<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 8.00.6001.18783">
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT size=2 face=Arial>Did you see Michael's post</FONT></DIV>
<BLOCKQUOTE
style="BORDER-LEFT: #000000 2px solid; PADDING-LEFT: 5px; PADDING-RIGHT: 0px; MARGIN-LEFT: 5px; MARGIN-RIGHT: 0px"
dir=ltr>
<DIV><FONT size=2 face=Arial>also I used this command to clear mqueue of all
email 1 day orld of more</FONT></DIV>
<DIV><FONT size=2 face=Arial> /var/spool/mqueue/ -type f -mtime +1 -ls
-exec rm {} \;</FONT></DIV>
<DIV><FONT size=2 face=Arial>and</FONT></DIV>
<DIV><FONT size=2 face=Arial> /var/spool/mqueue.in/ -type f -mtime +1
-ls -exec rm {} \;</FONT></DIV>
<DIV><FONT size=2 face=Arial></FONT> </DIV>
<DIV><FONT size=2 face=Arial>Gerald</FONT></DIV>
<DIV><FONT size=2 face=Arial></FONT> </DIV>
<DIV>> Ok, let us take a look at the first logged line:<BR>><BR>>>
Jul 15 08:08:49 msi1 sendmail[18333]: n6FD4mxh018333:<BR>>> from=<<A
href="mailto:vitaly@ihome.net.ua">vitaly@ihome.net.ua</A>>, size=2749,
class=0, nrcpts=49,<BR>>> msgid=<<A
href="mailto:200907151305.n6FD4mxh018333@msi1.portage.net">200907151305.n6FD4mxh018333@msi1.portage.net</A>>,
proto=ESMTP,<BR>>> daemon=MTA, relay=[82.128.35.90]<BR>><BR>> We
have the sender <<A
href="mailto:vitaly@ihome.net.ua">vitaly@ihome.net.ua</A>> (probably faked)
comming from <BR>> the IP<BR>> 82.128.35.90.<BR>><BR>> The line "
size=2749, class=0, nrcpts=49" tells us that the email was 2749<BR>> bytes
long and "nrcpts=49" means: This email had 49 individual recipients <BR>>
(To,<BR>> CC or BCC). So once this email got accepted by your mailserver,
your <BR>> Sendmail<BR>> attempted to deliver it to all 49 recipients -
regardless if they were <BR>> local<BR>> accounts or
not.<BR>><BR>> Now the question is: Why was this box relaying for
82.128.35.90?<BR>><BR>> Is that IP in the Sendmail access list and
allowed to relay? It is <BR>> probably<BR>> not, but it's worth
checking.<BR>><BR>> Did the sender use SMTP-Auth? If *that* is the case,
check the log entry <BR>> right<BR>> before that line in question. There
should be something like this there:<BR>><BR>> sendmail[5204]:
AUTH=server, relay=ihome.net.ua [82.128.35.90], <BR>> authid=tom,<BR>>
mech=PLAIN, bits=0<BR>><BR>> In that case the "authid=tom" would tell us
that user "tom" used SMTP-Auth <BR>> to<BR>> authenticate against
SMTP.<BR>><BR>> That would then point the blame to user tom either being
the spammer, or <BR>> him<BR>> having used a weak and guesable password
that got exploited by a spammer</DIV></BLOCKQUOTE></BODY></HTML>