Local user repeatedly calling sendmail

cp51 · 03-04-2014, 02:50 PM

Hi all,

I am managing a web/email server and have run into a problem.

My server is running Ubuntu 10.04

It is set up so that the user: web, maintains a set of webpages hosted on the server.

For some reason, periodically throughout the day, the web user calls sendmail and sends an empty message to an email address(not on this server). It is always the same email address, and I know who it is sending to, we just cant figure out why it is doing it.

So far, I have: Changed the web account password, locked the web account, set its shell to /bin/false to prevent sshing.

No one is logged in to the web user.
There are no cron jobs listed by the web user.
If I run: ps aux | grep web, the only thing that web user runs is the periodic sendmail command.

I'm thinking perhaps on some webpage someone has a form that sends an email that is being spammed, but I havent been able to find that yet.

Does anyone have any other insight on what may be causing this, or other places to look to see why the user keeps calling sendmail?

(I cant delete the web user because it handles the webpages...)

Thanks for any help.

Habitual · 03-04-2014, 03:14 PM

Well, you've done some things that should be done is this situation.

Have you

Code:

grep -i *mail* /home/web/* -Rl

or possibly

Code:

find `pwd` /home/web -iname "*.php" -type f -exec grep -i mail

or some variation on those?

also, possibly

Code:

lsof +D /home/web

but this one requires paying a lot of attention as it may "fly by" on the screen, especially if it's a short attempt at sending.

TenTenths · 03-05-2014, 04:08 AM

Some CMS applications (like WordPress) also have a pseudo-cron where access to a web page can set off internal "jobs". Same could be happening if you're using a third-party library within your websites that's set to mail home every so often.

cp51 · 03-14-2014, 12:25 PM

Hi guys,

Thanks for the quick replies. I've been trying to run lsof when the mail is actually being sent, but it has been tricky trying to catch the process in action.

I dont have any CMSs running through the web user so I dont think that would be the problem. But if I am missing something, it should be a pretty routine consistent frequency of emails being sent out right? like equally spaced in time? I just ask because last week, I removed about 30k of these emails from the queue over the course of 3 days. This week, for whatever reason, I have only had about 200 for the whole week, which makes it a little more difficult to investigate.

Thanks for your help, I will keep investigating.

Habitual · 03-14-2014, 02:12 PM

I mistyped this in my reply:
Should be (and still should be checked)

Code:

find `pwd` /home/web_user -iname "*.php" -type f -exec grep -i mail {} \;

Please let us know.