[Tfug] Qmail and Open Relay

[Andrew Ayre]

Jon,

64011 = qmaild
64020 = vpopmail

If it is a contact form would the emails appear with:

  Received: from 202.99.204.66 by h0000000 (envelope-from <>, uid 64011)
with qmail-scanner-1.25st

The IP address 202.99.204.66 is not ours. It appears to be somewhere in
China.

Andy


-----Original Message-----
From: tfug-bounces at tfug.org [mailto:tfug-bounces at tfug.org]On Behalf Of
Jon
Sent: Friday, June 08, 2007 1:40 PM
To: Tucson Free Unix Group
Subject: Re: [Tfug] Qmail and Open Relay


Andrew Ayre wrote:

Who is UID 64020 and 64011? Are those users reserved for the qmail
processes or are they actual users on the box? I'm leaning towards a
form handler that is getting abused.

--
Jon

_______________________________________________
Tucson Free Unix Group - tfug at tfug.org
Subscription Options:
http://www.tfug.org/mailman/listinfo/tfug_tfug.org