I am running a RH9 server with Apache/PHP/MySql using postfix and have a few email enabled applications using very simple php forms.

However, for some time we have been getting the following in the maillog:

Oct 24 17:16:21 www postfix/pickup[18079]: 086C15045A: uid=48 from=<apache>
Oct 24 17:16:21 www postfix/cleanup[18572]: 086C15045A: message-id=<20061024211621.086C15045A@spweb.someplace.edu>
Oct 24 17:16:21 www postfix/pickup[18079]: warning: maildrop/00BC311C312: No recipients specified
Oct 24 17:16:21 www postfix/pickup[18079]: 0B3975045A: uid=48 from=<apache>
Oct 24 17:16:21 www postfix/cleanup[18572]: 0B3975045A: message-id=<20061024211620.0B3975045A@spweb.someplace.vt.edu>
Oct 24 17:16:21 www postfix/pickup[18079]: warning: maildrop/EA9BC11C30B: No recipients specified
Oct 24 17:16:21 www postfix/pickup[18079]: 29B045045A: uid=48 from=<apache>
Oct 24 17:16:21 www postfix/cleanup[18574]: 29B045045A: message-id=<20061024211621.29B045045A@spweb.someplace.vt.edu>
Oct 24 17:16:21 www postfix/pickup[18079]: warning: maildrop/00BC311C312: No recipients specified

The user apache should not be sending email to anyone.

The rate is variable but seems to be increasing lately. I'd like to find out what we have mis-configured. Got any ideas?

Ron

Is spweb.someplace.vt.edu a domain you actually send to? Appears to me some kiddie scriptors trying to use your simple php forms to send spam, looking for exploits or an accessible MTA to send their unwanted trash.

spweb.someplace.vt.edu is the hostname of the webserver which is running postfix.

Okay, so that makes sense. I would assume what I mentioned before, spammers attempting to exploit your online php mail form scripts. Either trust your code has zero security holes in it or setup a firewall and start blocking the culprits.