Re: Help. My system cracked and used to spam
On Thu, Aug 08, 2002 at 11:55:33PM -0400, David Teague wrote:
> It is a stock 2.0 install from CDs with Exim installed and
> setup by the scripts. Nothing particular was done to prevent
> entry. What does "Properly locked down" mean?
I believe someone expounded on this a bit earlier on.
>
> I had some accounts there that may not have had decent
> passwords, but they would have needed root access to
> change the Exim setup, don't you suppose?
>
> I don't know enough to find whether it could have been set up as
> a relay. I do need to understand the spam relay.
>
> I want to stop the spam relay long enough to copy the data to another
> machine (which will have Sarge installed).
Well, one option is to use a crossover cable between the two machines in
question. Another would be to reboot into single user mode, so things
like exim won't get started. Can't remember if you get networking on by
default in single user mode, but /etc/init.d/networking start should do
the trick if it isn't.
>
> I still need references to do some reading so I can understand
> what I need to do to fix things.
A good first step would be to use one of the online services that test
whether you are an open relay. Try googling on open relay test, or
search the list archives, it's definitely come up before. If you are an
open relay, shut down exim and test again. If that fixes it, then you
know that you have an exim config problem, and you can go from there.
- Chris
Reply to: