I have a user on my system who appears to be sending large quantities of mail and I'm having difficulty identifying who he is. I don't know his IP address or username by which he authenticated.
One such entry from the syslog is:
root@s2:~# zgrep '2EA87A0CDF' /var/log/syslog.2.gz | more
Jul 28 21:04:32 s2 postfix/pickup[10654]: 2EA87A0CDF: uid=33 from=<callcenter@bdo.com>
Jul 28 21:04:32 s2 postfix/cleanup[11263]: 2EA87A0CDF: message-id=<56a1b0b372c938dfc989c5630be75ac1@www.ourCustomersDomain.com>
Jul 28 21:04:32 s2 postfix/qmgr[2545]: 2EA87A0CDF: from=<callcenter@bdo.com>, size=4808, nrcpt=1 (queue active)
Jul 28 21:04:36 s2 postfix/smtp[11361]: 2EA87A0CDF: to=<mangmkkepweng@yahoo.com>, relay=mta5.am0.yahoodns.net[98.137.159.27]:25, delay=4.4, delays=0.01/0.01/1.2/3.2, dsn=2.0.0, status=sent (250 ok dirdel)
Jul 28 21:04:36 s2 postfix/qmgr[2545]: 2EA87A0CDF: removed
Please note the following:
- I've replaced our customer's domain name with ourCustomersDomain.com.
- bdo.com domain is an external domain not handled by us and appears to be being used as the from address given by our user.
- Because I know the customer's domain what I'm looking for is the actual username being used to gain access.
I can see the UID, which is '33' but it doesn't mean anything to me. How can a match this to the username used?