Application tries to send mail?

Message

-leliel- · Post by **-leliel-** » Wed Apr 11, 2007 8:01 am

Hi folks,

I set up my box again and everything is all right so far. I thought sSMTP would be a fine method to send my daily system reports etc. so I installed it as well. I can send mails through console and f.e. denyhosts is sending mails as well. But there's one application I configured which attampts to send mails without success:

Apr 11 02:50:01 blackbox cron[22604]: (root) CMD (test -x /usr/sbin/run-crons && /usr/sbin/run-crons )
Apr 11 03:00:01 blackbox cron[22616]: (root) CMD (test -x /usr/sbin/run-crons && /usr/sbin/run-crons )
Apr 11 03:00:01 blackbox cron[22618]: (root) CMD (rm -f /var/spool/cron/lastrun/cron.hourly)
Apr 11 03:00:01 blackbox cron[22621]: (root) CMD (/usr/sbin/chkrootkit)
Apr 11 03:00:03 blackbox sSMTP[22654]: RCPT TO:<me@mydomain.com> (553 <root@blackbox>: Sender address rejected: not owned by user root@l-c-f.net)

Well, I know the mistake and I would like to fix that, but I really don't know what app tries to send these mails?

I checked all crons and chkrootkit, but I can't find anything. It's not even after every cron.hourly. Just sometimes.

Thanks for any help.

JeliJami · Post by **JeliJami** » Wed Apr 11, 2007 11:30 am

the file /etc/rkhunter.conf has an entry

Code: Select all

MAIL-ON-WARNING=me@mydomain

that shows in your logs

change it into your real email address

and you can configure your root destination in /etc/ssmtp/revaliases

-leliel- · Post by **-leliel-** » Thu Apr 12, 2007 12:25 pm

Don't have rkhunter installed.

The problem is not me@mydomain, problem is root@blackbox should be root@l-c-f.net as sender id.

The entry appears every day at about 3 a.m., so it should be in the daily crons, but I can't find anything.

JeliJami · Post by **JeliJami** » Thu Apr 12, 2007 1:05 pm

what's the content of your /etc/ssmpt/revaliases

-leliel- · Post by **-leliel-** » Thu Apr 12, 2007 8:03 pm

root:root@l-c-f.net:customer-smtp.b-one.net:2525

everything should be fine there. In the daily crons is only logrotate, makewhatis and slocate. Is there any way to see daily crons for all users? Maybe there's something in a users crontab?

thanks a lot

-leliel- · Post by **-leliel-** » Tue Apr 17, 2007 1:08 pm

probem still exists.

magic919 · Post by **magic919** » Tue Apr 17, 2007 5:58 pm

Sounds exactly like the cron job at the end of the chkrootkit docs here http://www.gentoo.org/doc/en/security/s ... =printable

Seem you should check root's crontab.