RE: [cobalt-users] Email relaying from localhost?

[flash22@xxxxxxx]

On Thu, 21 Feb 2002, Curtis Ross wrote:
> 
> >From httpd  Wed Feb 20 16:28:11 2002
> Return-Path: <httpd>
> Received: (from httpd@localhost)
> by www.myserver.com (8.10.2/8.10.2) id g1KNSA812133;
> Wed, 20 Feb 2002 16:28:10 -0700
> Date: Wed, 20 Feb 2002 16:28:10 -0700
> Message-Id: <200202202328.g1KNSA812133@xxxxxxxxxxxxxxxx>
> 
> Now my question is....how do I stop this guy or anyone else from doing
> this?

By canceling his account ;P

Log what he's doing, he seems to be using the system mailer, based on the
message id, you can log all outbound mail for the httpd user with a one
liner

create /home/httpd/.mailrc
in it put:

set record=/home/httpd/outbound.log

Now all his sent mail (and everyone else sending mail from httpd
user) fill leave a copy in outbound.log

After you get some samples, ask him to leave, otherwise, he's just going
to find some other way to send spam, and you really don't need the
headache, it's not worth it....really

gsh