Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My Ubuntu 8.04 server has been reported for sending spam mails. I can't figure out which program is sending the mail.

Can anyone help me in identifying the unwanted ports in my Ubuntu server?

Here is the list of open ports:

alt text

share|improve this question
up vote 1 down vote accepted

It looks like your email server is properly locked down (Submission and SMTP only listening on localhost). That doesn't help much though. Check the mail logs in /var/log to see if there is anything you don't recognize there. If you are using exim, check /var/log/exim/mainlog or /var/log/exim2/mainlog. The log files all get rotated so you shold use zless to look at the older logs.

My experience blocking spam, is that it is more likely to be a spambot running on a windows box behind the same router.

If you don't need to send Internet email from this server, consider installing shorewall and blocking SMTP outgoing traffic. This will prevent bots on the server from sending email. If you set the block up to log, it will help trace the problem.

EDIT: If you have a router in front of this box consider blocking all outgoing email on it as well. Best spam reduction option is to have only one host behind the network able to send outbound. Configure all your client to submit email to that host. Use the submission port with authentication if possible.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .