Re: [vchkpw] How can I identify a spammer?

2004-10-23 Thread Jeremy Kitchen
On Sat, 2004-10-23 at 02:35 -0300, Walter Souto R. Junior wrote: Currently I'm keeping my server open, without the hostname as a parameter to qmail-smtpd. Thats the reason that it worked. If I put the hostaname, nobody can suscefully login and send e-mail, independs on the method used. I

Re: [vchkpw] How can I identify a spammer?

2004-10-23 Thread Jeremy Kitchen
On Fri, 2004-10-22 at 18:57 -0300, Walter Souto R. Junior wrote: Thanks Tom and Jeremy, I do fix my run file for smtp, but now I have a 501 malformed auth input (#5.5.4) using telnet. I'm also trying with Opera with plain, auth and cram-md5 without success. My run file looks like:

Re: [vchkpw] How can I identify a spammer?

2004-10-23 Thread Walter Souto R. Junior
Jeremy, It's a REALLY BAD IDEA to leave your system as an open relay. Please, for the sake of yourself, and the rest of the internet, shut your open relay down. -Jeremy Yes! I shut my open relay off. Now I do relay only for myself and my clients. I figure out the problem with my run file for

Re: [vchkpw] How can I identify a spammer?

2004-10-23 Thread Walter Souto R. Junior
On Sat, 23 Oct 2004 10:22:19 -0500, Jeremy Kitchen [EMAIL PROTECTED] wrote: On Fri, 2004-10-22 at 18:57 -0300, Walter Souto R. Junior wrote: Thanks Tom and Jeremy, I do fix my run file for smtp, but now I have a 501 malformed auth input (#5.5.4) using telnet. I'm also trying with Opera with

Re: [vchkpw] How can I identify a spammer?

2004-10-23 Thread X-Istence
On Oct 23, 2004, at 11:22 AM, Jeremy Kitchen wrote: On Fri, 2004-10-22 at 18:57 -0300, Walter Souto R. Junior wrote: Thanks Tom and Jeremy, I do fix my run file for smtp, but now I have a 501 malformed auth input (#5.5.4) using telnet. I'm also trying with Opera with plain, auth and cram-md5

Re: [vchkpw] How can I identify a spammer?

2004-10-23 Thread Erwin Hoffmann
Hi, At 11:50 23.10.04 -0400, you wrote: On Oct 23, 2004, at 11:22 AM, Jeremy Kitchen wrote: On Fri, 2004-10-22 at 18:57 -0300, Walter Souto R. Junior wrote: Thanks Tom and Jeremy, I do fix my run file for smtp, but now I have a 501 malformed auth input (#5.5.4) using telnet. I'm also

Re: [vchkpw] How can I identify a spammer?

2004-10-23 Thread X-Istence
On Oct 23, 2004, at 4:16 PM, Erwin Hoffmann wrote: This is a very old story. Pls. visit: http://www.fehcom.de/qmail/smtpauth.html Essentially, with all the disturbed discussion, I'ld like to conclude: - Putting the hostname in the call of qmail-smtpd for SMTP Authentication conforms to the use of

[vchkpw] How can I identify a spammer?

2004-10-22 Thread Walter Souto R. Junior
Hi, I have one of my users using my server to send spam (I think). The messages came from 200.78.38.103. When I figure that out, I just block him and bring my server back... So how can I see what account on vpopmail did used to do this kind of thing? I have only auth-smtp, and just accept

RE: [vchkpw] How can I identify a spammer?

2004-10-22 Thread Jeremy Eder
-Original Message- From: Walter Souto R. Junior [mailto:[EMAIL PROTECTED] Sent: Friday, October 22, 2004 7:18 AM To: [EMAIL PROTECTED] Subject: [vchkpw] How can I identify a spammer? Hi, I have one of my users using my server to send spam (I think). The messages came from 200.78.38.103

Re: [vchkpw] How can I identify a spammer?

2004-10-22 Thread Walter Souto R. Junior
Install this http://www.enderunix.org/isoqlog/ Don't forget the cron job to update it's webpages. It reads from qmail logs, so hopefully qmail is logging properly on your box. =) Best Regards, Jeremy Eder Hi-Tek Data, Corp. V: 516-797-8800 F: 516-797-8892 Thanks Jeremy, but the spammer changes

Re: [vchkpw] How can I identify a spammer?

2004-10-22 Thread Jeremy Kitchen
On Friday 22 October 2004 06:17 am, Walter Souto R. Junior wrote: Hi, I have one of my users using my server to send spam (I think). The messages came from 200.78.38.103. When I figure that out, I just block him and bring my server back... So how can I see what account on vpopmail did used

Re: [vchkpw] How can I identify a spammer?

2004-10-22 Thread Walter Souto R. Junior
Hi Jeremy, the smtp auth patch you use should be putting a header in the email saying who sent it.. check for that header, and shut the guy off. This is the first thing that I did try. My server was set 2 years ago and vpopmail version is 5.3.20. I use the toaster guide from Bill Shup and his

Re: [vchkpw] How can I identify a spammer?

2004-10-22 Thread Tom Collins
On Oct 22, 2004, at 8:33 AM, Walter Souto R. Junior wrote: Received: from unknown (HELO meals) ([EMAIL PROTECTED]) by xxx.yyy.zzz with SMTP; 22 Oct 2004 11:46:16 -0200 It looks like he's coming from IP 218.61.42.211, and authenticating as '123'. Do you have a user 123 in your default domain,

Re: [vchkpw] How can I identify a spammer?

2004-10-22 Thread Jeremy Kitchen
On Friday 22 October 2004 10:33 am, Walter Souto R. Junior wrote: Received: (qmail 5098 invoked by uid 1010); 22 Oct 2004 11:46:22 -0200 Received: from [EMAIL PROTECTED] by alonso.bayweb.biz by uid 0 with qmail-scanner-1.22 (clamdscan: 0.74. spamassassin: 2.63. as Tom pointed out, you are

Re: [vchkpw] How can I identify a spammer?

2004-10-22 Thread Walter Souto R. Junior
Thanks Tom and Jeremy, I do fix my run file for smtp, but now I have a 501 malformed auth input (#5.5.4) using telnet. I'm also trying with Opera with plain, auth and cram-md5 without success. My run file looks like: #!/bin/sh LOCAL=`head -1 /var/qmail/control/me` QMAILDUID=`id -u qmaild`

Re: [vchkpw] How can I identify a spammer?

2004-10-22 Thread Tom Collins
On Oct 22, 2004, at 2:57 PM, Walter Souto R. Junior wrote: I do fix my run file for smtp, but now I have a 501 malformed auth input (#5.5.4) using telnet. I'm also trying with Opera with plain, auth and cram-md5 without success. My run file looks like: Well, you need to enter a properly

Re: [vchkpw] How can I identify a spammer?

2004-10-22 Thread Walter Souto R. Junior
Hi Tom, On Oct 22, 2004, at 2:57 PM, Walter Souto R. Junior wrote: I do fix my run file for smtp, but now I have a 501 malformed auth input (#5.5.4) using telnet. I'm also trying with Opera with plain, auth and cram-md5 without success. My run file looks like: Well, you need to enter a