hundredds of exim instances overloading server

[EMS]

Hi,

Just had an incident whereby the server load went crazy. I restarted the server but whenever the network cable was plugged in - 1200 exim processes spooled up followed by clamd service which takes the load up to 100% and disk access is constant.

I got the datacenter to unplug the network cable, restart the server and stop exim - then plug it back in.

I then logged in remoteley and made sure the exim service was stopped, it was already starting again and building up 30 or 40 processes.

I've checked out the server and so far have been unable to find any compromised accounts or unusual files. /tmp is clean.

If exim is restarted it happens again.

Any ideas ?

[chirpy]

Well, any relevant information should be in /var/log/exim_mainlog

[EMS]

The mail queue had thousands of messages intended for one domin on the server. They appear to be delivery failures to a spam mesage sent with a spoofed header. They were not sent form the domain in question.

Its still happening - i'll run a script to clear out the mail queue every 30 seconds for messages contianing the content.

[abubin]

you need to install some security in your exim. Most probably you are being bombarded by spams and/or dictionary attack.

Have you installed RBL and APF (with brute force detection)?

Also, did you disable "catch-all"?

[EMS]

you need to install some security in your exim. Most probably you are being bombarded by spams and/or dictionary attack.

Have you installed RBL and APF (with brute force detection)?

Also, did you disable "catch-all"?

APF with BFD installed - RBL not. They were all delivery failures to spam messages. The reason the server was being overloaded is because the customer had a catchall set. once I set it to :blackhole: things eased up. We dont prevent them from using a catchall mailbox.

[chirpy]

APF and BFD won't do anythng about spam (unless you use the flawed exim blocker). You much better off with a dictionary attack ACL and not using :blackhole: - use :fail: instead, it's much lighter on your server resources and for many other reasons.

[elix]

Run this command to convert all domains to :fail: instead of :blackhole:.

perl -pi -e "s/:blackhole:/:fail:/g;" /etc/valiases/*

Also, I'd look at the headers in the mail queue to try to find out exactly where this coming from, and then I'd clear out the mail queue as that in itself could be causing high load.

Good luck.

Regards,

[EMS]

But, wont :fail: send a reply back - where :blackhole: will simply discard the message ?

[chirpy]

No:
http://www.configserver.com/free/fail.html

[EMS]

Ahh, thanks. I got it the wrong way round.