Eiji, Look in the /var/log/maillog log file. Search for one of the TO addresses that the SPAM is going to. Right after that send to address, there should be a field labeled "ctladdr". This is the "control address" or the sender's address.
If your SPAMMER is using a valid username/password to relay through your server - that "ctladdr" is the username that is being used. It was probably compromised. Change the password and see if it stops. If not, the SPAMMER is using a webmail package - like OpenWebMail. Go to /var/log and look in the log file for that webmail package (/var/log/openwebmail.log for OpenWebMail). Again, do a search for one of the usernames that the servers is sending the SPAM to. In that same line, right behind the sender's IP address, is the username of the sender. Again - change that user's password will probably fix it. If not, block that IP from your server with IPTables and you're done with him. Chuck ---------- Original Message ----------- From: "Eiji Hamano \(bluequartz\)" <[email protected]> To: "BlueOnyx General Mailing List" <[email protected]> Sent: Wed, 4 Aug 2010 13:49:33 +0900 Subject: [BlueOnyx:05160] why emaillog does not contain sender account > Dear > > Someone is sending spam from my onyx server, sometimes. > > endmail[29014]: o5TEpd5D025084: to=<hunayixyay3...@*****.com.br>,...... > > But I don't know the account which send spam. > Why maillog does not contain sender account ? > > Eiji Hamano > > _______________________________________________ > Blueonyx mailing list > [email protected] > http://www.blueonyx.it/mailman/listinfo/blueonyx ------- End of Original Message -------
_______________________________________________ Blueonyx mailing list [email protected] http://www.blueonyx.it/mailman/listinfo/blueonyx
