Re: Lots of unauthorized emails

[Steven Harris]

There are websites you can use to determine if you are an open relay.
the one I used was ordb.org
It is also possible that you have a virus that is sending out e-mails or
even that someone else has a virus (you are in there address book) and
they are sending out e-mails as you. But do the open relay test first.
On Nov 6, 2003, at 9:22 AM, Vincenzo Gianferrari Pini wrote:

James,

yes, those are all messages waiting to be sent. Just delete all the 
files (better to stop James before doing that).

Have a look at the date/time: are thy <= to the moment you did set up 
SMTPAuth? if yes, it is likely that you have been exploited as an open 
relay, otherwise it sounds something to investigate further.

Ciao,

Vincenzo

-----Original Message-----
From: James Kearney(hotmail) [mailto:[EMAIL PROTECTED]
Sent: gioved� 6 novembre 2003 16.43
To: James Users List
Subject: Re: Lots of unauthorized emails
Vincenzo,

JAMES_ROOT/apps/james/var/mail/outgoing directory is full of
files, 8864 to
be exact.
Is this mail that is waiting to be sent, and can i just delete all the
files?
After doing this I will change the administrators account and all 
users
account passwords again - hopefully this will stop the abuse.

thanks v much

james.

----- Original Message -----
From: "Vincenzo Gianferrari Pini" <[EMAIL PROTECTED]>
To: "James Users List" <[EMAIL PROTECTED]>
Sent: Thursday, November 06, 2003 3:24 PM
Subject: RE: Lots of unauthorized emails
Have a look at the
JAMES_ROOT/apps/james/var/mail/outgoing directory
if using file based repositories, or
select * from spool where repository_name='outgoing'
if using jdbc based repositories.
Vincenzo

-----Original Message-----
From: James Kearney(hotmail) [mailto:[EMAIL PROTECTED]
Sent: gioved� 6 novembre 2003 16.05
To: [EMAIL PROTECTED]
Subject: Lots of unauthorized emails
Hi,

I am running the james server on jameskearney.com and I am
getting lots of
emails saying "could not send email to xxx" where xxx is some
address that I
have never heard of - so obviously someone unauthorized is using
my server.
I have smtp auth set up - so I don't believe that it is the
case that the
smtp server is an open relay.

I also have changed the passwords on the smtp accounts - this
also does not
help.
The only possibility is that all of these messages were spooled
in the short
time before I got smtp auth set up - is there anyway I can check 
what is
waiting to be sent, and remove it if it is not appropriate.

Failing this I am unsure as to how these nasty people are using
my server to
send their junk!
Please help, I don't want to add to the spam problem!

thanks very much

james kearney



---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]