Topic: I think my sme is being used to send spam?

[jameswilson]

Im getting funny failed messages.
Im assuming one of the websites on it, or a user account has been compromised.
How can i tell where these mails are originating from?

ie user on smtps or website / ibay, and which one?

Ta
James

[Stefano]

first of all disconnect your SME from wan..
if one (I guess PHP) site has been compromised, you are likely spamming..

[jameswilson]

already done that.

[Stefano]

thank you

how do the site(s) send email? do you use some kind of auth?

I suggest you to create separate users, one for each site..

[byte]

How can i tell where these mails are originating from?

Check the the /var/log/qmail, /var/log/qpsmtpd and /var/log/sqpsmtpd, this will show every mail transaction. Also change the password immediately of all users if you want to be on the safe side.

Can you tell us more ? is it a client workstation ? What version of SME Server are you using ?