delete the list of messages waiting

Excuse it's mail queue and i use this code and i suppose it's good
cd /var/spool
mv exim exim.old
mkdir -p exim/input
mkdir -p exim/msglog
mkdir -p exim/db
chown -R mail:mail exim
/sbin/service exim restart

Then delete the old spool:

rm -rf exim.old
 
all msgs is this
Code:
exim -bp | awk '/^ *[0-9]+[mhd]/{print "exim -Mrm " $3}' | bash
the other cmd is needs a msg id and did not work for me.
I had been looking also, thanks for that link scsi.
 
not sure.
on mine it seemed to be related to cron job notifications going to an incorrect admin address.
I'm not experienced enough to just guess whats happening on your end.
 
this is the mesage
1VqTxg-0007LL-DW-H
mail 8 12
<>
1386707480 0
-ident mail
-received_protocol local
-body_linecount 140
-max_received_linelength 148
-allow_unqualified_recipient
-allow_unqualified_sender
-deliver_firsttime
-localerror
XX
1
[email protected]

146P Received: from mail by ns3002026.ovh.net with local (Exim 4.72)
id 1VqTxg-0007LL-DW
for [email protected]; Tue, 10 Dec 2013 21:31:20 +0100
038 Date: Tue, 10 Dec 2013 21:31:20 +0100
050I Message-Id: <[email protected]>
047 X-Failed-Recipients: [email protected]
029 Auto-Submitted: auto-replied
061F From: Mail Delivery System <[email protected]>
027T To: [email protected]
059 Subject: Mail delivery failed: returning message to sender
1VqTxg-0007LL-DW-D
This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

[email protected]
(ultimately generated from [email protected])
retry time not reached for any host after a long failure period

------ This is a copy of the message, including all the headers. ------

Return-path: <[email protected]>
Received: from root by ns3002026.ovh.net with local (Exim 4.72)
(envelope-from <[email protected]>)
id 1VqTxg-0007LI-90
for [email protected]; Tue, 10 Dec 2013 21:31:20 +0100
Date: Tue, 10 Dec 2013 21:31:20 +0100
Message-Id: <[email protected]>
To: [email protected]
Subject: lfd on ns3002026.ovh.net: Suspicious process running under user triadedif
From: <[email protected]>

Time: Tue Dec 10 21:31:20 2013 +0100
PID: 28143 (Parent PID:5051)
Account: triadedif
Uptime: 68 seconds


Executable:

/usr/libexec/dovecot/imap


Command Line (often faked in exploits):

dovecot/imap [[email protected] 194.230.159.89]


Network connections by the process (if any):

tcp: 37.59.4.220:143 -> 194.230.159.89:36217


Files open by the process (if any):

/dev/null
/dev/null
anon_inode:[eventpoll]
/home/triadedif/imap/triade-diffusion.ch/f.sgarzi/Maildir/dovecot.index.log
/home/triadedif/imap/triade-diffusion.ch/f.sgarzi/Maildir/dovecot.index


Memory maps by the process (if any):

