Thanks Rob, I would also like to know what others think on this subject the best way to solve this. P.A > -----Original Message----- P.A > From: squirrelmail-users-bounces@xxxxxxxxxxxxxxxxxxxxx P.A > [mailto:squirrelmail-users-bounces@xxxxxxxxxxxxxxxxxxxxx] On Behalf Of P.A > Rob Wright P.A > Sent: Wednesday, July 02, 2008 1:16 PM P.A > To: squirrelmail-users@xxxxxxxxxxxxxxxxxxxxx P.A > Subject: Re: squirrelmail used for spam P.A > P.A > On Wednesday 02 July 2008 11:38:37 Paul A wrote: P.A > > Hi I'm running a version of squirrelmail by nutsmail.com. I have P.A > Tried P.A > > version, 1.4.10a_NM-9.XPBlueSky and 1.4.13_NM-12.XP_BlueSky. P.A > > What is happening is that foreign ips, especially Nigerian ips are P.A > sending P.A > > spam through squirrelmail. P.A > > P.A > > server versions: P.A > > P.A > > postfix mail_version = 2.2.10 P.A > > Server version: Apache/2.0.52 P.A > > PHP 4.3.9 (cgi) (built: Sep 20 2007 19:31:11 P.A > > P.A > > At 1st I though it was a vulnerable version that I was using but I P.A > have P.A > > used several versions and the same thing happens. I was wondering is P.A > anyone P.A > > here knew how these ips are relaying through my squirrelmail server, P.A > below P.A > > are the logs that I have. Are the spammers using a authenticated P.A > username P.A > > with a weak password, if so how can I determine the username they P.A > are P.A > > using, I'm assuming the easiest way is to look at the queued mail. P.A > > P.A > > I'm just trying to figure out how I can fix this as its becoming a P.A > big P.A > > problem. P.A > P.A > Paul, P.A > P.A > We had the same problem here for a while off and on. We finally P.A > tracked it to P.A > spammers running scripts with stolen or weak passwords and sending a P.A > lot of P.A > mail through squirrelmail, one login/message at a time. We installed a P.A > PHP P.A > Captcha and pretty much solved the problem. P.A > P.A > This may not have been the best solution, but it worked for us. I'd be P.A > interested to see what other suggestions come up. P.A > P.A > Rob Wright P.A > debianrob@xxxxxxxxxxxxx P.A > P.A > ---------------------------------------------------------------------- P.A > --- P.A > Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW! P.A > Studies have shown that voting for your favorite open source project, P.A > along with a healthy diet, reduces your potential for chronic lameness P.A > and boredom. Vote Now at http://www.sourceforge.net/community/cca08 P.A > ----- P.A > squirrelmail-users mailing list P.A > Posting guidelines: http://squirrelmail.org/postingguidelines P.A > List address: squirrelmail-users@xxxxxxxxxxxxxxxxxxxxx P.A > List archives: http://news.gmane.org/gmane.mail.squirrelmail.user P.A > List info (subscribe/unsubscribe/change options): P.A > https://lists.sourceforge.net/lists/listinfo/squirrelmail-users P.A > No virus found in this incoming message. P.A > Checked by AVG. P.A > Version: 8.0.134 / Virus Database: 270.4.3/1528 - Release Date: P.A > 7/1/2008 7:26 AM ------------------------------------------------------------------------- Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW! Studies have shown that voting for your favorite open source project, along with a healthy diet, reduces your potential for chronic lameness and boredom. Vote Now at http://www.sourceforge.net/community/cca08 ----- squirrelmail-users mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: squirrelmail-users@xxxxxxxxxxxxxxxxxxxxx List archives: http://news.gmane.org/gmane.mail.squirrelmail.user List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users
