dman <dsh8290@???> writes:
> --
> On Sun, May 05, 2002 at 11:09:12PM -0400, Tomasz Kosinski wrote:
> | I am using exim 3.32, Debian woody/testing.
> |
> | I have been using exim and fetchmail for about six months on a mostly
> | single user machine with a dial-up connection. For some reason, about
> | ten days ago, I stopped being able to send out mail.
>
> How much do you usually dial-up? Do you usually stay connected for
> long?
>
Until recently yes, sometimes for days. However, my machine won't stay
connected for more than a couple of hours at a time for the last few weeks.
>
> | 8.) One or two days pass by while I try to figure this out, when all
> | of a sudden there are 83 new junk mail message in the queue. If I
> | try to check out with -Mvh where they are coming from, I get, for
> | example:
> |
> | sanmarco:# exim -Mvh 173w7f-0001KG-00
> ...
> | mail 8 8
> ...
> | -received_protocol local
> ...
> | 147P Received: from mail by localhost with local (Exim 3.32 #1 (Debian))
>
> Some locally running process with uid 8 and gid 8 (mail/mail) and
> piped a message to exim. This means there is a hole on your system
> somewhere and at least one spammer is aware of it and is exploiting
> it.
>
> | 068 X-Failed-Recipients: 395=217.10.172.50=65.90.116.84=@[65.90.116.84]
> ^^^^^^^^^^^^
> Was that your IP at that time? It is blacklisted in several DNSBLs.
No
>
> | It appears that the first (the junk) is generated by a user or group
> | named "mail", how, I don't understand, but...
>
> A common cause is having the formmail.pl script on your webserver. It
> is easy to send a packaged HTTP request to it to make it send mail out
> through your system.
>
I don't have a webserver on my machine, I'll try to see if the formmail
script is somewhere else on my system, by chance. Is it strange that the
mails should be generated sporadically, I don't know the pattern, but
maybe every 36-48 hours, and, to now, in limited quantities (one
hundred, not one thousand)
>
> HTH, -D
>
Thanks very much for your help -
Tomasz
