<html>
At 20:48 08/11/2011 +0000, you wrote:<br><br>
<br>
<blockquote type=cite class=cite cite>On 8 November 2011 19:47, John
Craven <<a href="mailto:jc@ukzone.com">jc@ukzone.com</a>> wrote:
<dl>
<dd>At 19:41 08/11/2011 +0000, you wrote:<br><br>
<br><br>
<blockquote type=cite class=cite cite>
<dd>On 8 November 2011 19:29, John Craven
<<a href="mailto:jc@ukzone.com">jc@ukzone.com</a>> wrote:
<dd>At 19:24 08/11/2011 +0000, you wrote:
<dd>John,<br><br>
<br><br>
<br><br>
<dd>>I have been notified that a spammer is sending mail through my
server.
<dd>>I need help in finding out how this is happening.
</dl><br>
My server is running centos 5<br>
hth...
<dl>
<dd>First do your logs show evidence that these spams are originating
from
<dd>your system or being relayed by your system?
</dl><br>
I don't know where to look ????<br>
It has been suggested that I check my auth log, but I don't seem to have
one.
<dl>
<dd>Have you seen any blowback? If you are being spoofed (or
otherwise)
</dl><br>
No. I haven't had any returned mail.
<dl>
<dd>you are very likely to see many non-delivery reports.<br><br>
<dd>Do you have a sample of an offending e-mail with the full headers?
</dl><br>
Email in previous email. Obviously "crossed in post".
<dl>
<dd>What mailer (MTA) are you running? exim, sendmail?
</dl><br>
I'm running SENDMAIL
<dl>
<dd>Andrew
</dl><br><br>
At first look that looks like it's coming from a script. Where is your
website located?</blockquote><br>
The server is located in Preston, Lancashire.<br><br>
I do run lots of scripts on the server, for different web sites
(clients).<br>
Is there any way of identifying what kind of script, or better still,
which script.<br><br>
<br>
Actually I meant a URL ;)<br><br>
Client sites are difficult, but you can search the code for mail()
functions if it's php.</blockquote><br>
How would I do this ???<br><br>
<br>
<blockquote type=cite class=cite cite>You might also be able to check
your sendmail logs for activity. Who manages the server?<br><br>
s/</blockquote><br>
Sorry for misunderstanding.<br><br>
I manage the server and I have around 30 web sites hosted of which I
created around 15 of them.<br>
My sendmail logs are very active since all the sites have their email on
my server.<br>
It would help if I knew what the times were that the offending email was
sent.<br>
Is there any way of identifying this info ???<br><br>
John C<br><br>
<br><br>
<br><br>
<blockquote type=cite class=cite cite>-- <br>
Twitter: @sfgreenwood<br>
"post-apocalyptic allen keys"<br>
</blockquote>
<x-sigsep><p></x-sigsep>
=================================================<br><br>
Check out our British Country Music Web Sites <br><br>
<x-tab> </x-tab><a href="http://www.countrymusic.org.uk/" eudora="autourl">http://www.countrymusic.org.uk<br>
</a><x-tab> </x-tab><a href="http://www.bcmi-radio.co.uk/" eudora="autourl">http://www.bcmi-radio.co.uk<br>
</a><x-tab> </x-tab><br>
Over 300,000 visitors a week<br><br>
=================================================</html>