Re: [cobalt-users] Mail Bomb ... I'm stumped

[Ursula <ursulasays@xxxxxxxxxxxx>]

 --- Gerald Waugh <gwaugh@xxxxxxxxxxxxxxxxxxxxxxx>
wrote: > On Thursday 21 November 2002 21:24, Ursula
wrote:
> > We've had a couple of strange incidents on a 4i.
> They
> > appear to be deliberate mail bombs, but appear to
> be
> > generated by httpd rather than coming from the
> > outside.
> 
> Guess! - Is someone running FormMail on your server?
> 

That was my first thought.

I'm familiar with the Formmail tricks, and I know what
it looks like in the access logs. Nothing relating to
it at all is appearing in the log. If formail (or
anything else) was being run at the time it would have
showed up in the access log. The access log shows
nothing at all executable (pl, cgi, php or asp) at the
time the first email arrived, so I don't see how
formmail can be the problem in this case.




=====

--

Ursula


http://www.yahoo.promo.com.au/hint/ - Yahoo! Hint Dropper
- Avoid getting hideous gifts this Christmas with Yahoo! Hint Dropper!