Relaying of spam - Discuss

5 Feb 2006


      Hi, sorry if this isn't the right place to post, but I'm having some 
trouble figuring out a spamming issue. If anyone here can help, that'd 
be amazing.
I'm running Brian's CentOS/BlueQuartz CD, version  3.5 from Nuonce.net. 
Everything seemed to be running fine for several days until this 
morning, when I received a zillion "returned mail" notices from the 
mailer daemon. Within it, it said it was unable to complete sending to 
the following users for various reasons and blah blah blah. That's fine, 
but I never initiated the email.
In my logs, entries like the following shows up ('portal' is the name of 
the box obviously):
Feb  5 12:11:45 portal sendmail[17135]: k15EXFZf015093: SMTP outgoing 
connect on portal.xxxxxxx.com
Feb  5 12:12:51 portal sendmail[17135]: k15EXFZf015093: makeconnection 
(mobilemail.caii-dc.com. [209.135.227.253]) failed: Connection timed out 
with mobilemail.caii-dc.com.
Feb  5 12:12:51 portal sendmail[17135]: k15EXFZf015093: 
to=aldara@caii-dc.com, 
ctladdr=username@portal.xxxxxxxxxxxxxxxxxxxx.com (502/100), 
delay=03:39:35, xdelay=00:01:06, mailer=esmtp, pri=3188891, 
relay=mobilemail.caii-dc.com. [209.135.227.253], dsn=4.0.0, 
stat=Deferred: Connection timed out with mobilemail.caii-dc.com.
Irregardless of the errors, I can't figure out why/where the outbound 
email is being generated. There are many entries in the log like this, 
and I assume alot of it, is going through. The user never initiated it. 
It has to be the server itself?
Plus, it's using the full name of the server which is 
portal.domainname.com in the email address. It seems to only use ONE 
user's name though. AND it's ONLY using 1 user's name from a list of 
several.
The user account gets some spam every now and then with the following 
header info, then these returned emails. These emails are from the local 
server using an account that doesn't exist:
===============================
Subject:
The hottest issue we've seen this year
From:
ThePickOfTheYear2696@domainname.com
Date:
Sun, 5 Feb 2006 08:52:47 -0600
To:
ThePickOfTheYear2696@portal.domainname.com
===============================
Since the "pickoftheyear" account doesn't exist....
Is there any suggestions from the group? I'm a newb at running a mail 
server, just trying to figure out what's going on. The site in question 
did have a couple formmail scripts that I deleted.
I am interested in running chkrootkit but is there a specific package 
required for CentOS/BQ? Or just download and compile?
Thanks.
M