Delete all mail by auth_id?

osirion

• September 27, 2015 09:04

Hi guys, Every now and then a cPanel or mailbox account gets compromised sending tons of 'authorised mail'. Once detected, a (apparently) way to delete all the mail by an auth_id is: find /var/spool/exim/input -name "*-H" -exec grep -q "-auth_id AUTHID" {} \; -print | while read MSG; do exim -Mrm $(basename ${MSG%-H}); done However, when I run this, I get the following output: grep: invalid option -- 't' Usage: grep [OPTION]... PATTERN [FILE]... Try 'grep --help' for more information. This output repeats many times (I am assuming its repeating for each mail currently in the queue). What am I doing wrong? PS: I know how to delete mail 'from' someone or 'to' someone, but that isnt sufficient because malware generally uses spoofed addresses so hence the need to do it by the compromised auth_id.

• 

  Jcats

  • September 27, 2015 15:03

  You just need to escape the dash in -auth_id
  "\-auth_id AUTHID"
  Should do the trick

  0
• 

  osirion

  • September 27, 2015 15:20

  Thanks - I'll give that a shot :)

  0
• 

  cPanelMichael

  • October 02, 2015 16:12

  Hello :) Feel free to update this thread with the outcome once you have had a chance to try the updated command. Thank you.

  0
• 

  osirion

  • October 02, 2015 16:28

  Seemed to work well, had to use it a couple of days ago. Seemed to only delete mail by specified auth_id, but I didnt verify it 100%. After running the command, checked my queue and it was its 'usual size' of about 90 and before the command was 5000+.

  0
• 

  cPanelMichael

  • October 05, 2015 19:57

  I am happy to see the new command worked. Thank you for updating us with the outcome.

  0

Please sign in to leave a comment.