Re: [cobalt-users] SMTP problems - HELP!

[Kris Dahl <krislists@xxxxxxxxxxxxx>]

on 6/27/00 3:44 PM, Theodore Jones at theoj@xxxxxxxxxxxxx wrote:

> Kris,
> 
> How can one figure out if SMTP is being used/abused on a system then?  What
> are
> the symptoms?

One of the first symptoms (and may be too late at that point) is that you
start receiving angry emails from sysadmins that received SPAM coming from
you machine.

If you want to be pro-active about it, take a look at /var/log/maillog (i
think that is the location on the Cobalt--worse case run located maillog)
Its format is
%DATE   %REMOTE_HOST ...

if you are seeing a lot of remote hosts that you don't know where they came
from you'll want to shut them down--they are using your server.

The best way to do it is to deny all, and then if you absolutely need to,
add a customer's single subnet, domain or ip in the allow relay relay
interface.


-k