Natalio Gatti wrote:
I already check rcpthosts, it only lists my local domains.
I´m looking right now at smtp and send logs, and I´m seeing something
strange. All those mails come from "[EMAIL PROTECTED]". I´m afraid that
some service extra qmail is letting spammers send mails.
I see this in the send log:
----------------------------------------------------
2006-07-03 04:24:01.660831500 new msg 240870
2006-07-03 04:24:01.660834500 info msg 240870: bytes 8983 from
<[EMAIL PROTECTED]> qp 13290 uid 48
2006-07-03 04:24:01.665611500 starting delivery 735147: msg 240870 to
remote [EMAIL PROTECTED]
----------------------------------------------------
And in the same second (at 04:24:01) the log shows tens of mails (and
it continous in the following seconds)
But I can´t locate those messages in the "smtp" log.
Are you running something in Apache? If you have a script running there
(PHP webpage, CGI script, etc.) it may have been compromised and someone
is sending emails that way.
BTW - PHPNuke is the worst. I had a client set that up, and within 24
hours someone emailed them their own root password and let them know
they had "owned" their system..... *NOT* nice.
---------------------------------------------------------------------
QmailToaster hosted by: VR Hosted <http://www.vr.org>
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
