Re: Smart Host Configuration

2010-12-26 Thread Stan Hoeppner
Roman Gelfand put forth on 12/26/2010 7:09 PM: > I have one last question. Since postfix's header information is most > meaningful, is there a setting that would allow me to strip all the > previous header info (in this case exchange's)? Yes. This was covered somewhat recently on the list, and s

Re: Web script compromised? (Was: Mail Server Compromised?)

2010-12-26 Thread ASAI
Thanks to everyone for the priceless advice.

Re: Smart Host Configuration

2010-12-26 Thread Roman Gelfand
I have one last question. Since postfix's header information is most meaningful, is there a setting that would allow me to strip all the previous header info (in this case exchange's)? Thanks On Sun, Dec 26, 2010 at 8:09 AM, Stan Hoeppner wrote: > Roman Gelfand put forth on 12/25/2010 6:06 PM:

Re: Web sscript compromised? (Was: Mail Server Compromised?)

2010-12-26 Thread mouss
Le 25/12/2010 19:55, ASAI a écrit : > Greetings, > > In the logs I have been seeing many attempts made to send messages to > gmail which seem like there's spam being sent from my server. In the > logs I see this: > > Dec 24 00:05:11 triata amavis[29729]: (29729-06) Passed CLEAN, > -> , > Messag

Re: Mail Server Compromised?

2010-12-26 Thread Benny Pedersen
On lør 25 dec 2010 19:55:10 CET, ASAI wrote What is a problem is that there is no user named apa...@triata... and this user is sending hundreds of emails out to Gmail. So it looks like there's been a compromise. My question is, how do I begin to plug this hole? remove apache unix user f

Re: Mail Server Compromised?

2010-12-26 Thread /dev/rob0
On Sun, Dec 26, 2010 at 07:28:11PM +0100, Martin Kellermann wrote: > Am 25.12.2010 19:55, schrieb ASAI: >> In the logs I have been seeing many attempts made to send messages >> to gmail which seem like there's spam being sent from my server. >> In the logs I see this: >> >> Dec 24 00:05:11 triat

Re: Mail Server Compromised?

2010-12-26 Thread Martin Kellermann
Am 25.12.2010 19:55, schrieb ASAI: Greetings, In the logs I have been seeing many attempts made to send messages to gmail which seem like there's spam being sent from my server. In the logs I see this: Dec 24 00:05:11 triata amavis[29729]: (29729-06) Passed CLEAN, -> , Message-ID: <2010

Re: .Forward file piping forwarded mail (abort sendmail)

2010-12-26 Thread /dev/rob0
On Fri, Dec 17, 2010 at 12:25:19AM -0800, selcukyazar wrote: > we don't have procmail or maildrop. just postfix.I wannt abort > forwarding mail it's subject contains Spam think. A better approach is to use recipient_delimiter and tag the envelope recipient address. Amavisd-new can do this. Then,

Re: Smart Host Configuration

2010-12-26 Thread Jeroen Geilman
On 12/26/10 1:58 PM, Stan Hoeppner wrote: mouss put forth on 12/26/2010 4:13 AM: Le 26/12/2010 05:12, Roman Gelfand a écrit : On Fri, Dec 24, 2010 at 4:20 PM, Stan Hoeppner wrote: Roman Gelfand put forth on 12/24/2010 10:45 AM: I neglected to mention the exchange server, source outbound se

Re: Smart Host Configuration

2010-12-26 Thread Stan Hoeppner
Roman Gelfand put forth on 12/25/2010 6:06 PM: > Actually, the original proble reported with the previous post namely > connection timeout was resolved. After checking tcpdump, I realized > outgoing smtp port was closed. > > But, as it appears, this email was not in vain. I need to use a > diffe

Re: Smart Host Configuration

2010-12-26 Thread Stan Hoeppner
mouss put forth on 12/26/2010 4:13 AM: > Le 26/12/2010 05:12, Roman Gelfand a écrit : >> On Fri, Dec 24, 2010 at 4:20 PM, Stan Hoeppner >> wrote: >>> Roman Gelfand put forth on 12/24/2010 10:45 AM: I neglected to mention the exchange server, source outbound server, is on internal edge

Re: Smart Host Configuration

2010-12-26 Thread mouss
Le 26/12/2010 05:12, Roman Gelfand a écrit : > On Fri, Dec 24, 2010 at 4:20 PM, Stan Hoeppner wrote: >> Roman Gelfand put forth on 12/24/2010 10:45 AM: >>> I neglected to mention the exchange server, source outbound server, >>> is on internal edge of the dmz. >> >> Bah, you did mention the Exchan