On Fri, Apr 10, 2009 at 09:42:21AM +0800, Uwe Dippel wrote: > I'm running postfix as MTA on a machine with several CMS, on a chrooted > Apache. Recently, there is a huge number of spam being sent from there, > alas. When I scan the postfix-logs, all those come from 'root', meaning > they don't come through port 25. I run OpenBSD with mini-sendmail, and > now I wonder how I could find out from which CMS they are sent. Is there > any chance to find out from which CMS they are sent?
It'll take a little bit of effort on your part, but you can compare the time and date in the maillog with the apache logs. It should become apparent very quickly which CMS the spam is coming from as you will see a repeated number of hits in your apache log within close proximity of the times in the maillog.
