My Ubuntu 8.04 server has been reported for sending spam mails. I can't figure out which program is sending the mail.
Can anyone help me in identifying the unwanted ports in my Ubuntu server?
Here is the list of open ports:
It looks like your email server is properly locked down (Submission and SMTP only listening on localhost). That doesn't help much though. Check the mail logs in /var/log to see if there is anything you don't recognize there. If you are using exim, check /var/log/exim/mainlog or /var/log/exim2/mainlog. The log files all get rotated so you shold use zless to look at the older logs.
My experience blocking spam, is that it is more likely to be a spambot running on a windows box behind the same router.
If you don't need to send Internet email from this server, consider installing shorewall and blocking SMTP outgoing traffic. This will prevent bots on the server from sending email. If you set the block up to log, it will help trace the problem.
EDIT: If you have a router in front of this box consider blocking all outgoing email on it as well. Best spam reduction option is to have only one host behind the network able to send outbound. Configure all your client to submit email to that host. Use the submission port with authentication if possible.