Client account sending spam!

Portal Home > Knowledgebase > Articles Database > Client account sending spam!

Posted by anastasia0181, 03-17-2010, 03:07 PM
Hi, I have one clients account sending spam How to tweak the server to block it, well: 1- from WHM i disabled to user nobody from sending mails. I have suexec enabled. I have PHP running with Suexec. What else I am missing, One more thing what to do to detect user sending spams? and which log files I need to check? Thank you.
Posted by bear, 03-17-2010, 03:10 PM
You know which account is sending spam? Suspending the above user?
Posted by Hosting50, 03-17-2010, 06:15 PM
You can install this plugins on WHM, Mail Manage and Mail Queues. Will help you alot in this matter and for future.
Posted by PsyHost, 03-17-2010, 07:26 PM
Suspend the user for abusing your system
Posted by servertechs, 03-18-2010, 08:57 AM
You need to check follwing logs for mails in cPanel Message Reception and Delivery: Location : /var/log/exim_mainlog or /var/log/exim/mainlog Description : Receives an entry every time a message is received or delivered.
Posted by energizedit, 03-18-2010, 09:09 AM
I'm with others on this one and suggest you suspend the account. If that is what they are in the business for they will just bail on you anyway once you get their spamming blocked. If they have broken your TOS then skip the hassle and suspend.
Posted by shawn_linux, 03-19-2010, 08:16 AM
Setthe max email limit in /var/cpanel/cpanel.config this can help you detect spamming/.
Posted by jadursupport, 03-20-2010, 08:46 PM
I do also suggest you to enable SPF record and domain keys for your domains on cpanel accounts. SPF : Most domains send outbound mail through a relatively small number of servers. Domains should describe that set of servers in an SPF record in their DNS. Internet email receivers can then reject forged messages which don't come from an envelope sender domain's approved servers. For domain key Installation is simple and it’s done on a domain basis. How to install DomainKeys on a specific domain. 1. First check that you are running the latest version on RELEASE or CURRENT of cPanel 11. 2. Run the script /usr/local/cpanel/bin/domain_keys_installer username * note : Where username is the cPanel user.
Posted by andreyka, 03-21-2010, 12:52 AM
If you want pervent spam sending - you need custom script Script will stop exim if mail in queue over 1k
Posted by Mark Muyskens, 03-21-2010, 02:04 AM
sounds like a fail idea to just STOP it. you would be better off with a script to monitor the queue and to alert you when you are over 500 or so.
Posted by Thebigdream, 03-21-2010, 02:54 AM
I would suggest emailing the client and if they do not stop, Shutting down their services, With notice.
Posted by Crashus, 03-22-2010, 12:42 PM
change their MX record so your server will not serve mail for this specific client
Posted by joombyte, 03-23-2010, 02:04 PM
I suggest contact the client first. It's possible that his account has been compromised. Change the password immediately
Posted by VIPoint, 03-23-2010, 04:19 PM
Hi anastasia0181, I will recommend to you to Suspend the account immediately and ask for explanation from the client. Also check the logs to find out if the account is compromised or not.