Sendmail become open relay

Paul Macdonald paul at
Mon Sep 8 14:26:55 UTC 2008

This might be more general advice than a specific help, but i've found 
most bad mail originating from me comes from php driven forum sites.
After originally patching the php src to log sitenames that send mail, i 
found enabling MAILHEAD support in php build adds customs headers which 
help to identify the site anyway.

I plan on adding a milter to pick these up dynamically, but for now, it 
helps identify sites from stuck items in mailq.

i.e a grep into mailq  for X-PHP-Script

/var/spool/mqueue/qfm83AltWj045560:H??X-PHP-Script: for x.101.27.178

Its easy to spot dubious scripts as the ip is commonly the same.

gd luck.

lyd mc wrote:
> Hi guys need help..
> My mailserver become an open relay.
> Unknown user can now send mail.
> snippet from mailq
> m88C8iWq042874      689 Mon Sep  8 20:08 <osxch at>
>                  (Deferred: Name server: host name loo)
>                                          <chenaa00 at>
>                                          < at>
>                                          <chena0877 at>
>                                          <chena0 at>
>                                          <chena11 at>
>                                          <chena121959330 at>
>                                          <chena1238 at>
>                                          <chena186890 at>
>                                          <chena1966 at>
>                                          <chena20155 at>
>                                          <chena226 at>
>                                          <chena22 at>
>                                          <chena26232000 at>
> I don't  have user 'osxch' and there others can also send..
> best regars thnx
> alydio
> _______________________________________________
> freebsd-questions at mailing list
> To unsubscribe, send any mail to "freebsd-questions-unsubscribe at"


<> 	*Ultra fast and secure web hosting
Live and on demand video streaming
Custom online Solutions *

*Paul Macdonald*
paul at <mailto:paul at> <> 	

127 Rose St South Lane, Edinburgh, EH2 4BB


More information about the freebsd-questions mailing list