LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Closed Thread
  Search this Thread
Old 05-13-2014, 03:43 PM   #1
ilnli
Member
 
Registered: Jul 2004
Location: Pakistan
Distribution: Slackware 10.0, SUSE 9.1, RH 7, 7.3, 8, 9, FC2
Posts: 413

Rep: Reputation: 32
Sendmail problem


Hi,

I'm running Centos 5.7 with the following version of sendmail:

sendmail-cf-8.13.8-8.1.el5_7
sendmail-8.13.8-8.1.el5_7

However recently I noticed that my server stopped sending me emails and then after looking at the log file, I found an unknown relay server which was being used (i.e., mx.b-io.co.):

Code:
May 13 20:37:34 myserverhostname sendmail[17075]: STARTTLS=client, relay=mx.b-io.co., version=TLSv1/SSLv3, verify=FAIL, cipher=AES256-SHA, bits=256/256
May 13 20:37:34 myserverhostname sendmail[17075]: s4DJbYCF017074: to=info@mydomain, delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=30731, relay=mx.b-io.co. [23.21.240.230], dsn=2.0.0, stat=Sent (OK (BF0C1661-70AB-47AF-A02F-9C412FA98805.1))
This is not the relay server that I have in sendmail.cf file, I cannot find why my server is using mx.b-io.co. as a relay and when that changed I've checked all the configuration files and can't find that hostname anywhere but still don't understand why sendmail is using that, does that mean my server is hacked? how can I track down this issue further and how can I fix the relay issue?

Please help!

Thanks in advance
 
Old 05-13-2014, 03:54 PM   #2
MensaWater
LQ Guru
 
Registered: May 2005
Location: Atlanta Georgia USA
Distribution: Redhat (RHEL), CentOS, Fedora, CoreOS, Debian, FreeBSD, HP-UX, Solaris, SCO
Posts: 7,815
Blog Entries: 15

Rep: Reputation: 1662Reputation: 1662Reputation: 1662Reputation: 1662Reputation: 1662Reputation: 1662Reputation: 1662Reputation: 1662Reputation: 1662Reputation: 1662Reputation: 1662
Are you sure the sendmail that is running is using the /etc/mail/sendmail.cf? (That is have you checked to see if possibly the one running isn't the one you think is running.)

Other things can setup different relays. Do you have any *.db files in /etc/mail (e.g smarttable.db).

I mention smarttable because if it is enabled it allows you to use different relays based on the sender domain. (We use smarttable here to direct some email via our MS Exchange relay but for one domain we relay via a separate sendmail server.)

Look in your /usr/share/sendmail-cf directory holds the m4 files for features. The sendmail.mc file (usually in /etc/mail) determines which features are enabled.

This site talks both about smarttable and mailertable that deal with relays:
http://jmaimon.com/sendmail/anfi.homeunix.net/sendmail/
 
Old 05-13-2014, 04:14 PM   #3
ilnli
Member
 
Registered: Jul 2004
Location: Pakistan
Distribution: Slackware 10.0, SUSE 9.1, RH 7, 7.3, 8, 9, FC2
Posts: 413

Original Poster
Rep: Reputation: 32
Hi MensaWater,

Thanks for your reply.

I don't have any smarttable file, so I think I'm not using that:

Code:
root@myserver mail]# find /etc/ | grep -y smarttables
[root@myserver mail]#

I've these feature enabled in sendmail:

