocol local
-body_linecount 140
-max_received_linelength 148
-allow_unqualified_recipient
-allow_unqualified_sender
-deliver_firsttime
-localerror
XX
1
[email protected]
146P Received: from mail by ns3002026.ovh.net with local (Exim 4.72)
id 1VqTxg-0007LL-DW
for [email protected]; Tue, 10 Dec 2013 21:31:20 +0100
038 Date: Tue, 10 Dec 2013 21:31:20 +0100
050I Message-Id: <[email protected]>
047 X-Failed-Recipients: [email protected]
029 Auto-Submitted: auto-replied
061F From: Mail Delivery System <[email protected]>
027T To: [email protected]
059 Subject: Mail delivery failed: returning message to sender
and1VqTxg-0007LL-DW-D
This message was created automatically by mail delivery software.
A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:
[email protected]
(ultimately generated from [email protected])
retry time not reached for any host after a long failure period
------ This is a copy of the message, including all the headers. ------
Return-path: <[email protected]>
Received: from root by ns3002026.ovh.net with local (Exim 4.72)
(envelope-from <[email protected]>)
id 1VqTxg-0007LI-90
for [email protected]; Tue, 10 Dec 2013 21:31:20 +0100
Date: Tue, 10 Dec 2013 21:31:20 +0100
Message-Id: <[email protected]>
To: [email protected]
Subject: lfd on ns3002026.ovh.net: Suspicious process running under user triadedif
From: <[email protected]>
Time: Tue Dec 10 21:31:20 2013 +0100
PID: 28143 (Parent PID:5051)
Account: triadedif
Uptime: 68 seconds
Executable:
/usr/libexec/dovecot/imap
Command Line (often faked in exploits):
dovecot/imap [[email protected] 194.230.159.89]
Network connections by the process (if any):
tcp: 37.59.4.220:143 -> 194.230.159.89:36217
Files open by the process (if any):
/dev/null
/dev/null
anon_inode:[eventpoll]
/home/triadedif/imap/triade-diffusion.ch/f.sgarzi/Maildir/dovecot.index.log
/home/triadedif/imap/triade-diffusion.ch/f.sgarzi/Maildir/dovecot.index
Memory maps by the process (if any):
00400000-0041f000 r-xp 00000000 09:01 41741 /usr/libexec/dovecot/imap
0061f000-00620000 rw-p 0001f000 09:01 41741 /usr/libexec/dovecot/imap
00620000-006ab000 rw-p 00000000 00:00 0 [heap]
3c7ec00000-3c7ec02000 r-xp 00000000 09:01 147697 /lib64/libkeyutils-1.2.so
3c7ec02000-3c7ee01000 ---p 00002000 09:01 147697 /lib64/libkeyutils-1.2.so
3c7ee01000-3c7ee02000 rw-p 00001000 09:01 147697 /lib64/libkeyutils-1.2.so
7faba63c6000-7faba63d0000 r-xp 00000000 09:01 151278 /lib64/libnss_files-2.5.so
7faba63d0000-7faba65cf000 ---p 0000a000 09:01 151278 /lib64/libnss_files-2.5.so
7faba65cf000-7faba65d0000 r--p 00009000 09:01 151278 /lib64/libnss_files-2.5.so
7faba65d0000-7faba65d1000 rw-p 0000a000 09:01 151278 /lib64/libnss_files-2.5.so
7faba65d1000-7faba660c000 r-xp 00000000 09:01 147672 /lib64/libsepol.so.1
7faba660c000-7faba680c000 ---p 0003b000 09:01 147672 /lib64/libsepol.so.1
7faba680c000-7faba680d000 rw-p 0003b000 09:01 147672 /lib64/libsepol.so.1
7faba680d000-7faba6817000 rw-p 00000000 00:00 0
7faba6817000-7faba682c000 r-xp 00000000 09:01 150084 /lib64/libselinux.so.1
7faba682c000-7faba6a2c000 ---p 00015000 09:01 150084 /lib64/libselinux.so.1
7faba6a2c000-7faba6a2e000 rw-p 00015000 09:01 150084 /lib64/libselinux.so.1
7faba6a2e000-7faba6a2f000 rw-p 00000000 00:00 0
7faba6a2f000-7faba6a40000 r-xp 00000000 09:01 151280 /lib64/libresolv-2.5.so
7faba6a40000-7faba6c40000 ---p 00011000 09:01 151280 /lib64/libresolv-2.5.so
7faba6c40000-7faba6c41000 r--p 00011000 09:01 151280 /lib64/libresolv-2.5.so
7faba6c41000-7faba6c42000 rw-p 00012000 09:01 151280 /lib64/libresolv-2.5.so
7faba6c42000-7faba6c44000 rw-p 00000000 00:00 0
7faba6c44000-7faba6c4c000 r-xp 00000000 09:01 18435 /usr/lib64/libkrb5support.so.0.1
7faba6c4c000-7faba6e4b000 ---p 00008000 09:01 18435 /usr/lib64/libkrb5support.so.0.1
7faba6e4b000-7faba6e4c000 rw-p 00007000 09:01 18435 /usr/lib64/libkrb5support.so.0.1
7faba6e4c000-7faba6e62000 r-xp 00000000 09:01 147705 /lib64/libpthread-2.5.so
7faba6e62000-7faba7062000 ---p 00016000 09:01 147705 /lib64/libpthread-2.5.so
7faba7062000-7faba7063000 r--p 00016000 09:01 147705 /lib64/libpthread-2.5.so
7faba7063000-7faba7064000 rw-p 00017000 09:01 147705 /lib64/libpthread-2.5.so
7faba7064000-7faba7068000 rw-p 00000000 00:00 0
7faba7068000-7faba708c000 r-xp 00000000 09:01 18426 /usr/lib64/libk5crypto.so.3.1
7faba708c000-7faba728b000 ---p 00024000 09:01 18426 /usr/lib64/libk5crypto.so.3.1
7faba728b000-7faba728d000 rw-p 00023000 09:01 18426 /usr/lib64/libk5crypto.so.3.1
7faba728d000-7faba728f000 r-xp 00000000 09:01 147673 /lib64/libcom_err.so.2.1
7faba728f000-7faba748e000 ---p 00002000 09:01 147673 /lib64/libcom_err.so.2.1
7faba748e000-7faba748f000 rw-p 00001000 09:01 147673 /lib64/libcom_err.so.2.1
7faba748f000-7faba7520000 r-xp 00000000 09:01 18433 /usr/lib64/libkrb5.so.3.3
7faba7520000-7faba7720000 ---p 00091000 09:01 18433 /usr/lib64/libkrb5.so.3.3
7faba7720000-7faba7724000 rw-p 00091000 09:01 18433 /usr/lib64/libkrb5.so.3.3
7faba7724000-7faba7750000 r-xp 00000000 09:01 18423 /usr/lib64/libgssapi_krb5.so.2.2
7faba7750000-7faba7950000 ---p 0002c000 09:01 18423 /usr/lib64/libgssapi_krb5.so.2.2
7faba7950000-7faba7952000 rw-p 0002c000 09:01 18423 /usr/lib64/libgssapi_krb5.so.2.2
7faba7952000-7faba7a4c000 r-xp 00000000 09:01 74474 /usr/local/lib/libiconv.so.2.5.1
7faba7a4c000-7faba7c4c000 ---p 000fa000 09:01 74474 /usr/local/lib/libiconv.so.2.5.1
7faba7c4c000-7faba7c4e000 rw-p 000fa000 09:01 74474 /usr/local/lib/libiconv.so.2.5.1
7faba7c4e000-7faba7c55000 r-xp 00000000 09:01 151281 /lib64/librt-2.5.so
7faba7c55000-7faba7e55000 ---p 00007000 09:01 151281 /lib64/librt-2.5.so
7faba7e55000-7faba7e56000 r--p 00007000 09:01 151281 /lib64/librt-2.5.so
7faba7e56000-7faba7e57000 rw-p 00008000 09:01 151281 /lib64/librt-2.5.so
7faba7e57000-7faba7e59000 r-xp 00000000 09:01 151274 /lib64/libdl-2.5.so
7faba7e59000-7faba8059000 ---p 00002000 09:01 151274 /lib64/libdl-2.5.so
7faba8059000-7faba805a000 r--p 00002000 09:01 151274 /lib64/libdl-2.5.so
7faba805a000-7faba805b000 rw-p 00003000 09:01 151274 /lib64/libdl-2.5.so
7faba805b000-7faba8071000 r-xp 00000000 09:01 74468 /usr/local/lib/libz.so.1.2.3
7faba8071000-7faba8270000 ---p 00016000 09:01 74468 /usr/local/lib/libz.so.1.2.3
7faba8270000-7faba8271000 rw-p 00015000 09:01 74468 /usr/local/lib/libz.so.1.2.3
7faba8271000-7faba839e000 r-xp 00000000 09:01 150135 /lib64/libcrypto.so.0.9.8e
7faba839e000-7faba859d000 ---p 0012d000 09:01 150135 /lib64/libcrypto.so.0.9.8e
7faba859d000-7faba85be000 rw-p 0012c000 09:01 150135 /lib64/libcrypto.so.0.9.8e
7faba85be000-7faba85c2000 rw-p 00000000 00:00 0
7faba85c2000-7faba860a000 r-xp 00000000 09:01 150137 /lib64/libssl.so.0.9.8e
7faba860a000-7faba880a000 ---p 00048000 09:01 150137 /lib64/libssl.so.0.9.8e
7faba880a000-7faba8810000 rw-p 00048000 09:01 150137 /lib64/libssl.so.0.9.8e
7faba8810000-7faba895f000 r-xp 00000000 09:01 147460 /lib64/libc-2.5.so
7faba895f000-7faba8b5f000 ---p 0014f000 09:01 147460 /lib64/libc-2.5.so
7faba8b5f000-7faba8b63000 r--p 0014f000 09:01 147460 /lib64/libc-2.5.so
7faba8b63000-7faba8b64000 rw-p 00153000 09:01 147460 /lib64/libc-2.5.so
7faba8b64000-7faba8b69000 rw-p 00000000 00:00 0
7faba8b69000-7faba8bf0000 r-xp 00000000 09:01 17326 /usr/lib/dovecot/libdovecot.so.0.0.0
7faba8bf0000-7faba8def000 ---p 00087000 09:01 17326 /usr/lib/dovecot/libdovecot.so.0.0.0
7faba8def000-7faba8df2000 rw-p 00086000 09:01 17326 /usr/lib/dovecot/libdovecot.so.0.0.0
7faba8df2000-7faba8df5000 rw-p 00000000 00:00 0
7faba8df5000-7faba8ee9000 r-xp 00000000 09:01 18745 /usr/lib/dovecot/libdovecot-storage.so.0.0.0
7faba8ee9000-7faba90e8000 ---p 000f4000 09:01 18745 /usr/lib/dovecot/libdovecot-storage.so.0.0.0
