Sendmail

tgrist · 08-20-2006, 04:01 PM

Linux server running sendmail without any open relay. No domains send mail out via the server at the moment. When I look at the maillog I can see a constant stream of messages being sent to yahoo accounts.

How can I determine what/who is initiating this use of sendmail?

bigrigdriver · 08-20-2006, 04:45 PM

Sounds like someone is using your server as an SMPT relay. Versions of Sendmail before 8.9 allowed that be default. Since the release of 8.9, it has to be specifically allowed. You can find out more here:
http://www.redhat.com/docs/manuals/l...ping-spam.html

tgrist · 08-20-2006, 04:56 PM

Thanks for the reply but we are already running Sendmail version 8.11.6 so the relay should need to be explicit.

The maillog does not seem to give any indication of where the request to send the mail is originating from.

bigrigdriver · 08-20-2006, 06:18 PM

Can you adjust the degree of logging to maillog? As in, make it more verbose, paranoid, etc.?

tgrist · 08-22-2006, 09:58 AM

I have now determined that a particular user has been infected with a trojan causing the sending out of the mail through their account. I have diabled them whilst they clean their system.

I had thought that if no domains were enabled for relaying that they could not relay through their own domains. This appears not to be the case although if trying to smtp this does get blocked