Code:
# cat /etc/mail/sendmail.mc  | grep -vy "^dnl"
divert(-1)dnl
include(`/usr/share/sendmail-cf/m4/cf.m4')dnl
VERSIONID(`setup for linux')dnl
OSTYPE(`linux')dnl
define(`confDEF_USER_ID', ``8:12'')dnl
define(`confTO_CONNECT', `1m')dnl
define(`confTRY_NULL_MX_LIST', `True')dnl
define(`confDONT_PROBE_INTERFACES', `True')dnl
define(`PROCMAIL_MAILER_PATH', `/usr/bin/procmail')dnl
define(`ALIAS_FILE', `/etc/aliases')dnl
define(`STATUS_FILE', `/var/log/mail/statistics')dnl
define(`UUCP_MAILER_MAX', `2000000')dnl
define(`confUSERDB_SPEC', `/etc/mail/userdb.db')dnl
define(`confPRIVACY_FLAGS', `authwarnings,novrfy,noexpn,restrictqrun')dnl
define(`confAUTH_OPTIONS', `A')dnl
define(`confTO_IDENT', `0')dnl
FEATURE(`no_default_msa', `dnl')dnl
FEATURE(`smrsh', `/usr/sbin/smrsh')dnl
FEATURE(`mailertable', `hash -o /etc/mail/mailertable.db')dnl
FEATURE(`virtusertable', `hash -o /etc/mail/virtusertable.db')dnl
FEATURE(redirect)dnl
FEATURE(always_add_domain)dnl
FEATURE(use_cw_file)dnl
FEATURE(use_ct_file)dnl
FEATURE(local_procmail, `', `procmail -t -Y -a $h -d $u')dnl
FEATURE(`access_db', `hash -T<TMPF> -o /etc/mail/access.db')dnl
FEATURE(`blacklist_recipients')dnl
EXPOSED_USER(`root')dnl
DAEMON_OPTIONS(`Port=smtp,Addr=127.0.0.1, Name=MTA')dnl
FEATURE(`accept_unresolvable_domains')dnl
LOCAL_DOMAIN(`localhost.localdomain')dnl
MAILER(smtp)dnl
MAILER(procmail)dnl
and this is the relay in sendmail.cf:

Code:
# grep "^DS" /etc/mail/sendmail.cf
DSsmtp.ultrahosting.com
Your help will be very much appreciated.

Thank you again,
 
Old 05-13-2014, 04:17 PM   #4
ilnli
Member
 
Registered: Jul 2004
Location: Pakistan
Distribution: Slackware 10.0, SUSE 9.1, RH 7, 7.3, 8, 9, FC2
Posts: 413

Original Poster
Rep: Reputation: 32
Also I think the sendmail I'm running is using the config file from /etc:

Code:
[root@myserver mail]## strace -e open -f service sendmail restart 2>&1 | grep sendmail
[pid 26222] open("/etc/init.d/sendmail", O_RDONLY|O_LARGEFILE) = 3
[pid 26222] open("/etc/sysconfig/sendmail", O_RDONLY|O_LARGEFILE) = 3
Shutting down sendmail: [pid 26222] open("/var/run/sendmail.pid", O_RDONLY|O_LARGEFILE) = 3
Starting sendmail: Process 26234 attached
[pid 26240] open("/etc/mail/sendmail.cf", O_RDONLY) = 3
[pid 26244] open("/etc/mail/sendmail.cf", O_RDONLY) = 3
[pid 26245] open("/var/run/sendmail.pid", O_WRONLY|O_CREAT|O_EXCL, 0600) = 5
[pid 26247] open("/var/lock/subsys/sendmail", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0666) = 0
 
Old 05-13-2014, 04:23 PM   #5
ilnli
Member
 
Registered: Jul 2004
Location: Pakistan
Distribution: Slackware 10.0, SUSE 9.1, RH 7, 7.3, 8, 9, FC2
Posts: 413

Original Poster
Rep: Reputation: 32
Also, I've noticed, even if I stop sendmail and try to send mail using:

# mail myemail@myserver -s subject
test
.

I still get the following message recorded in /var/log/maillog file is that normal? is my mail client logging that message?

May 13 21:21:37 myserver sendmail[32745]: s4DKLbDn032745: from=root, size=46, class=0, nrcpts=1, msgid=<201405132021.s4DKLbDn032745@myserver>, relay=root@localhost
May 13 21:21:37 myserver sendmail[32745]: s4DKLbDn032745: to=myemail@myserver, ctladdr=root (0/0), delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=30046, relay=[127.0.0.1] [127.0.0.1], dsn=4.0.0, stat=Deferred: Connection refused by [127.0.0.1]
 
Old 05-13-2014, 07:29 PM   #6
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,409
Blog Entries: 55

Rep: Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582
Closed as not compromised / duplicate effort, see https://www.linuxquestions.org/quest...ts-4175504891/ or https://www.linuxquestions.org/quest...5/#post5170309 .
 
  


Closed Thread


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
sendmail.mc and sendmail-cf problem. ChrisScott Linux - Software 1 11-26-2006 02:30 PM
problem with sendmail bijuhpd Linux - Newbie 2 02-26-2005 06:45 AM
I am having a problem with sendmail. mi_xx_nc Linux - Software 1 11-20-2003 09:11 AM
problem processing sendmail.mc to sendmail.cf ...help... lucastic Linux - Networking 1 09-21-2003 11:08 AM
Sendmail problem: sm-client permissions problem d3funct Linux - Software 0 08-12-2003 06:00 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 02:18 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration