Additional info:
All that shows in the logs is,
Apr 24 08:26:59 barton postfix/pickup[14103]: 849CFF4569: uid=0
from=<root>
Apr 24 08:26:59 barton postfix/cleanup[2161]: 849CFF4569:
message-id=<[email protected]>
Apr 24 08:27:09 barton postfix/qmgr[6233]: 849CFF4569:
from=<[email protected]>, size=278, nrcpt=1 (queue active)
Apr 24 08:27:09 barton postfix/local[2235]: 849CFF4569:
to=<[email protected]>, orig_to=<mungedactualalias>,
relay=local, delay=10, status=deliverable (delivery via
local: delivers to command: /usr/bin/procmail)
Apr 24 08:27:40 barton postfix/qmgr[6233]: 849CFF4569: removed
Postfix is not the SMTP gateway, but I can find no related
entries from mail avenger to link to these mails.
We have only one mailing list on the system, and the alias address
is not a member.
On Sat, 24 Apr 2010, Charles Gregory wrote:
Received about a dozen of the following 'delivery status reports' for
messages with the subject 'probe', all 'returned' to '[email protected]'
all within a 10 minute period. Some report 'user unknown', others
like this one say 'deliverable'.
What is this? Symptom of hack?
- Charles
On Sat, 24 Apr 2010, Mail Delivery System wrote:
Date: Sat, 24 Apr 2010 08:27:30 -0400 (EDT)
From: Mail Delivery System <[email protected]>
To: [email protected]
Subject: Mail Delivery Status Report
This is the Postfix program at host barton.hwcn.org.
Enclosed is the mail delivery report that you requested.
The Postfix program
<[email protected]> (expanded from <mungedactualalias>):
delivery via local: delivers
to command: /usr/bin/procmail