00400000-0041f000 r-xp 00000000 09:01 41741 /usr/libexec/dovecot/imap
0061f000-00620000 rw-p 0001f000 09:01 41741 /usr/libexec/dovecot/imap
00620000-006ab000 rw-p 00000000 00:00 0 [heap]
3c7ec00000-3c7ec02000 r-xp 00000000 09:01 147697 /lib64/libkeyutils-1.2.so
3c7ec02000-3c7ee01000 ---p 00002000 09:01 147697 /lib64/libkeyutils-1.2.so
3c7ee01000-3c7ee02000 rw-p 00001000 09:01 147697 /lib64/libkeyutils-1.2.so
7faba63c6000-7faba63d0000 r-xp 00000000 09:01 151278 /lib64/libnss_files-2.5.so
7faba63d0000-7faba65cf000 ---p 0000a000 09:01 151278 /lib64/libnss_files-2.5.so
7faba65cf000-7faba65d0000 r--p 00009000 09:01 151278 /lib64/libnss_files-2.5.so
7faba65d0000-7faba65d1000 rw-p 0000a000 09:01 151278 /lib64/libnss_files-2.5.so
7faba65d1000-7faba660c000 r-xp 00000000 09:01 147672 /lib64/libsepol.so.1
7faba660c000-7faba680c000 ---p 0003b000 09:01 147672 /lib64/libsepol.so.1
7faba680c000-7faba680d000 rw-p 0003b000 09:01 147672 /lib64/libsepol.so.1
7faba680d000-7faba6817000 rw-p 00000000 00:00 0
7faba6817000-7faba682c000 r-xp 00000000 09:01 150084 /lib64/libselinux.so.1
7faba682c000-7faba6a2c000 ---p 00015000 09:01 150084 /lib64/libselinux.so.1
7faba6a2c000-7faba6a2e000 rw-p 00015000 09:01 150084 /lib64/libselinux.so.1
7faba6a2e000-7faba6a2f000 rw-p 00000000 00:00 0
7faba6a2f000-7faba6a40000 r-xp 00000000 09:01 151280 /lib64/libresolv-2.5.so
7faba6a40000-7faba6c40000 ---p 00011000 09:01 151280 /lib64/libresolv-2.5.so
7faba6c40000-7faba6c41000 r--p 00011000 09:01 151280 /lib64/libresolv-2.5.so
7faba6c41000-7faba6c42000 rw-p 00012000 09:01 151280 /lib64/libresolv-2.5.so
7faba6c42000-7faba6c44000 rw-p 00000000 00:00 0
7faba6c44000-7faba6c4c000 r-xp 00000000 09:01 18435 /usr/lib64/libkrb5support.so.0.1
7faba6c4c000-7faba6e4b000 ---p 00008000 09:01 18435 /usr/lib64/libkrb5support.so.0.1
7faba6e4b000-7faba6e4c000 rw-p 00007000 09:01 18435 /usr/lib64/libkrb5support.so.0.1
7faba6e4c000-7faba6e62000 r-xp 00000000 09:01 147705 /lib64/libpthread-2.5.so
7faba6e62000-7faba7062000 ---p 00016000 09:01 147705 /lib64/libpthread-2.5.so
7faba7062000-7faba7063000 r--p 00016000 09:01 147705 /lib64/libpthread-2.5.so
7faba7063000-7faba7064000 rw-p 00017000 09:01 147705 /lib64/libpthread-2.5.so
7faba7064000-7faba7068000 rw-p 00000000 00:00 0
7faba7068000-7faba708c000 r-xp 00000000 09:01 18426 /usr/lib64/libk5crypto.so.3.1
7faba708c000-7faba728b000 ---p 00024000 09:01 18426 /usr/lib64/libk5crypto.so.3.1
7faba728b000-7faba728d000 rw-p 00023000 09:01 18426 /usr/lib64/libk5crypto.so.3.1
7faba728d000-7faba728f000 r-xp 00000000 09:01 147673 /lib64/libcom_err.so.2.1
7faba728f000-7faba748e000 ---p 00002000 09:01 147673 /lib64/libcom_err.so.2.1
7faba748e000-7faba748f000 rw-p 00001000 09:01 147673 /lib64/libcom_err.so.2.1
7faba748f000-7faba7520000 r-xp 00000000 09:01 18433 /usr/lib64/libkrb5.so.3.3
7faba7520000-7faba7720000 ---p 00091000 09:01 18433 /usr/lib64/libkrb5.so.3.3
7faba7720000-7faba7724000 rw-p 00091000 09:01 18433 /usr/lib64/libkrb5.so.3.3
7faba7724000-7faba7750000 r-xp 00000000 09:01 18423 /usr/lib64/libgssapi_krb5.so.2.2
7faba7750000-7faba7950000 ---p 0002c000 09:01 18423 /usr/lib64/libgssapi_krb5.so.2.2
7faba7950000-7faba7952000 rw-p 0002c000 09:01 18423 /usr/lib64/libgssapi_krb5.so.2.2
7faba7952000-7faba7a4c000 r-xp 00000000 09:01 74474 /usr/local/lib/libiconv.so.2.5.1
7faba7a4c000-7faba7c4c000 ---p 000fa000 09:01 74474 /usr/local/lib/libiconv.so.2.5.1
