How to see who is using the mail server?

[Guest justinwyllie]

Someone is using the Postfix mail server on my CentOs 6.4 system to send spam mail.

 

I see this in the log:

 

Jul 5 19:25:45 048582 courier-pop3d: LOGIN, user=info@x.com, ip=[::ffff:nn.nnn.nnn.54], port=[1265]

Jul 5 19:25:57 048582 courier-pop3d: LOGIN, user=info@x.com, ip=[::ffff:nn.nnn.nnn.54], port=[1267]

Jul 5 19:31:52 048582 courier-pop3d: LOGIN, user=info@x.com, ip=[::ffff:nn.nnn.nnn.54], port=[1295]

 

That looks to me like a line saying there has been a successful login for a user 'info@x.com'. Is this right?

 

And, secondly, what are those port numbers? That looks like scanning - but

isn't this the IP and port of the client making the connection?

 

EDIT: Reading up on this a bit. Am I correct in thinking that this is the client trying to establish multiple simultaneous connections by using different ports?

 

Thank-you

 

--Justin Wyllie

 

Continue reading...