Re: [exim] Am I Hacked?

Christoph Purrucker wrote:
> Hi Rick,
>
>
>>The only active net services
>>are exim and apache.
>
>
> do you have any contact-forms on this server, which could be abused by
> spammers?

Negative. No forms-based pages under apache. Was
running a simple Java servlet as a display aide on
one set of pages, but that broke when I did the
system upgrade (probably need to rebuild a .so
file). If the servlet was the problem, breaking
it should have 'fixed' the hypothetical spam problem.
The activity report for today looks similar to
yesterday, just slightly more activity.

If I do have a problem (yet to be confirmed) my gut
feel says it is some exim capability that is being
abused. Maybe some kind of email virus that triggers
spamming from an exim system to a list of address it
carries along with it. My server has no address lists
to compromise that I am aware of. My address lists
are all on my email client (Mozilla), which is on a
separate Linux system on my intranet. I'm pretty sure
that one is not being hacked.

--
Rick Lutowski, GRI, REALTOR
Greg Doering & Associates
Keller Williams Realty
rick@???
512-461-1456
I Reward Referrals