RE: [toaster] Disturbing Logs

[Peter Maag]

Tom,   Looking through my logs it seems that a number of domains are doing what the original domain address is doing.  In every case the from address(that claims to be from my server) is not a valid address on my server.  It seems that someone has found a way to compromise the catchall setting in vpopmail, as the domains in question all have a catchall mail account.     Does anyone have any idea how this can be stopped while still having catch all support?               Peter   -----Original Message----- From: Tom Collins [mailto:[EMAIL PROTECTED]] Sent: Thursday, May 29, 2003 6:02 PM To: [EMAIL PROTECTED] Subject: Re: [toaster] Disturbing Logs   On Thursday, May 29, 2003, at 05:05 PM, Peter Maag wrote: The message appears to be coming from my server and is being delivered to an external server that is not being hosted by my server. The local account that QMail is claiming the mail is being sent from is not even a valid POP3 account. Try `grep -ri "email.domain.com" /home/vpopmail/domains` (where the address in your log that the message went to is [EMAIL PROTECTED]) to see if the address in question is a forwarding address on any account you host. It is possible that it's a remote catchall, and could get listed in the log that way. -- Tom Collins [EMAIL PROTECTED]