Koozali.org: home of the SME Server

Legacy Forums => Experienced User Forum => Topic started by: glindsay on April 15, 2004, 11:36:07 PM

Title: Am I hacked?
Post by: glindsay on April 15, 2004, 11:36:07 PM

I've been looking through my logs lately and noticed some things that look to me rather suspicious.  But I may be reading them incorrectly.

I have checked to see if I'm open as a relay agent but that proved false.

My question is: Which log file analysis report should I look at to see if someone is using me to send spam?

And what in that report should I be looking for?

Thank you.
-garrett

Title: Am I hacked?
Post by: NickR on April 16, 2004, 10:56:53 PM

Run iptraf from the console & get it to log activity on eth1 (or whatever the external interface is).  Leave to to log for a few hours & examine log.

Title: Am I hacked?
Post by: RavenIV on April 16, 2004, 11:42:17 PM

i you left your SME to standard, you are not an open relay.

cheers klaus