Re: [qmailtoaster] Re: Attack?

[David Milholen]

On 06/22/2010 01:43 PM, Eric Shubert wrote: I'm guessing then that they call came from a single submission. ? What are the rest of the messages in the smtp log right after that one? # qmlog -lc anonym...@metalservice smtp will take you right to it in the smtp log. Also, they came from 127.0.0.2. That looks suspicious. Perhaps your apache server has been cracked. I would get rid of the 127.: line in /etc/tcprules.d/tcp.smtp, then # qmailctl cdb Then, in order for squirrelmail to be able to submit, change SM configuration to use authentication by adding this to your /etc/squirrelmail/config_local.php file: $smtpServerAddress  = 'localhost'; $smtpPort           = 587; $smtp_auth_mech     = 'login'; then restart apache: # service httpd restart Eric,  thanks for this one to remind me to do this on the new machine I have. I am still taking notes so if I have to build out again I will not have to rely on my brain LOL  --Dave -- David Milholen Project Engineer 501-318-1300 Wireless Etc