Topic: suspect e-mails

[Joel Thompson]

Hello.

Today i added the "admin" account to my Outlook.

By some reason i found too many (over 100 over 3 months) mails from my "MAILER-DAEMON". These are messages to notify me that messages wasn't recieved (or sent? Don't know...).

Anyway, this worries me. Maybe someone are using my server to send e-mails or something similar. ("Hacked the server.") I have a feeling that this is only the messages that arent recieved. My guess is that there is a whole lot more mail going throu my server.

Can anyone take a quick look at the messages, and tell me what this all means, and maybe what i shall do. http://www.univi.com/doc the messages are named 1 to 8 in plain text.

Is there any way off stopping messages from my server, see the messages sent from the server and see who is sending them (its no one on the local network)?

Hope someone can help me.

Regards,
Joel Thompson.

[Bill Talcott]

Joel Thompson wrote:
>
> Hi. This is the qmail-send program at univi.com.
> I tried to deliver a bounce message to this address, but the bounce bounced!

Double bounce. Your server tried to bounce a bad email, but the address was faked so the bounce notice bounced back to you. It's doing exactly what it's supposed to, letting the admin of the server know that the error message didn't go through. Search for "double bounce" if you want to change the related server settings.

> Anyway, this worries me. Maybe someone are using my server to
> send e-mails or something similar. ("Hacked the server.") I
> have a feeling that this is only the messages that arent
> recieved. My guess is that there is a whole lot more mail
> going throu my server.

Unless you've changed the settings yourself, nobody outside your local LAN can access your SMTP server. If you do need to open it up for outside access, use Damien Curtain's SASL contrib for 5.5 and newer, or Nathan Fowler's pop-before-smtp script for 5.1.2 and older. These allow access to the SMTP server for validated users (well, kinda, in Nathan's case, but secure enough for most people) but not the general public. You can check the access logs to make sure nobody else has been using your server though, if you're that worried about it.