<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 12 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML - vooraf opgemaakt Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Ballontekst Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";
color:black;}
span.E-mailStijl17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.HTML-voorafopgemaaktChar
{mso-style-name:"HTML - vooraf opgemaakt Char";
mso-style-priority:99;
mso-style-link:"HTML - vooraf opgemaakt";
font-family:Consolas;
color:black;}
span.E-mailStijl20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.BallontekstChar
{mso-style-name:"Ballontekst Char";
mso-style-priority:99;
mso-style-link:Ballontekst;
font-family:"Tahoma","sans-serif";
color:black;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body bgcolor=white lang=NL link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Thanx will try that<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal style='margin-left:35.4pt'><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'>Van:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'> blueonyx-bounces@mail.blueonyx.it [mailto:blueonyx-bounces@mail.blueonyx.it] <b>Namens </b>Greg Kuhnert<br><b>Verzonden:</b> vrijdag 6 juli 2012 10:40<br><b>Aan:</b> blueonyx@mail.blueonyx.it<br><b>Onderwerp:</b> [BlueOnyx:10934] Re: server being abused<o:p></o:p></span></p></div></div><p class=MsoNormal style='margin-left:35.4pt'><o:p> </o:p></p><div><p class=MsoNormal style='margin-left:35.4pt'>Hi Steffan.<br><br>On 7/6/2012 4:50 PM, Steffan wrote:<o:p></o:p></p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><p class=MsoNormal style='margin-left:35.4pt'><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Webmail is almost empty so that is not the problem</span><o:p></o:p></p><p class=MsoNormal style='margin-left:35.4pt'><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Is it possible to hack in to a site with httpd </span><o:p></o:p></p><p class=MsoNormal style='margin-left:35.4pt'><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Then use your own script to send out email without </span><o:p></o:p></p><p class=MsoNormal style='margin-left:35.4pt'><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Logging it in to maillog.</span><o:p></o:p></p><p class=MsoNormal style='margin-left:35.4pt'><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal style='margin-left:35.4pt'><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>It looks like it is not a php script, that will be logged in the email log.</span><o:p></o:p></p></blockquote><p class=MsoNormal style='margin-left:35.4pt'><br>Try this:<br><br>watch lsof -n -i tcp:25<br><br>This will update your screen every 2 seconds - reporting running processes that listeners on port 25, or current open connections (both inbound and outbound) on port 25. Look for any process names other than the normal sendmail daemon to get an idea of what is happening.<br><br>Regards,<br>Greg.<br><br><br><br><o:p></o:p></p><p class=MsoNormal style='margin-left:35.4pt'><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal style='margin-left:35.4pt'><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Steffan</span><o:p></o:p></p><p class=MsoNormal style='margin-left:35.4pt'><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal style='margin-left:35.4pt'><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal style='margin-left:70.8pt'><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>Van:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> <a href="mailto:blueonyx-bounces@mail.blueonyx.it">blueonyx-bounces@mail.blueonyx.it</a> [<a href="mailto:blueonyx-bounces@mail.blueonyx.it">mailto:blueonyx-bounces@mail.blueonyx.it</a>] <b>Namens </b>Chuck Tetlow<br><b>Verzonden:</b> donderdag 5 juli 2012 19:25<br><b>Aan:</b> BlueOnyx General Mailing List<br><b>Onderwerp:</b> [BlueOnyx:10932] Re: server beinng abused</span><o:p></o:p></p></div></div><p class=MsoNormal style='margin-left:70.8pt'> <o:p></o:p></p><p class=MsoNormal style='margin-left:70.8pt'>If you're got OpenWebMail or another webmail package - look in its logs. We've had some easy passwords guessed and then the webmail was abused to send out crapola. <br><br><br><br>Chuck <br><br><br><span style='font-size:10.0pt'><br><br><b>---------- Original Message -----------</b> <br>From: "Steffan" <<a href="mailto:general@ziggo.nl">general@ziggo.nl</a>> <br>To: "'BlueOnyx General Mailing List'" <<a href="mailto:blueonyx@mail.blueonyx.it">blueonyx@mail.blueonyx.it</a>> <br>Sent: Thu, 5 Jul 2012 19:12:06 +0200 <br>Subject: [BlueOnyx:10931] server beinng abused <br><br>> Hello, <br>> <br>> I have a server that is getting blacklisted <br>> Spamhaus says it is a email issue <br>> <br>> There is nothing in the logs <br>> Looks like someone is sending emails without the server is logging it <br>> How to find this problem ? <br>> <br>> Cant find any post commands in the httpd log <br>> <br>> Server is 5106 R and has abouth 100 sites <br>> <br>> _______________________________________________ <br>> Blueonyx mailing list <br>> <a href="mailto:Blueonyx@mail.blueonyx.it">Blueonyx@mail.blueonyx.it</a> <br>> <a href="http://mail.blueonyx.it/mailman/listinfo/blueonyx" target="_blank">http://mail.blueonyx.it/mailman/listinfo/blueonyx</a> <br><b>------- End of Original Message -------</b> </span><o:p></o:p></p><p class=MsoNormal style='margin-left:35.4pt'><br><br><br><o:p></o:p></p><pre style='margin-left:35.4pt'>_______________________________________________<o:p></o:p></pre><pre style='margin-left:35.4pt'>Blueonyx mailing list<o:p></o:p></pre><pre style='margin-left:35.4pt'><a href="mailto:Blueonyx@mail.blueonyx.it">Blueonyx@mail.blueonyx.it</a><o:p></o:p></pre><pre style='margin-left:35.4pt'><a href="http://mail.blueonyx.it/mailman/listinfo/blueonyx">http://mail.blueonyx.it/mailman/listinfo/blueonyx</a><o:p></o:p></pre><p class=MsoNormal style='mso-margin-top-alt:0cm;margin-right:0cm;margin-bottom:12.0pt;margin-left:35.4pt'><o:p> </o:p></p></div></body></html>