sendmail timed out sessions

rahmad · 09-03-2007, 05:53 AM

Hello all,

i have too many sleaping sendmail processes in my server. and the server keeps crash because of this sleaping sendmail processes.

i checked the maillog file i found out there are too many timed out sessions in the file. i tried to telnet thier mail exchangers on port 25 but i could not telnet them, but i can telnet for examp,e google mail exchanger.

can anyone tell me how to know who send to these unworking exchangers or how can i make a script to kill any timed out sendmail process.

thanks,
Rami

unSpawn · 09-04-2007, 04:22 PM

Search for "mail relay test" and see if that rings a bell? Could be your server is being abused for sending spam. In any case it could be helpful to add some log output or find commonality in the messages those threads are trying to handle (non-existent domains, remote MTA refusal and that kind of stuff): see /var/spool/mqueue contents.

rahmad · 09-05-2007, 04:36 AM

thank you sir,

I will read more about the mail test relay actually i didnt use it before, do you know please a tursted and reliable test mail relay that i can use in my test??

in the maillog file i extracted the domains that are their mail exchanger does not work.

what can i benefit of /var/spool/mqueue??

unSpawn · 09-05-2007, 11:54 AM

Quote:

Originally Posted by rahmad

do you know please a tursted and reliable test mail relay that i can use in my test?

If you use a searchengine you'll find many usable ones.

Quote:

Originally Posted by rahmad

what can i benefit of /var/spool/mqueue??

A queued message consists of two parts there: the actual message and a control file. The control file lists timeouts and errors to check.

rahmad · 09-13-2007, 10:27 PM

hi,

i made the mail relay test from web based mail tester, but the result was the remote hosts can not relay thru my MTA only the authorized hosts. the mail queue is normal, i cant check the mail queue when the attack starts because the system goes down.

in the server hosts multiple websites, i suspect the attack might be from one of these local sites. how can i find out the source of local attack??

ur prompt reply is highly appreciated.