[BlueOnyx:08786] Re: Mail (spam) to apache ans mailer-daemon users

[Charles Bowman]

I think this is something to do with PHP functionality ("mail" user &
SuPHP). But there are probably many other reasons (MailMan, BO admin GUI,
MajorDomo...).

#grep -i apache /etc/mail/virtusertable
[For me] Shows everyone has an entry.

Cheers,
Charles

On 9 October 2011 04:54, Jeff Folk <jfolk at qzoneinc.com> wrote:

> Have one of my servers receiving spam to apache and mailer-daemon users
> that get delivered to the admin mailbox. I'm really confused by this as
> these aren't supposed to be users that can have mail delivered...
>
> How can I start trying to figure this out?
>
> Headers:
> Return-Path: <0-mr.evil-0 at bbdo.at>
> Received: from [213.87.122.251] ([213.87.122.251])
>        by mail.copyzone.net (8.14.4/8.14.4) with ESMTP id p9932EBS006316
>        for <apache at copyzone.net>; Sat, 8 Oct 2011 22:02:15 -0500
> Received: from 213.87.122.251(helo=copyzone.net)
>        by copyzone.net with esmtpa (Exim 4.69)
>        (envelope-from )
>        id 1MMFS5-3160ia-AD
>        for <apache at copyzone.net>; Sun, 9 Oct 2011 07:02:13 +0400
> From: <apache at copyzone.net>
> To: <apache at copyzone.net>
> Subject: Would like to find a partner to enjoy life with
> Date: Sun, 9 Oct 2011 07:02:13 +0400
> MIME-Version: 1.0
> Content-Type: text/plain;
>        charset="Windows-1252"
> Content-Transfer-Encoding: 7bit
> X-Mailer: enxhvoad.08
> Message-ID: <6898956138.UOA2B36R400793 at xyriklieqo.zuxemihbv.va>
>
> Maillog:
> Oct  8 22:02:15 mail sendmail[6316]: p9932EBS006316: from=<
> 0-mr.evil-0 at bbdo.at>, size=1334, class=0, nrcpts=1, msgid=<
> 6898956138.UOA2B36R400793 at xyriklieqo.zuxemihbv.va>, proto=ESMTP,
> daemon=MTA, relay=[213.87.122.251]
> Oct  8 22:02:16 mail sendmail[6317]: p9932EBS006316: to=admin,
> delay=00:00:01, xdelay=00:00:01, mailer=local, pri=31517, dsn=2.0.0,
> stat=Sent
> _______________________________________________
> Blueonyx mailing list
> Blueonyx at mail.blueonyx.it
> http://mail.blueonyx.it/mailman/listinfo/blueonyx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.blueonyx.it/pipermail/blueonyx/attachments/20111009/75e7facf/attachment.html>