Hello again people,
> At this point, I suspect this has nothing to do with assp
> and this guy has managed to compromise the mailboxes'
> security.
> Also, at this point in time, I took away the account that
> does all
> this in hope that it will stop whitelisting spam
> addresses.
> Still investigating . . .
Looks like I am in the right tracks.
The whole mess was created by a drop-list account that I was
silly enough to give it the same password as its account name.
(Whooops !)
Thinking that because of the fact that this is a drop-list and for
simplicity reasons, it wouldn't be much of a problem to give it a
standard password, with the same characters as the ones used for
the drop-list account name. However, it seems that there _is_ a
problem with this and here I am now. . .
Anyway. The strangest of things happens now on ASSP.
Be taking away (deleting) the problematic account, one would think
that it would stop spewing spam, however :
-------------------------------------------------------------------
Feb-26-11 05:18:50 90322-03915 110.83.53.58 <account_that_...@deleted.gr> to:
zhangfan101...@126.com whitelist addition: 570660...@qq.com;
Feb-26-11 05:18:50 90322-03915 110.83.53.58 <account_that_...@deleted.gr> to:
zhangfan101...@126.com whitelist addition: jk...@163.com;
Feb-26-11 05:18:50 90322-03915 110.83.53.58 <account_that_...@deleted.gr> to:
zhangfan101...@126.com whitelist addition: h...@federal.com.cn;
Feb-26-11 05:18:50 90322-03915 110.83.53.58 <account_that_...@deleted.gr> to:
zhangfan101...@126.com whitelist addition: mrh...@gmail.com;
Feb-26-11 05:18:50 90322-03915 110.83.53.58 <account_that_...@deleted.gr> to:
zhangfan101...@126.com whitelist addition: bj_...@126.com;
Feb-26-11 05:18:50 90322-03915 110.83.53.58 <account_that_...@deleted.gr> to:
zhangfan101...@126.com whitelist addition: zhangfan101...@126.com;
Feb-26-11 05:18:50 90322-03915 110.83.53.58 <account_that_...@deleted.gr> to:
zhangfan101...@126.com whitelist addition: liankaiwang2...@126.com;
Feb-26-11 05:18:50 90322-03915 110.83.53.58 <account_that_...@deleted.gr> to:
zhangfan101...@126.com whitelist addition: gaochenxint...@163.com;
Feb-26-11 05:18:50 90322-03915 110.83.53.58 <account_that_...@deleted.gr> to:
zhangfan101...@126.com whitelist addition: lishu1...@163.comq;
Feb-26-11 05:18:50 90322-03915 110.83.53.58 <account_that_...@deleted.gr> to:
zhangfan101...@126.com whitelist addition: a...@263.net;
Feb-26-11 05:18:50 90322-03915 110.83.53.58 <account_that_...@deleted.gr> to:
zhangfan101...@126.com whitelist addition: 339790...@qq.com;
Feb-26-11 05:18:51 90322-03915 [Local] 110.83.53.58
<account_that_...@deleted.gr> to: zhangfan101...@126.com local -- authenticated
-- [] -> notspam/3915.eml;
-------------------------------------------------------------------
Someone is still sending crap from an account that no longer exists
on the system.
Don't know what else to do. I've restarted the mail server.
However I didn't restart assp. I am doing it now.
Any ideas ?
Thank you all for your contribution and ideas,
Best Regards,
spyros
----
"I merely function as a channel that filters
music through the chaos of noise"
- Vangelis
------------------------------------------------------------------------------
Free Software Download: Index, Search & Analyze Logs and other IT data in
Real-Time with Splunk. Collect, index and harness all the fast moving IT data
generated by your applications, servers and devices whether physical, virtual
or in the cloud. Deliver compliance at lower cost and gain new business
insights. http://p.sf.net/sfu/splunk-dev2dev
_______________________________________________
Assp-test mailing list
Assp-test@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/assp-test
