From Can someone look at a maillog to see if I am realying someone's m 2

[bkonner]

Hi,

I was hacked the other day. I fixed the problem I hope, but I now know to check my logs more carefully. Any way, I am running a Linux server with Sendmail. Here is a log that I find interesting:

My web server is cantonma.org.

What I don't get is the relay part. Am I relaying this stuff?

Mar 3 08:44:49 cantonma sendmail[25717]: g23DT0L25717: from=<bounce-10-adamse#cantonma.org@bostonherald.publishmail.com>, size=0, class=0, nrcpts=0, proto=SMTP, daemon=MTA, relay=[64.39.30.253]

I also got this one, which may be interesting:

Mar 3 08:46:01 cantonma sendmail[25980]: g23DgFL25980: from=<bounce-11-adamse#cantonma.org@bostonherald.publishmail.com>, size=33872, class=0, nrcpts=1, msgid=<20020303.13003600.bounce-11-adamse#cantonma.org@bostonherald.publishmail.com>, bodytype=8BITMIME, proto=SMTP, daemon=MTA, relay=pm1.publishmail.com [64.39.30.253] (may be forged)

Thanks,

bkonner

 

[Stingreen]

You gotta be kidding me when you said these were sendmail logs,
Server itself is using qmail.
So..?
By the way don't use telnet to administer to your server,
It's like begging to be hacked since it sends the password in clear text, use Secure CRT instead.

 

[DumTech]

Sure looks like Sendmail to me...

bostonherald.publishmail.com, on the other hand, doesn't seem to be running Sendmail...is that where you looked Stingreen?

bkonner, it doesn't look like you're an open relay, at least, judging by a couple of attempts to send mail through your server. [If you see some suspicious log entries from 206.x.x.x, it was benign suspicious behavior.]

The address portion of the log entries does look kinda funny, but I don't think the relay information is saying that you're relaying the message; the IP given is the IP for pm1.publishmail.com, which would probably be correct for the relay to bostonherald.publishmail.com...
Matt
matt@paperlove.org
If I can help, I will.

 

[jad]

if you want to check that you realy ... in any way, you can check by telnet'ing from your mail server to: relay-test.mail-abuse.org ... and they will run a handful of relay tests off you.

it was nice to know that we were reasonably secure by this method.

Jon