Hi !!
are you enforcing smt auth for all your users ?
it looks like you are not doing this ... this log
also seems incomplete ... and obfuscated :(
> I'm using Exim 4.63 from backports.org an a Debian system and I've trouble
> with spammers sending mails with my exim server. I already did a relay test
> on abuse.net and they said that my server is at least not a relay. I already
> changed passwords, but spam is still being send with my user. Excerpt from
> the logfile:
>
> 2007-07-28 07:04:17 1IEeTL-0004li-Hs => myuser <myuser@???>
> R=local_user T=mail_spool
> 2007-07-28 07:04:17 1IEeTL-0004li-Hs Completed
> 2007-07-28 07:04:17 1IEeTL-0004lc-6d => myuser <michi@???>
> R=spamcheck_router T=spamcheck
> 2007-07-28 07:04:17 1IEeTL-0004lc-6d Completed
> 2007-07-28 07:12:20 Start queue run: pid=26157
> 2007-07-28 07:12:20 End queue run: pid=26157
> 2007-07-28 07:34:23 1IEewY-0004ga-QN <= <> H=(mforward2.dtag.de)
> [194.25.242.123] P=esmtp S=73282
> id=200707230408.l6N48PPu019592@???
> 2007-07-28 07:34:31 1IEewZ-0004gg-Oy <= <> U=Debian-exim P=spam-scanned
> S=73688 id=200707230408.l6N48PPu019592@???
> 2007-07-28 07:34:31 1IEewZ-0004gg-Oy => myuser <myuser@???>
> R=local_user T=mail_spool
> 2007-07-28 07:34:31 1IEewZ-0004gg-Oy Completed
> 2007-07-28 07:34:31 1IEewY-0004ga-QN => myuser <Kal424@???>
> R=spamcheck_router T=spamcheck
> 2007-07-28 07:34:31 1IEewY-0004ga-QN Completed
> 2007-07-28 07:42:20 Start queue run: pid=28125
> 2007-07-28 07:42:20 End queue run: pid=28125
> 2007-07-28 08:12:20 Start queue run: pid=3273
>
> I replaced my domain with mydomain.com and my user with myuser. I don't know
> who that Kal424 is. No matter, the name changes every time and every 2-3
> hours such a mail is send from my exim server. I also did rootkit checking
> with chkrootkit, but it didn't find anything.
>
> Anyone knows what to do?
>
> Michael
--
Salu-2 y hasta pronto ...
I am Homer of Borg. Prepare to be assim... mmmm, donuts.
----------------------------------------------------------------
David Saez Padros http://www.ols.es
On-Line Services 2000 S.L. e-mail david@???
Pintor Vayreda 1 telf +34 902 50 29 75
08184 Palau-Solita i Plegamans movil +34 670 35 27 53
----------------------------------------------------------------
