Re: Mail from Apache ?

On Fri, 20 May 2005 15:48:04 -0500, Ed Wilts wrote:

>> I'm getting some mails send from the Apache I administer.
> 
> Are you sure that they actually came from your system?  It's quite
> possible that the e-mail was forged from another site.  Check the full
> e-mail headers before you make any conclusions.

No, localhost.localdomain and 127.0.0.1

There is mail sent to more than one address. I am pretty sure, one of my
users is playing with PHP or so.
I can find the maillog, but it only says things like :

sendmail[7929]: j4K28Coa007929: from=apache, size=66, class=0, nrcpts=1,
msgid=<200505200208.j4K28Coa007929-USlphWUnWDzKNqgsw2TcsiYBQl1e6Axj@public.gmane.org>,
relay=apache@localhost

The thing is, there are a good 200 user-ids and I wonder if I can find out
who is doing this. Just last week I had to lock down one luser running a
jukebox-business on the Internet. But there, the access-log of course,
gave her away.
I couldn't find any way of tracing a specific user here playing
with mail and that bugs me a bit.


Uwe