<HTML>
<HEAD>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<META content="OPENWEBMAIL" name=GENERATOR>
</HEAD>
<BODY bgColor=#ffffff>
Also check your webmail package logs. We had one guess a username/password and was using a BQ server as a relay with SMTP Auth. I shut that down and it was OK for a couple days. Then I noticed a ton of crap going thru us again. Turns out he was using the OpenWebMail package to send it out.
<br />
<br />I finally just blocked his whole stinkin' country with our front-door router. Fixed that garbage! Of course - I also deleted the account he was using. Any user stupid enough to change his password to the same thing as his username is too stupid to use my service!!
<br />
<br />
<br />
<br />Chuck
<br />
<br /><font size="2">
<br />
<br /><b>---------- Original Message
-----------</b>
<br />
From: "Charles Bowman" <charlesbowman@wknet.co.uk>
<br />
To: <blueonyx@blueonyx.it>
<br />
Sent: Sat, 27 Jun 2009 19:03:04 +0100
<br />
Subject: [BlueOnyx:01515] Re: Slammed with Spammer
<br />
<br />> Check your secure logs:
<br />>
#more /var/log/secure
<br />>
Look for *lots* of connections, verifying the IP address will give you
<br />>
anything obvious; i.e. Taiwanese IP logging-in.
<br />>
Check the webspace for the user for any Phisting scams & web back doors.
<br />>
Check the rest of the box has not been compromised...
<br />>
<br />>
Cheers,
<br />>
Charles
<br />>
<br />>
-----Original Message-----
<br />>
From: blueonyx-bounces@blueonyx.it
<br />>
[mailto:blueonyx-bounces@blueonyx.it]On Behalf Of Steve Davis
<br />>
Sent: 27 June 2009 18:05
<br />>
To: blueonyx@blueonyx.it
<br />>
Subject: [BlueOnyx:01513] Slammed with Spammer
<br />>
Importance: Low
<br />>
<br />>
Having an issue with an old enemy on a new BO box.
<br />>
<br />>
net.tw,
<br />>
gov.tw
<br />>
org.tw
<br />>
net.tw
<br />>
com.tw
<br />>
<br />>
take your pick.
<br />>
<br />>
Some how, they must know one of the emails userid and password on the
<br />>
box and are sending 4000 - 5000 spams per hour into my mail queue.
<br />>
<br />>
I have turned off PopBeforeSMTP, so probably not sending email out.
<br />>
Probably.
<br />>
<br />>
How do I tell which account is being used to connect.
<br />>
<br />>
Any other suggestion of course is always appreciated.
<br />>
<br />>
Steve
<br />>
<br />>
_______________________________________________
<br />>
Blueonyx mailing list
<br />>
Blueonyx@blueonyx.it
<br />>
<a target="_blank" href="http://www.blueonyx.it/mailman/listinfo/blueonyx">http://www.blueonyx.it/mailman/listinfo/blueonyx</a>
<br />>
<br />>
_______________________________________________
<br />>
Blueonyx mailing list
<br />>
Blueonyx@blueonyx.it
<br />>
<a target="_blank" href="http://www.blueonyx.it/mailman/listinfo/blueonyx">http://www.blueonyx.it/mailman/listinfo/blueonyx</a>
<br /><b>------- End of Original Message
-------</b>
<br />
</font>
</BODY>
</HTML>