Re: Determining if my OpenBSD 3.3 box sent out mails

[Olivier Cherrier <oc@karedas.cediti.be>]

On Fri, Sep 12, 2003 at 01:34:04PM -0700, JLambert@Futurex.com wrote:
> We had an issue at our company last night where our ISP detected a large
> amount of emails coming from our IP address.  I want to make sure this
> wasn't generated by my OpenBSD systems.  Is there something I can check,
> some log or configuration, that will tell me if my system was the offending
> system?  I have checked the maillogs and the messages logs in the /var/log
> directory but didnt see anything overt. 
> 
> My systems are stock OpenBSD3.3 systems with DHCP, NAT, and PF enabled.  I
> have also installed healthd which could email on a problem, but which isn't
> configured to email on any problems.

If you do some NAT for some internal networks, it could be one of these
computer that sent so many emails, depending in your PF rules.
You can try to block such connections or, at least, log them.

-- 
oc - oc@karedas.cediti.be