7faba90e8000-7faba90f2000 rw-p 000f3000 09:01 18745 /usr/lib/dovecot/libdovecot-storage.so.0.0.0
7faba90f2000-7faba910e000 r-xp 00000000 09:01 150533 /lib64/ld-2.5.so
7faba92f6000-7faba92fe000 rw-p 00000000 00:00 0
7faba9308000-7faba930b000 r--s 00000000 09:02 52166905 /home/triadedif/imap/triade-diffusion.ch/f.sgarzi/Maildir/dovecot.index.log
7faba930b000-7faba930e000 rw-p 00000000 00:00 0
7faba930e000-7faba930f000 r--p 0001c000 09:01 150533 /lib64/ld-2.5.so
7faba930f000-7faba9310000 rw-p 0001d000 09:01 150533 /lib64/ld-2.5.so
7fff195aa000-7fff195cb000 rw-p 00000000 00:00 0 [stack]
7fff195ff000-7fff19600000 r-xp 00000000 00:00 0 [vdso]
ffffffffff600000-ffffffffff601000 r--p 00000000 00:00 0 [vsyscall]
2013-12-10 21:31:20 Received from <> R=1VqTxg-0007LI-90 U=mail P=local S=9945 T="Mail delivery failed: returning message to sender"
2013-12-10 21:32:23 mx1.hotmail.com [65.55.92.168] Connection timed out
2013-12-10 21:33:26 mx1.hotmail.com [65.55.37.120] Connection timed out
2013-12-10 21:34:29 mx1.hotmail.com [65.55.37.72] Connection timed out
2013-12-10 21:35:32 mx1.hotmail.com [65.55.92.184] Connection timed out
root: [email protected]
#info: postmaster
#marketing: postmaster
#sales: postmaster
#support: postmaster
# $Cambridge: exim/exim-src/src/aliases.default,v 1.1 2004/10/07 10:39:01 ph10 Exp $
# Default aliases file, installed by Exim. This file contains no real aliases.
# You should edit it to taste.
# The following alias is required by the mail RFCs 2821 and 2822.
# Set it to the address of a HUMAN who deals with this system's mail problems.
# postmaster: [email][email protected][/email]
# It is also common to set the following alias so that if anybody replies to a
# bounce message from this host, the reply goes to the postmaster.
# mailer-daemon: postmaster
# You should also set up an alias for messages to root, because it is not
# usually a good idea to deliver mail as root.
# root: postmaster
# It is a good idea to redirect any messages sent to system accounts so that
# they don't just get ignored. Here are some common examples:
# bin: root
# daemon: root
# ftp: root
# nobody: root
# operator: root
# uucp: root
# You should check your /etc/passwd for any others.
# Other commonly enountered aliases are:
#
# abuse: the person dealing with network and mail abuse
# hostmaster: the person dealing with DNS problems
# webmaster: the person dealing with your web site
####
diradmin: :blackhole:
# $Cambridge: exim/exim-src/src/aliases.default,v 1.1 2004/10/07 10:39:01 ph10 Exp $
# Default aliases file, installed by Exim. This file contains no real aliases.
# You should edit it to taste.
# The following alias is required by the mail RFCs 2821 and 2822.
# Set it to the address of a HUMAN who deals with this system's mail problems.
# postmaster: [email][email protected][/email]
# It is also common to set the following alias so that if anybody replies to a
# bounce message from this host, the reply goes to the postmaster.
# mailer-daemon: postmaster
# You should also set up an alias for messages to root, because it is not
# usually a good idea to deliver mail as root.
[COLOR="#FF0000"]root: [email][email protected][/email][/COLOR]
# It is a good idea to redirect any messages sent to system accounts so that
# they don't just get ignored. Here are some common examples:
# bin: root
# daemon: root
# ftp: root
# nobody: root
# operator: root
# uucp: root
# You should check your /etc/passwd for any others.
# Other commonly enountered aliases are:
#
# abuse: the person dealing with network and mail abuse
# hostmaster: the person dealing with DNS problems
# webmaster: the person dealing with your web site
####
diradmin: :blackhole:
www: webmaster
webmaster: root
noc: root
security: root
hostmaster: root
info: postmaster
marketing: postmaster
sales: postmaster
support: postmaster