Apache spamming localhost

Swakoo · 06-06-2007, 01:26 AM

Hi guys,

I have a series of webserver serving php web content.

Recently my root user account is building up at very fast speed... 500++MB in a matter of 10minutes.

Apparently, I see alot of mail from localhost to postmaster and apache.. which causes bounce back as there are no valid apache mailboxes.

Also, there is one particular legit email (the web application is sending out newsletter occassionally) that seems to have fused with a spam email.

Fused as in, there are 2 subjectline and 2 message body.
Its still received from the localhost.

But otherwise mainly its just the earlier problem I mentioned... localhost/postmaster/apache spamming each other.

q1: Is there anyway I can prevent mails to be send to root user?
q2: is there ways to create user accounts in the server without it having a mail account? I know error messages from cron etc also gets send to mail..

I'm pretty lost as to how I should investigate this problem, so any help would be appreciated

I have currently stop sendmail to prevent root mail account from exploding.

At the same time I realise my maillog are building up to very big size...
One particular line which repeated so often is:

Quote:

Jun 3 06:47:45 web2 sendmail[8668]: l4T3Y4vf005836: to=root, delay=4+09:55:37, xdelay=00:00:09, mailer=local, pri=7017700, dsn=4.0.0, stat=Deferred: local mailer (/usr/bin/procmail) exited with EX_TEMPFAIL

Thanks!

bathory · 06-06-2007, 02:31 AM

Quote:

q1: Is there anyway I can prevent mails to be send to root user?

I think that's not a good practice to prevent mails to root, as many services will send notifications reporting problems etc.

Quote:

q2: is there ways to create user accounts in the server without it having a mail account? I know error messages from cron etc also gets send to mail..

If you want certain cronjobs to not send mail to root then add at the end of that cronjobs the: " /dev/null 2>&1", i.e: edit your crontab for a job you don't want mail to look like this:

Code:

00 01 * * * /path/to/cronjob > /dev/null 2>&1

If you want a user to not receive email then edit /etc/mail/aliases and make an alias for that user to /dev/null, i.e. for apache

Code:

apache: /dev/null

Don't forget to run

Code:

newaliases

for the changes to work.

Regards

Swakoo · 06-06-2007, 08:57 AM

so in my case.. postmaster is sending invalid mails to apache.. which seems to bounce back to root... will the solution work?

Also.. how and what should i investigate what could be causing the problem?

bathory · 06-06-2007, 09:33 AM

If you create the alias from apache to /dev/null, then any mail to apache will be discarded.

Quote:

Also.. how and what should i investigate what could be causing the problem?

Check to see if there are any known issues about the php mailing-list software you use. Perhaps someone is using it to spam.