Page 1 of 1

[Alert Mailboxes] Where they are registered?

Posted: 29 Jul 2015, 12:43
by misterasso
Hi all,
I would please ask for help on this situation: in Exim queue of undelivered messages I find, often, a long list of frozen messages sent by LFD (for hack attempt to htpasswd) to recipients like this ones:

Script@<MyLocalDomain>
Hack@<MyLocalDomain>
Attempts.@<MyLocalDomain>
-t@<MyLocalDomain>

with this return path

Return-path: <Automated@<MyLocalDomain>

The messages are frozen cause the previous mailbox are non existants on my server (this one hosting MyLocalDomain).

A typical string contained in this (frozen) messages are a thing like so:

[Wed Jul 29 12:42:08.337385 2015] [auth_basic:error] [pid 25413] [client <SOME_IP>:<SOME_PORT>] AH01618: user Admin not found:

How I can solve this problem? Where the previous mailboxes are read?

Thank you!

Re: [Alert Mailboxes] Where they are registered?

Posted: 30 Jul 2015, 19:20
by misterasso
Solved: during the customization of alert message I wriote the words "Automated" "Script" "Hack" "Attemps." that will be the "sender" and some recipients of the message itself.

Bye all!