From owner-freebsd-questions@FreeBSD.ORG Sun Sep 26 14:54:35 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 2727816A4D1 for ; Sun, 26 Sep 2004 14:54:35 +0000 (GMT) Received: from smtp04.gnvlscdb.sys.nuvox.net (smtp.nuvox.net [64.89.70.9]) by mx1.FreeBSD.org (Postfix) with ESMTP id ADC9043D1F for ; Sun, 26 Sep 2004 14:54:34 +0000 (GMT) (envelope-from joe@jwebmedia.com) Received: from webmail.nuvox.net (webmail.nuvox.net [64.89.70.59]) i8QEt7Yv031589; Sun, 26 Sep 2004 10:55:07 -0400 Received: from 69.29.89.98 (authenticated user jkoenig@nuvox.net); by webmail.nuvox.net with HTTP; Sun, 26 Sep 2004 09:54:32 -0500 (CDT) Message-ID: <52452.69.29.89.98.1096210472.squirrel@69.29.89.98> In-Reply-To: <52356.69.29.89.98.1096209680.squirrel@69.29.89.98> References: <52356.69.29.89.98.1096209680.squirrel@69.29.89.98> Date: Sun, 26 Sep 2004 09:54:32 -0500 (CDT) From: "Joseph Koening (jWeb)" To: joe@jwebmedia.com User-Agent: SquirrelMail/1.4.3a-0.e3.1 X-Mailer: SquirrelMail/1.4.3a-0.e3.1 MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) Importance: Normal cc: freebsd-questions@freebsd.org Subject: Re: locating origin of spammer X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: joe@jwebmedia.com List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 26 Sep 2004 14:54:35 -0000 Right after I posted this I did locate an old version of formmail.pl and disabled it until the customer can replace it with a more secure version. Thanks. > I got up this morning and discovered that someone sent some spam through > one of my servers. The messages were sent from the 'www' user on > localhost, which is leading me to think somewhere someone has an insecure > php or perl script that is allowing someone to designate the recipient, > the subject, body, etc. I know the machine is not open-relay (I tested it > to double check) and I checked to make sure no one had actually logged in. > I grepped all of apache's log files looking for sites that received hits > about the same time the mail started going out. What else can I do to find > how the mail is being sent? Thanks, > > Joe > > _______________________________________________ > freebsd-questions@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to > "freebsd-questions-unsubscribe@freebsd.org" >