guimaraes83
09-29-2006, 07:41 AM
I have a lot e-mails in mail queue sent from <> to all kind of weird e-mail adresses. Does that mean my mailserver is being used by a spammer?
How can i find out? I didn't configure my mail server after i installed directadmin.
gbjbaanb
09-29-2006, 02:52 PM
Possibly. Can you check which user sent them? If its the apache user, then it could be due to a webmail form that is hacked. You'd want to check your apache logs for instances of those email address the mail is being sent to to see.
The other thing to check is that the open relay setting is switched off so all users must authenticate before sending.
guimaraes83
09-29-2006, 04:02 PM
Well, it doesn't show a user. At the sender column it only shows "<>".
I guess you are right about the open relay, is there any quick check to see if open relay is enabled on my server?
Justin
09-29-2006, 06:33 PM
is there any quick check to see if open relay is enabled on my server? Easiest method is try sending something through smtp without authenticating or checking through pop3 first. If your mail server lets you send without checking through pop first then it is an open relay and you should take immediate action to resolve that problem (else the spammers may have a field day with your server and get you on alot of blacklists).
Note: As exim out of box uses popb4smtp it shouldn't be a problem and I highly doubt you've got an open relay. The only issue I can see if local problems (sendmail and the like). Your best bet would be to modify exim to smtp auth and disable the use of sendmail (provided you're able to do such without too many clients moaning).