Followup... yes found the exact feature you are looking for:
g_sent_store "System_Sent"
with
expire_rule folder="System_Sent" age="30".
Also look at the settings:
g_spam_user_max, g_spam_user_warn, g_breakin_enable, g_country_login
g_hacker_max + g_hacker_days
g_hacker_password / g_hacker_passwords / g_hacker_weak
g_hacker_alert
Let me know how that goes.
Marijn
On Thursday 12/11/2026 at 3:32 pm, SurgeMail Support (Marijn) via list
wrote:
>
>
> Hi
>
> That is the first mailing list post in a while! Here are my thoughts
> on the matter :-)
>
> Are those guesses from "safe" countries or "obscure" countries,
> particularly if obscure I would start with g_country_ip based
> detection. Typical settings might be:
>
> g_country_ip "TRUE"
> g_safe_country "US,AU,NZ,FR,GB,CA"
> g_safe_alert "TRUE"
> and maybe
> g_safe_warning "TRUE"
> is a good combination for early detection of compromised accounts.
>
>
> I am not aware of any features that match exactly what you are
> suggesting, but will have a look to see what I can find.
>
> The most relevant existing feature is :
> g_redirect_from_cc from="*@mydomain.com"
> to="ourtbound@mydomain.com"
> would allow you to capture all outbound mail from all or some matching
> accounts in one place and and setup expire rules to only keep 30 days
> worth.
>
> I think these could be made to work too:
> 1) each of the archive features
> 2) mfilter based solution
>
>
> Also there already is a sent_store feature that allows mail clients to
> trigger the store to sent folder on an authenticated SMTP session to
> do most of what you are describing without having to separately imap
> upload the messages. That could easily be extended and always trigger.
>
>
> Hmmm... maybe Chris has already implemented your exact feature, this
> always used to be his area... I will do some more source code hunting
> :-)
>
>
> Marijn
>
>
>
>
>
>
>
>
> On Thursday 12/11/2026 at 2:56 pm, Lyle Giese via list wrote:
>>
>> My personal Surgemail server has been under very heavy password attack
>> from around the world. They know valid user ids and pound away to
>> the tune of thousands per account every day. It's been going on for
>> about 2 or 3 months now.
>>
>> Like a blind squirrel looking for nuts, they finally found a valid
>> password and proceed to abuse it. However the abuse was a very small
>> volume of messages to valid email addresses(no NDRs generated). The
>> only way I discovered it was that I use a relayhost for relaying email
>> and monitor all email outbound on it. So any damage was limited and
>> I quickly changed the password on the effected email account.
>>
>> Now my question pertains to outbound email. If a password is
>> compromised, how do I easily discover that? If the abusers are smart
>> and don't send any email that generates an NDR, the abuse could
>> continue with little notice esp with low mail volume generated.
>>
>> My question pertains to sent email. Right now, it's up the the email
>> sending agent to archive sent email to the 'Sent' folder. I don;t see
>> off hand how I can capture outbound email and review it. Email
>> archiving is one way, but how would that give me easy access to volume
>> of sent mail per account? The rules per account seem to be for
>> inbound email only.
>>
>> I am thinking I could use a rule to save a copy of outbound email
>> server side into a special 'sent' folder for each account(or against
>> each account). Then just glance at the number of messages once or
>> twice a day and see out of normal usage. For this to work, I need this
>> to be a server side rule and not rely on the email sender. Archiving
>> includes all email for the account, incoming and outgoing and doesn't
>> lend itself to easy viewing.
>>
>> I don't want this for long term storage and would limit to 30days or
>> less.
>>
>> Lyle Giese
>>
>>
>
>
>
>
|
