Option to exempt mailing lists from mails per hour limit

[rs-freddo]

WHM has the ability to disallow emails over a certain number to be sent. I thought this was a great feature except it also counts email lists emails. As some of my clients have large email lists the feature is useless. However i would like to be emailed if anyone sends email over x amount per hour. I don't mind getting the email if it's the lists - but it would be handy to get an email if one of my customers did start sending large amounts of email, at least I could investigate and make sure they are legit.

The reason I ask this is because I recently setup a piece of software that used my outgoing email server to send emails - unfortunately it wasn't a very safe piece of software as it accepted email from outside my LAN - in effect it was an open-relay that could make my server look like an open relay.

I would just like to be notified if anyone sends large amounts of email so I can investigate.

Does anyone else think this is a good idea?

[gorilla]

Great Idea !

[rs-freddo]

I'm surprised there is so little interest. Obviously most cpanel admins host on networks that allow SPAM.

[sawbuck]

Yes I would be interested to see something similar.

[Faldran]

http://home-port.net/Mail-Watch/

use that, it works pretty good!

[rs-freddo]

Originally posted by Faldran
http://home-port.net/Mail-Watch/

use that, it works pretty good!

Thanks!, that looks good.

[eth00]

Good idea about the feature, now they just need to implement mail-watch in whm

[rs-freddo]

Yes, well until they do...

For those using phpsuexec, mailwatch won't run by chmodding the logs 644. So...

Setup mailwatch as per instructions.
Copy mailwatch.php, function.inc.php, config.php
to /root/mailwatch/
chown all three files mailnull.mail
chmod 755 mailwatch.php
open mailwatch and add
#!/usr/local/bin/php -q
as the first line.

No need to change anything with logs.

You can now run it via cron job or manually from SSH.

This is quick and dirty and the mailwatch.php file really needs to be tidied up to be run as cgi (as per my instructions).

[sawbuck]

Thanks Michael!

[Faldran]

Side note on it.. if you have alot of mail going through your server, you may need to change the logrotate for the exim files..

I set all of mine to rotate daily for 7 days, instead of once a week for 4 weeks. ( I also like to disable compression, but that is your choice.. )

BTW.. nice trick.. I just ran mine as root in crontab, but that is much easier solution.. will have to implement it.

[Faldran]

another trick that works well with mail-watch is to add this to exim.conf ( or through WHM exim conf editor .. first box )

log_selector = +address_rewrite +all_parents +arguments +connection_reject +delay_delivery +delivery_size +dnslist_defer +incoming_interface +incoming_port +lost_incoming_connection +queue_run +received_sender +received_recipients +retry_defer +sender_on_delivery +size_reject +skip_delivery +smtp_confirmation +smtp_connection +smtp_protocol_error +smtp_syntax_error +subject +tls_cipher +tls_peerdn 

Remember that should be all one line.

Gives more details about each mail sent.

[cPanelDavidG]

Back to the original topic, the max emails per hour is governed by Exim - does anyone have any technical suggestions on how to have Exim ignore mailing lists (or at least, certain addresses sending email) from this per-hour per-domain limit?