EMERGENCY - need to secure my server against an ongoing SPAMMER

[Lai Zit Seng]

On Fri, 11 Mar 2005, Bob Brennan wrote:

> Sorry for the brevity here but I woke this morning to find my
> mailserver sending 1000+ rejected email notices to postmaster@, and it
> was increasing by the minute. I have shut down Sendmail and am
> removing all relay permissions (I hope) but have a few issues that
> need to be resolved quickly before going back online - knowing the
> spammer will be retrying and my legitimate users are losing services.
>
> 1. There are 700+ emails sitting in the outgoing queue, I am using
> WebMin to delete them but at 20 at-a-time it is useless. I need a
> command line that will do it without causing more damage.

I guess the fastest way is to simply delete everything under 
/var/spool/mqueue.

> 2. MySql is shut down for some reason, I don't know if it's related to
> the attack. "service msqld status" returns "msqld dead but subsys
> locked"

Well you could check the mysql logs to see if it gives you any clue about 
what might be wrong...

Regards,

.lzs