Re: Re: Mail from Apache ?

Quoting Uwe Dippel <[email protected]>:

> On Fri, 20 May 2005 15:48:04 -0500, Ed Wilts wrote:

> 
> >> I'm getting some mails send from the Apache I administer.
> > 
> > Are you sure that they actually came from your system?  It's quite
> > possible that the e-mail was forged from another site.  Check the full
> > e-mail headers before you make any conclusions.
> 
> No, localhost.localdomain and 127.0.0.1
> 
> There is mail sent to more than one address. I am pretty sure, one of my
> users is playing with PHP or so.
> I can find the maillog, but it only says things like :
> 
> sendmail[7929]: j4K28Coa007929: from=apache, size=66, class=0, nrcpts=1,
> msgid=<200505200208.j4K28Coa007929-USlphWUnWDzKNqgsw2TcsiYBQl1e6Axj@public.gmane.org>,
> relay=apache@localhost
> 
> The thing is, there are a good 200 user-ids and I wonder if I can find out
> who is doing this. Just last week I had to lock down one luser running a
> jukebox-business on the Internet. But there, the access-log of course,
> gave her away.
> I couldn't find any way of tracing a specific user here playing
> with mail and that bugs me a bit.
> 
> 
> Uwe
> 
> 
> 
> _______________________________________________
> Tao-discuss mailing list
> [email protected]
> http://mailman.taolinux.org/mailman/listinfo/tao-discuss
> 


How about checking your apache logs, then, for something that happened around
this particular time. It might just give you an IP and what page was being
accessed. Older forms for mail on the web are notorious for bad stuff. If you
have multiple logs for virtual domains, a quick grep of all of them for the time
should let you know which ones to spend time on.

Hope this helps

Steve Campbell


-------------------------------------------------
This mail sent through IMP: http://horde.org/imp/