From owner-freebsd-questions@FreeBSD.ORG  Sun Sep 26 14:41:22 2004
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 7C56D16A4CE
	for <freebsd-questions@freebsd.org>;
	Sun, 26 Sep 2004 14:41:22 +0000 (GMT)
Received: from smtp03.gnvlscdb.sys.nuvox.net (smtp.nuvox.net [64.89.70.9])
	by mx1.FreeBSD.org (Postfix) with ESMTP id EEACB43D55
	for <freebsd-questions@freebsd.org>;
	Sun, 26 Sep 2004 14:41:21 +0000 (GMT)
	(envelope-from joe@jwebmedia.com)
Received: from webmail.nuvox.net (webmail.nuvox.net [64.89.70.59])
	i8QEflwM009420
	for <freebsd-questions@freebsd.org>; Sun, 26 Sep 2004 10:41:47 -0400
Received: from 69.29.89.98
        (authenticated user jkoenig@nuvox.net);
        by webmail.nuvox.net with HTTP;
        Sun, 26 Sep 2004 09:41:20 -0500 (CDT)
Message-ID: <52356.69.29.89.98.1096209680.squirrel@69.29.89.98>
Date: Sun, 26 Sep 2004 09:41:20 -0500 (CDT)
From: "Joseph Koening (jWeb)" <joe@jwebmedia.com>
To: freebsd-questions@freebsd.org
User-Agent: SquirrelMail/1.4.3a-0.e3.1
X-Mailer: SquirrelMail/1.4.3a-0.e3.1
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-Priority: 3 (Normal)
Importance: Normal
Subject: locating origin of spammer
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
Reply-To: joe@jwebmedia.com
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 26 Sep 2004 14:41:22 -0000

I got up this morning and discovered that someone sent some spam through
one of my servers. The messages were sent from the 'www' user on
localhost, which is leading me to think somewhere someone has an insecure
php or perl script that is allowing someone to designate the recipient,
the subject, body, etc. I know the machine is not open-relay (I tested it
to double check) and I checked to make sure no one had actually logged in.
I grepped all of apache's log files looking for sites that received hits
about the same time the mail started going out. What else can I do to find
how the mail is being sent? Thanks,

Joe