7faba7c4c000-7faba7c4e000 rw-p 000fa000 09:01 74474 /usr/local/lib/libiconv.so.2.5.1
7faba7c4e000-7faba7c55000 r-xp 00000000 09:01 151281 /lib64/librt-2.5.so
7faba7c55000-7faba7e55000 ---p 00007000 09:01 151281 /lib64/librt-2.5.so
7faba7e55000-7faba7e56000 r--p 00007000 09:01 151281 /lib64/librt-2.5.so
7faba7e56000-7faba7e57000 rw-p 00008000 09:01 151281 /lib64/librt-2.5.so
7faba7e57000-7faba7e59000 r-xp 00000000 09:01 151274 /lib64/libdl-2.5.so
7faba7e59000-7faba8059000 ---p 00002000 09:01 151274 /lib64/libdl-2.5.so
7faba8059000-7faba805a000 r--p 00002000 09:01 151274 /lib64/libdl-2.5.so
7faba805a000-7faba805b000 rw-p 00003000 09:01 151274 /lib64/libdl-2.5.so
7faba805b000-7faba8071000 r-xp 00000000 09:01 74468 /usr/local/lib/libz.so.1.2.3
7faba8071000-7faba8270000 ---p 00016000 09:01 74468 /usr/local/lib/libz.so.1.2.3
7faba8270000-7faba8271000 rw-p 00015000 09:01 74468 /usr/local/lib/libz.so.1.2.3
7faba8271000-7faba839e000 r-xp 00000000 09:01 150135 /lib64/libcrypto.so.0.9.8e
7faba839e000-7faba859d000 ---p 0012d000 09:01 150135 /lib64/libcrypto.so.0.9.8e
7faba859d000-7faba85be000 rw-p 0012c000 09:01 150135 /lib64/libcrypto.so.0.9.8e
7faba85be000-7faba85c2000 rw-p 00000000 00:00 0
7faba85c2000-7faba860a000 r-xp 00000000 09:01 150137 /lib64/libssl.so.0.9.8e
7faba860a000-7faba880a000 ---p 00048000 09:01 150137 /lib64/libssl.so.0.9.8e
7faba880a000-7faba8810000 rw-p 00048000 09:01 150137 /lib64/libssl.so.0.9.8e
7faba8810000-7faba895f000 r-xp 00000000 09:01 147460 /lib64/libc-2.5.so
7faba895f000-7faba8b5f000 ---p 0014f000 09:01 147460 /lib64/libc-2.5.so
7faba8b5f000-7faba8b63000 r--p 0014f000 09:01 147460 /lib64/libc-2.5.so
7faba8b63000-7faba8b64000 rw-p 00153000 09:01 147460 /lib64/libc-2.5.so
7faba8b64000-7faba8b69000 rw-p 00000000 00:00 0
7faba8b69000-7faba8bf0000 r-xp 00000000 09:01 17326 /usr/lib/dovecot/libdovecot.so.0.0.0
7faba8bf0000-7faba8def000 ---p 00087000 09:01 17326 /usr/lib/dovecot/libdovecot.so.0.0.0
7faba8def000-7faba8df2000 rw-p 00086000 09:01 17326 /usr/lib/dovecot/libdovecot.so.0.0.0
7faba8df2000-7faba8df5000 rw-p 00000000 00:00 0
7faba8df5000-7faba8ee9000 r-xp 00000000 09:01 18745 /usr/lib/dovecot/libdovecot-storage.so.0.0.0
7faba8ee9000-7faba90e8000 ---p 000f4000 09:01 18745 /usr/lib/dovecot/libdovecot-storage.so.0.0.0
7faba90e8000-7faba90f2000 rw-p 000f3000 09:01 18745 /usr/lib/dovecot/libdovecot-storage.so.0.0.0
7faba90f2000-7faba910e000 r-xp 00000000 09:01 150533 /lib64/ld-2.5.so
7faba92f6000-7faba92fe000 rw-p 00000000 00:00 0
7faba9308000-7faba930b000 r--s 00000000 09:02 52166905 /home/triadedif/imap/triade-diffusion.ch/f.sgarzi/Maildir/dovecot.index.log
7faba930b000-7faba930e000 rw-p 00000000 00:00 0
7faba930e000-7faba930f000 r--p 0001c000 09:01 150533 /lib64/ld-2.5.so
7faba930f000-7faba9310000 rw-p 0001d000 09:01 150533 /lib64/ld-2.5.so
7fff195aa000-7fff195cb000 rw-p 00000000 00:00 0 [stack]
7fff195ff000-7fff19600000 r-xp 00000000 00:00 0 [vdso]
ffffffffff600000-ffffffffff601000 r--p 00000000 00:00 0 [vsyscall]
and
2013-12-10 21:31:20 Received from <> R=1VqTxg-0007LI-90 U=mail P=local S=9945 T="Mail delivery failed: returning message to sender"
2013-12-10 21:32:23 mx1.hotmail.com [65.55.92.168] Connection timed out
2013-12-10 21:33:26 mx1.hotmail.com [65.55.37.120] Connection timed out
2013-12-10 21:34:29 mx1.hotmail.com [65.55.37.72] Connection timed out
2013-12-10 21:35:32 mx1.hotmail.com [65.55.92.184] Connection timed out

