daily mail "Security-Report"

Fle>< · 12-30-2004, 01:44 PM

Hello,

I was used to check roots mail with the command 'mail'. I got everyday a kind of status report of the system: Who logged in via ssh, errors from vsftpd, what was cron doing,...
Suddenly I receive no mails any longer.
Any ideas why?

regards

Capt_Caveman · 12-30-2004, 11:04 PM

Did you have logwatch installed? It provides a daily summary of important log messages which is then mailed to root. If that was the messages you were seeing, check /etc/cron.daily/ and make sure that a logwatch is in the directory. It should be a link, so do ls -al and make sure that the file it is linked to exists as well (usually is /etc/log.d/scripts/logwatch.pl). Then try sending a message with logwatch by running "logwatch".

Also, take a look and make sure that syslog is running and that log messages are appearing in the system logs. If you don't see anything current, test it by doing: "logger test" and check system log to confirm logging of "test" message occurred.

Fle>< · 12-31-2004, 06:09 AM

yeah, it is logwatch (i remember). i checked out, what you have said, and everything seems to be okay. But I get no mail, if I run logwatch - now I know my problem =). If I run 'logwatch --print', I can see the whole report on stdout.

Capt_Caveman · 12-31-2004, 09:39 AM

So if you run logwatch without any options, it doesn't mail root any messages? Does your local mail system work (try sending mail to root) or is it only a logwatch problem?

Fle>< · 12-31-2004, 10:54 AM

it's a mail problem. i can send mails without errors, but i don't receive mails: 'No mail for root'. I tried to send mails with another user -> same problem.
does anybody know, how I can fix this?

Capt_Caveman · 01-04-2005, 11:37 PM

Any error messages in /var/log/maillog?

Fle>< · 01-05-2005, 11:30 AM

there are a lot...
they are all like this one:

Code:

Dec 26 04:19:44 projekte4 sm-msp-queue[17406]: 
iBQ524nA017175: to=root, ctladdr=root (0/0), delay=00:17:40, 
xdelay=00:03:09, mailer=relay, pri=120042, relay=[127.0.0.1] [127.0.0.1], 
dsn=4.0.0, stat=Deferred: Connection timed out with [127.0.0.1]

if i am right, i'd say, the mailerdaemon is not running. am i right? I've looked for a daemon - i've found sendmail. But I'm not sure, if it is also responsible for receiving mails.

Capt_Caveman · 01-05-2005, 09:15 PM

That error message usually means that sendmail is down/off or your firewall is blocking connections over the loopback interface. However, sendmail should be up if you can send a message. Check with netstat -pant (should see sendmail listening and accepting connections on localhost port 25). Check to make sure that sendmail is running with: ps aux | grep sendmail. Also try restarting the sendmail daemon (service sendmail restart).

Fle>< · 01-06-2005, 09:16 AM

thanks for your help - now I've found my mistake. In my 'delusion of security' I've scanned my box for opened ports. After that I was closing all ports I thought I do not need to be opened. Because of I had no mailserver installed (I thought

), I closed port 25 - smtp using iptables. Now I've opened it again, but only for the localhost.