Worrying email message from cron

merlininthewood · 10-14-2004, 01:29 PM

I have been receiving emails similar to below from my cron daemon on my RH9 web-server (1and1 root server running ensim):

Quote:

--header--
Return-Path: <root@myserverdomain>
Received: from myserverdomain (root@localhost)
by moretonhampstead.net (8.11.6/8.11.6) with ESMTP id i9EHb3917022
for <root@moretonhampstead.net>; Thu, 14 Oct 2004 18:37:03 +0100
Received: (from root@localhost)
by myserverdomain (8.11.6/8.11.6) id i9EHb1t17009
for root; Thu, 14 Oct 2004 18:37:01 +0100
Date: Thu, 14 Oct 2004 18:37:01 +0100
Message-Id: <200410141737.i9EHb1t17009@myserverdomain>
From: root@myserverdomain (Cron Daemon)
To: root@myserverdomain
Subject: Cron <root@myserverdomain> /usr/lib/opcenter/virtualhosting/MailQueueCleaner
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <HOME=/root>
X-Cron-Env: <PATH=/usr/bin:/bin>
X-Cron-Env: <LOGNAME=root>
--/header--
--body--
affinity... Can't create output
<freiejgxozyhji@cheatcity.com>... User unknown
affinity... Can't create output
savemail: cannot save rejected email anywhere

--/body--

So i did a: grep cheatcity /var/log/maillog
and got

Quote:

Oct 14 12:46:03 p15144987 sendmail[14325]: i9EBk2O14325: from=<freiejgxozyhji@cheatcity.com>, size=3845, class=0, nrcpts=1, msgid=<3niu952irt07$wg43ehe93oad61$319tei9hq0@S9863773>, proto=ESMTP, daemon=MTA, relay=mq-1.v3.com [66.179.230.120]
Oct 14 12:46:03 p15144987 sendmail[14330]: i9EBk3L14330: from=<freiejgxozyhji@cheatcity.com>, size=4067, class=0, nrcpts=1, msgid=<3niu952irt07$wg43ehe93oad61$319tei9hq0@S9863773>, proto=ESMTP, relay=root@localhost
Oct 14 12:46:05 p15144987 sendmail[14331]: i9EBk3L14331: to=<freiejgxozyhji@cheatcity.com>, delay=00:00:02, xdelay=00:00:02, mailer=esmtp, pri=32538, relay=mail.cheatcity.com. [207.44.236.22], dsn=5.7.1, stat=User unknown
Oct 14 13:37:03 p15144987 sendmail[14700]: i9ECb1014700: to=<freiejgxozyhji@cheatcity.com>, delay=00:00:02, xdelay=00:00:02, mailer=esmtp, pri=32538, relay=mail.cheatcity.com. [207.44.236.22], dsn=5.7.1, stat=User unknown
Oct 14 14:38:08 p15144987 sendmail[15218]: i9EDb5I15218: to=<freiejgxozyhji@cheatcity.com>, delay=00:00:01, xdelay=00:00:01, mailer=esmtp, pri=32538, relay=mail.cheatcity.com. [207.44.236.22], dsn=5.7.1, stat=User unknown
Oct 14 15:38:05 p15144987 sendmail[15744]: i9EEb1c15744: to=<freiejgxozyhji@cheatcity.com>, delay=00:00:02, xdelay=00:00:01, mailer=esmtp, pri=32538, relay=mail.cheatcity.com. [207.44.236.22], dsn=5.7.1, stat=User unknown
Oct 14 16:38:05 p15144987 sendmail[16254]: i9EFb1O16254: to=<freiejgxozyhji@cheatcity.com>, delay=00:00:01, xdelay=00:00:01, mailer=esmtp, pri=32538, relay=mail.cheatcity.com. [207.44.236.22], dsn=5.7.1, stat=User unknown
Oct 14 17:37:04 p15144987 sendmail[16652]: i9EGb2f16652: to=<freiejgxozyhji@cheatcity.com>, delay=00:00:01, xdelay=00:00:01, mailer=esmtp, pri=32538, relay=mail.cheatcity.com. [207.44.236.22], dsn=5.7.1, stat=User unknown
Oct 14 18:37:03 p15144987 sendmail[17006]: i9EHb1Y17006: to=<freiejgxozyhji@cheatcity.com>, delay=00:00:02, xdelay=00:00:02, mailer=esmtp, pri=32538, relay=mail.cheatcity.com. [207.44.236.22], dsn=5.7.1, stat=User unknown

I dont know much about the mail system!!
Is this someone using my server to send spam?? Where are they coming from?

The worrying thing is that no-one uses my server for smtp!!

m_shroom · 10-15-2004, 12:17 AM

If you have php running some one may be trying to use the mail(); function in a php script.

merlininthewood · 10-17-2004, 08:50 AM

Good point. I hadn't thought of that. I guess it could be any CGI script (ie perl). Does anyone know how I can find out who and what is trying to send these emails?

m_shroom · 10-17-2004, 02:38 PM

Quote:

Originally posted by merlininthewood
Good point. I hadn't thought of that. I guess it could be any CGI script (ie perl). Does anyone know how I can find out who and what is trying to send these emails?

Try searching your htdocs folder for the string in the to: e-mail address. IE "freiejgxozyhji"
or try searching your htdocs folder for the string "mail("

davidjeanneret · 11-07-2004, 01:47 PM

Did you find a way to solve whatever problem the mailqueuecleaner was coming up with and stop the emails.

I've just started getting the same problem from my server.

David

PS - have you found a 1&1 root server peer support group anywhere - they don't provide anything to help us help ourselves - scum

Cheers

merlininthewood · 11-08-2004, 05:48 AM

I havn't got any closer to solving this problem (not enough time).

I haven't heard of a support group. Maybe we should start an independant one and see if we can get 1and1 to link to it!!

I wonder if LinuxQuestions would be up for hosting a forum??