Am Mi, den 21.04.2004 schrieb Mike Rambour um 23:14: > I had already done the grep that was suggested, those 2 lines only show > up once in the maillog (there are others that only show up once also) Does > this mean that the relay was successful ? I sure hope not. And yes the > internal machines are mostly Windows and I did check for viruses and worms. What tells you that these two independent maillog entries were relay attempts? They are incomplete, at least incomplete pasted. If you want to inverstigate you must search the maillog for the queue ID and not the sendmail PID: so search for "MAA01067" and "MAA01214" and not "sendmail[1067]" or "sendmail[1214]". But I am very doubtful that both entries brings you closer to find out about the SPAM coming from your mailhost. As advised by Peter you better ask your ISP for details of the SPAM report. Are you running Apache on the mailserver too? If yes you might have a misusable formmail on it through which foreign people can send SPAM. > One thing I did notice after reading this reply is yes, I can set up a > external SMTP on a Windows machine and go through my firewall and connect > to it, but the internal machines are all using my SMPT server, there are > only 8 internal machines so it was easy to check. I dont think that is how > the SPAM got out, I trust these users. I will go browse the web some more > on viruses and worms to make sure that my tools can catch them, i am using > the latest anti-virus and adaware and stinger. It does not matter how the internal machines are configured using your own Sendmail as relay host. All modern worms are coming with their own STMP engine, being absolutely independent from other MTAs. > I will probably switch to Postfix several people have said it would > easier also. A myth. > mike Again, ask your ISP for details about the SPAM report. Check your Sendmail setup (sendmail.mc and access) - if you like, then send your setup files - and run agains open relay checkers like: http://spamlinks.openrbl.org/tools-relay.htm http://www.abuse.net/relay.html http://www.ordb.org/submit/ Alexander -- Alexander Dalloz | Enger, Germany | GPG key 1024D/ED695653 1999-07-13 Fedora GNU/Linux Core 1 (Yarrow) on Athlon CPU kernel 2.4.22-1.2179.nptl Sirendipity 23:55:15 up 3 days, 6:41, load average: 0.26, 0.20, 0.16 [ ÎÎÏÎÎ Ï'ÎÏÏÎÎ - gnothi seauton ] my life is a planetarium - and you are the stars
Attachment:
signature.asc
Description: Dies ist ein digital signierter Nachrichtenteil
