[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[cobalt-security] Spam Users



I got some probmlem on one of my cobalts
When y do a ps x | grep sendmail, they show me a lots of users conected and
sending mail from my own server like u could see below.

How can i stop this use from remote users?
Doing the same in another raq, this not happen'


[root admin]# ps x | grep sendmail
21965 ?        S      0:13 sendmail: accepting connections
21968 ?        S      0:00 /usr/sbin/sendmail -q15m
24826 ?        S      0:00 sendmail: q1/g7R2MFZ11795 uctem.cl.: user open
13760 ?        S      0:00 sendmail: q1/g7QN3n028095 compugraph.com.: user
open
18055 ?        S      0:00 sendmail: q1/g7QKpE015291 nomail.o0o.net.: user
open
18728 ?        S      0:00 sendmail: q1/g7QN3a028055 bedfordnet.com.: user
open
19519 ?        S      0:00 sendmail: q1/g7SAhRr03928 neunet.com.: user open
22239 ?        S      0:00 sendmail: q1/g7QLh9020253 mail.cwi.net.: user
open
23134 ?        S      0:00 sendmail: q1/g7QM7v022467 mail.cwi.net.: user
open
24066 ?        S      0:00 sendmail: q1/g7QDv0012340 bedfordnet.com.: user
open
24863 ?        S      0:00 sendmail: q1/g7QD0P007842 10.0.0.1.: user open
25637 ?        S      0:00 sendmail: q1/g7QD9W008548 bedfordnet.com.: user
open
26493 ?        S      0:00 sendmail: q1/g7QDKm009457 mail.cwi.net.: user
open
27293 ?        S      0:00 sendmail: q3/g7S1Zb924974 chilesite.com.: user
open
28218 ?        S      0:00 sendmail: q1/g7REkc027549 bbs.pinos.com.: user
open
29378 ?        S      0:00 sendmail: q1/g7SJcir22287 mta2-mail.england.com.:
use
30690 ?        S      0:00 sendmail: q1/g7SJV9r21587 mta2-mail.england.com.:
use
31810 ?        S      0:00 sendmail: q1/g7V2dFZ14954
mail.eroticmailcenter.com.:
31811 ?        S      0:00 sendmail: q2/g7V6d6G29464
smtp.sbs-promotion.co.jp.:
32483 pts/1    S      0:00 grep sendmail