RE: [cobalt-users] Solarspeed's Spam Filter

["Dan Kriwitsky" <list1@xxxxxxxxxxxxxxxxxxxx>]

> As always Dan and others, you've been quite helpful.
> 
> The 550 has been tested to not be an open relay, so I suspect 
> that that someone hacked in and running a spam script.
> 
> I have telnet turned off, and a pretty good alphanumeric 
> password used for SSH.
> 
> Which is the best log to look into re: 'others' getting into 
> the box and where is it located on a 550?
> 
> What have been the more commonly used spam scripts hackers 
> are installing so I can start the search?
> 

Unless you're seeing tons of action in your maillog, my guess is all
those deferred connections are from before you fixed your relay problem.
I'd wait a couple of days and watch:
tail -f /var/log/maillog to see if there's a lot of mail being sent via
your server. If not, nothing to worry about. Otherwise run top and see
what scripts are running.

-- 
C2003 Dan Kriwitsky

Please reply to the list only. Off list replies are not read.