Re: [vchkpw] How can I identify a spammer?

2004-10-23 Thread X-Istence
On Oct 23, 2004, at 4:16 PM, Erwin Hoffmann wrote: This is a very old story. Pls. visit: http://www.fehcom.de/qmail/smtpauth.html Essentially, with all the disturbed discussion, I'ld like to conclude: - Putting the hostname in the call of qmail-smtpd for SMTP Authentication conforms to the use of

Re: [vchkpw] How can I identify a spammer?

2004-10-23 Thread Erwin Hoffmann
Hi, At 11:50 23.10.04 -0400, you wrote: > >On Oct 23, 2004, at 11:22 AM, Jeremy Kitchen wrote: > >> On Fri, 2004-10-22 at 18:57 -0300, Walter Souto R. Junior wrote: >>> Thanks Tom and Jeremy, >>> >>> I do fix my run file for smtp, but now I have a "501 malformed auth >>> input >>> (#5.5.4)" using

Re: [vchkpw] How can I identify a spammer?

2004-10-23 Thread X-Istence
On Oct 23, 2004, at 11:22 AM, Jeremy Kitchen wrote: On Fri, 2004-10-22 at 18:57 -0300, Walter Souto R. Junior wrote: Thanks Tom and Jeremy, I do fix my run file for smtp, but now I have a "501 malformed auth input (#5.5.4)" using telnet. I'm also trying with Opera with plain, auth and cram-md5 wi

Re: [vchkpw] How can I identify a spammer?

2004-10-23 Thread Walter Souto R. Junior
On Sat, 23 Oct 2004 10:22:19 -0500, Jeremy Kitchen <[EMAIL PROTECTED]> wrote: On Fri, 2004-10-22 at 18:57 -0300, Walter Souto R. Junior wrote: Thanks Tom and Jeremy, I do fix my run file for smtp, but now I have a "501 malformed auth input (#5.5.4)" using telnet. I'm also trying with Opera wit

Re: [vchkpw] How can I identify a spammer?

2004-10-23 Thread Walter Souto R. Junior
Jeremy, It's a REALLY BAD IDEA to leave your system as an open relay. Please, for the sake of yourself, and the rest of the internet, shut your open relay down. -Jeremy Yes! I shut my open relay off. Now I do relay only for myself and my clients. I figure out the problem with my run file for qma

Re: [vchkpw] How can I identify a spammer?

2004-10-23 Thread Jeremy Kitchen
On Fri, 2004-10-22 at 18:57 -0300, Walter Souto R. Junior wrote: > Thanks Tom and Jeremy, > > I do fix my run file for smtp, but now I have a "501 malformed auth input > (#5.5.4)" using telnet. I'm also trying with Opera with plain, auth and > cram-md5 without success. My run file looks like:

Re: [vchkpw] How can I identify a spammer?

2004-10-23 Thread Jeremy Kitchen
On Sat, 2004-10-23 at 02:35 -0300, Walter Souto R. Junior wrote: > Currently I'm keeping my server "open", without the hostname as a > parameter to qmail-smtpd. Thats the reason that it worked. If I put the > hostaname, nobody can suscefully login and send e-mail, independs on the > method us

Re: [vchkpw] How can I identify a spammer?

2004-10-22 Thread Walter Souto R. Junior
Hi Tom, On Oct 22, 2004, at 2:57 PM, Walter Souto R. Junior wrote: I do fix my run file for smtp, but now I have a "501 malformed auth input (#5.5.4)" using telnet. I'm also trying with Opera with plain, auth and cram-md5 without success. My run file looks like: Well, you need to enter a proper

Re: [vchkpw] How can I identify a spammer?

2004-10-22 Thread Tom Collins
On Oct 22, 2004, at 2:57 PM, Walter Souto R. Junior wrote: I do fix my run file for smtp, but now I have a "501 malformed auth input (#5.5.4)" using telnet. I'm also trying with Opera with plain, auth and cram-md5 without success. My run file looks like: Well, you need to enter a properly formatt

Re: [vchkpw] How can I identify a spammer?

2004-10-22 Thread Walter Souto R. Junior
Thanks Tom and Jeremy, I do fix my run file for smtp, but now I have a "501 malformed auth input (#5.5.4)" using telnet. I'm also trying with Opera with plain, auth and cram-md5 without success. My run file looks like: #!/bin/sh LOCAL=`head -1 /var/qmail/control/me` QMAILDUID=`id -u qmaild` NO

Re: [vchkpw] How can I identify a spammer?

2004-10-22 Thread Jeremy Kitchen
On Friday 22 October 2004 10:33 am, Walter Souto R. Junior wrote: > Received: (qmail 5098 invoked by uid 1010); 22 Oct 2004 11:46:22 -0200 > Received: from [EMAIL PROTECTED] by alonso.bayweb.biz by uid 0 > with qmail-scanner-1.22 > (clamdscan: 0.74. spamassassin: 2.63. as Tom pointed out, you a

Re: [vchkpw] How can I identify a spammer?

2004-10-22 Thread Tom Collins
On Oct 22, 2004, at 8:33 AM, Walter Souto R. Junior wrote: Received: from unknown (HELO meals) ([EMAIL PROTECTED]) by xxx.yyy.zzz with SMTP; 22 Oct 2004 11:46:16 -0200 It looks like he's coming from IP 218.61.42.211, and authenticating as '123'. Do you have a user 123 in your default domain, or

Re: [vchkpw] How can I identify a spammer?

2004-10-22 Thread Walter Souto R. Junior
Hi Jeremy, the smtp auth patch you use should be putting a header in the email saying who sent it.. check for that header, and shut the guy off. This is the first thing that I did try. My server was set 2 years ago and vpopmail version is 5.3.20. I use the toaster guide from Bill Shup and his

Re: [vchkpw] How can I identify a spammer?

2004-10-22 Thread Jeremy Kitchen
On Friday 22 October 2004 06:17 am, Walter Souto R. Junior wrote: > Hi, > > I have one of my users using my server to send spam (I think). The > messages came from 200.78.38.103. When I figure that out, I just block him > and bring my server back... So how can I see what account on vpopmail did > u

Re: [vchkpw] How can I identify a spammer?

2004-10-22 Thread Walter Souto R. Junior
Install this http://www.enderunix.org/isoqlog/ Don't forget the cron job to update it's webpages. It reads from qmail logs, so hopefully qmail is logging properly on your box. =) Best Regards, Jeremy Eder Hi-Tek Data, Corp. V: 516-797-8800 F: 516-797-8892 Thanks Jeremy, but the spammer changes your

RE: [vchkpw] How can I identify a spammer?

2004-10-22 Thread Jeremy Eder
-Original Message- From: Walter Souto R. Junior [mailto:[EMAIL PROTECTED] Sent: Friday, October 22, 2004 7:18 AM To: [EMAIL PROTECTED] Subject: [vchkpw] How can I identify a spammer? Hi, I have one of my users using my server to send spam (I think). The messages came from 200.78.38.103.