Recommendations to prevent spam attacks

Recently one of my clients, had a virus and stole the mail access passwords, my server when crowd started getting spam mail sent through the correct login and password my client, until I found out and I act passed a few hours, when I went to the server and started working, I saw that all emails were from the same user, I changed the password and even got to remove it user but then I saw they had thousands and thousands of emails in the queue, which are impossible to valid and which are not as fast for you to regain the service was erasing them all, which for a few hours some of my customers lost emails.

What options are to avoid these problems? Things that Exchange can do ...

corrective: There is an option to prevent sending more than "x" emails per user per day? etc. ..

preventive:

Notices to increase the mail queue, for example more than "x" mail queued, warning email to admin .. etc. ..

You can do this with Virtualmin???

I would like in this post read your answers or ideas to avoid these problems, unfortunately so common lately.

Status: 
Active

Comments

Howdy -- Postfix doesn't currently support a method of restricting outgoing email on a per-user basis.

However, we're currently exploring using some third party tools in order to do that. Although we don't currently support this (that is, there isn't an automated way to set it up, and we don't have instructions for how to make it work) -- it appears as if Policyd can do that.

It runs as a daemon on your system, and it's possible to configure Postfix to consult it when sending outgoing email.

There may be other tools similar to that.

However, it is indeed possible to watch the mail queue, and receive a notification if there are too many emails within it.

To do that, go into Webmin -> Others -> System and Server Status, and there, you can setup a monitor for "Mail Queue Size". You can choose how large it has to get before it sends you a notification.

What you set that too depends on your system, but something like 50 - 100 may be a good place to start.

Thank you Andrey, i think this monitor is a very good start solution, but into Webmin -> Others -> System and Server Status, i view how i put a monitor to postfix service if it's down (and i have it) but i don't view anything about queue size ¿???

In the "System and Server Status" screen, when you add a monitor, the name of the monitor to add is "Mail Queue Size".

That's different than the Postfix monitor.

So you could have two monitors, one for "Postfix", which makes sure the process is running, and another for "Mail Queue Size", which checks how large the queue is.

Thankyou Andrew, i not view this monitor before, i'm sorry, i think that with this monitor have a 50% that i need to know the good state of my mail server

Best regards

This would be a nice addition to spam kontrol ... and while we are on the matter, is it possible to configure to check outgoing mails for spam?