thanks, i have 50 mail by hour ??
 
The reason for that is root is on Exim's "never user list".

Best way to handle this is to edit your /etc/aliases file, then add an email adres of you choice like this:
Code:

It would be smart to comment the following too like this:
Code:
#info:          postmaster
#marketing:     postmaster
#sales:         postmaster
#support:       postmaster

Then save your /etc/aliases file, restart Exim and the problem should be over.
 
thanks this is my file
Code:
# $Cambridge: exim/exim-src/src/aliases.default,v 1.1 2004/10/07 10:39:01 ph10 Exp $

# Default aliases file, installed by Exim. This file contains no real aliases.
# You should edit it to taste.


# The following alias is required by the mail RFCs 2821 and 2822.
# Set it to the address of a HUMAN who deals with this system's mail problems.

# postmaster: [email][email protected][/email]

# It is also common to set the following alias so that if anybody replies to a
# bounce message from this host, the reply goes to the postmaster.

# mailer-daemon: postmaster


# You should also set up an alias for messages to root, because it is not
# usually a good idea to deliver mail as root.

# root: postmaster

# It is a good idea to redirect any messages sent to system accounts so that
# they don't just get ignored. Here are some common examples:

# bin: root
# daemon: root
# ftp: root
# nobody: root
# operator: root
# uucp: root

# You should check your /etc/passwd for any others.


# Other commonly enountered aliases are:
#
# abuse:       the person dealing with network and mail abuse
# hostmaster:  the person dealing with DNS problems
# webmaster:   the person dealing with your web site

####
diradmin: :blackhole:
and i change for :
Code:
# $Cambridge: exim/exim-src/src/aliases.default,v 1.1 2004/10/07 10:39:01 ph10 Exp $

# Default aliases file, installed by Exim. This file contains no real aliases.
# You should edit it to taste.


# The following alias is required by the mail RFCs 2821 and 2822.
# Set it to the address of a HUMAN who deals with this system's mail problems.

# postmaster: [email][email protected][/email]

# It is also common to set the following alias so that if anybody replies to a
# bounce message from this host, the reply goes to the postmaster.

# mailer-daemon: postmaster


# You should also set up an alias for messages to root, because it is not
# usually a good idea to deliver mail as root.

[COLOR="#FF0000"]root: [email][email protected][/email][/COLOR]

# It is a good idea to redirect any messages sent to system accounts so that
# they don't just get ignored. Here are some common examples:

# bin: root
# daemon: root
# ftp: root
# nobody: root
# operator: root
# uucp: root

# You should check your /etc/passwd for any others.


# Other commonly enountered aliases are:
#
# abuse:       the person dealing with network and mail abuse
# hostmaster:  the person dealing with DNS problems
# webmaster:   the person dealing with your web site

####
diradmin: :blackhole:
 
As luck would have it, I've got a new machine on which I've just finished setting up CentOS6.5.

Among many others, it's got these:

www: webmaster
webmaster: root
noc: root
security: root
hostmaster: root
info: postmaster
marketing: postmaster
sales: postmaster
support: postmaster

As long as you've got a redirect from root to something you actually read, this will mean you'll get all those addresses at any domain that doesn't already have them. Sometimes handy, sometimes a real pain.

Over the years, I've begun to think I should remove some of them.

Jeff
 
Removing them is the same as commenting them.
Some are needed by RFC's, like hostmaster and/or postmaster (depending on your DNS config).

You don't need things like webmaster, security, info, marketing, sales and support. In fact it will give problems when a customer uses them (which is often the case with support, sales and info) and their mailbox is full or suspended.
You will see that your root email address is getting the full mails which should in fact go to them.
Those addresses should not be limited to root, so that's why it's best to either remove or comment them.
 
Problem with leaving these in the aliases file is that when a user sends (for example) to [email protected] and webmaster doesnt exist at that domain, the email will end up coming to you (presuming you forward root email somewhere, as I do.

If I recall correctly the RFQs require that the sending mailsever have a postmaster, not the domain, and etc.

So I create the required aliases in a domain-specific aliases file under (for example) /etc/virtual/host.example.com.

Jeff
 
ok thank you, but I've had nothing but problems with the disk serveurn HS yesterday ..
I'm trying to redo everything new ..
 
Back
Top