I seem to be sending spam
Going through my logs this morning I found that sendmail has been sending out what looks like spam at 8.20 each morning. Sendmail runs once an hour starting at 7.20. The spam is being sent out by two users only.
Here's the set-up. We're a home network connected to the Internet with a WRT54G router connected to a Wimax service. We have a permanent IP. The router is configured to forward HTTP (port 80) and FTP (port 21) to our server, but no other ports. All the machines on the network have 192.168.0.x addresses. The server is running SuSE 9.1, fully patched.
I checked the passwd file on the server and it has an entry that looks like this:
Is that normal?
'ps -A' doesn't show anything I wouldn't expect.
Any idea where I start looking for problems? I can then Google once I know what to start looking for. (I've spent a few hours googling so far, but I'm searching in the dark, so I need some pointers to refine my search).
I've changed the root password, but can't think what else to do for the moment. Any help would be appreciated.