Thanks Len.. but, What exactly should I search for in the log file? There are multiple messages sent to this user on the system from yesterdays log file. Clearly I am looking for someone whom may have 'logged' into the server using the root account to send email. What does that syntax look like in the log file.
Thanks, Cody ~~~~~~~~~~~~~~~ 817.329.5275 wk 817.329.1189 fx intercityweb.com -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Len Conrad Sent: Friday, December 07, 2001 12:48 PM To: [EMAIL PROTECTED] Subject: Re: [IMail Forum] Possible Mail Relay hack > or is there something else I am missing? your log file, to see the ip of the sending MTA, the envelope sender and recipient. All the other headers should be considered bogus, as they are forgeable. Len http://MenAndMice.com/DNS-training http://BIND8NT.MEIway.com : ISC BIND 8.2.4 for NT4 & W2K http://IMGate.MEIway.com : Build free, hi-perf, anti-abuse mail gateways Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
