<HTML>
<HEAD>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<META content="OPENWEBMAIL" name=GENERATOR>
</HEAD>
<BODY bgColor=#ffffff>
<font size="2">Eiji,
<br />
<br />Look in the /var/log/maillog log file. Search for one of the TO addresses that the SPAM is going to. Right after that send to address, there should be a field labeled "ctladdr". This is the "control address" or the sender's address.
<br />
<br />If your SPAMMER is using a valid username/password to relay through your server - that "ctladdr" is the username that is being used. It was probably compromised. Change the password and see if it stops.
<br />
<br />If not, the SPAMMER is using a webmail package - like OpenWebMail. Go to /var/log and look in the log file for that webmail package (/var/log/openwebmail.log for OpenWebMail). Again, do a search for one of the usernames that the servers is sending the SPAM to. In that same line, right behind the sender's IP address, is the username of the sender. Again - change that user's password will probably fix it. If not, block that IP from your server with IPTables and you're done with him.
<br />
<br />
<br />
<br />Chuck
<br />
<br />
<br />
<br /><b>---------- Original Message
-----------</b>
<br />
From: "Eiji Hamano \(bluequartz\)" <bluequartz@hypersys.ne.jp>
<br />
To: "BlueOnyx General Mailing List" <blueonyx@blueonyx.it>
<br />
Sent: Wed, 4 Aug 2010 13:49:33 +0900
<br />
Subject: [BlueOnyx:05160] why emaillog does not contain sender account
<br />
<br />> Dear
<br />>
<br />>
Someone is sending spam from my onyx server, sometimes.
<br />>
<br />>
endmail[29014]: o5TEpd5D025084: to=<hunayixyay3791@*****.com.br>,......
<br />>
<br />>
But I don't know the account which send spam.
<br />>
Why maillog does not contain sender account ?
<br />>
<br />>
Eiji Hamano
<br />>
<br />>
_______________________________________________
<br />>
Blueonyx mailing list
<br />>
Blueonyx@blueonyx.it
<br />>
<a target="_blank" href="http://www.blueonyx.it/mailman/listinfo/blueonyx">http://www.blueonyx.it/mailman/listinfo/blueonyx</a>
<br /><b>------- End of Original Message
-------</b>
<br />
</font>
</BODY>
</HTML>