Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have some servers hosting websites and email accounts for clients.

Today we found that one of our servers has a very heavy load and by looking at the maillog it is doing a lot of sending to strange email addresses. It looks like it is sending spam from our server. However, I couldn't find who the sending account is.

How can I find out the sender so that I can close that account down?

Here's an example of one of the outbound emails in the queue:

[root@server11 mqueue]# cat qfp96I9K1r020960
V8
T1317924562
K1318068176
N27
P3934747
I9/3/119387
MDeferred
Fws
$_localhost [127.0.0.1]
$rSMTP
$sUser
${daemon_flags}
${if_addr}127.0.0.1
S
rRFC822; jenners0223@aol.com
RPFD:
rRFC822; jennecho@aol.com
RPFD:
rRFC822; jennebarre@aol.com
RPFD:
rRFC822; jenndum@aol.com
RPFD:
rRFC822; jenncsh@aol.com
RPFD:
MDeferred
rRFC822; jennclemons@cs.com
RPFD:
rRFC822; jennesef@yahoo.com
RPFD:
rRFC822; jennerped@yahoo.com
RPFD:
rRFC822; jenneroutszong@yahoo.com
RPFD:
rRFC822; jennermills@yahoo.com
RPFD:
rRFC822; jennerbeez@yahoo.com
RPFD:
rRFC822; jennerate@yahoo.com
RPFD:
rRFC822; jenner_parker@yahoo.com
RPFD:
rRFC822; jennellsmilie@yahoo.com
RPFD:
rRFC822; jennellehuff@yahoo.com
RPFD:
rRFC822; jennel4eva@yahoo.com
RPFD:
rRFC822; jenneka.gaines@yahoo.com
RPFD:
rRFC822; jennejenkins@yahoo.com
RPFD:
rRFC822; jenneintenn@yahoo.com
RPFD:
rRFC822; jenneekay@yahoo.com
RPFD:
rRFC822; jennean.dickens@yahoo.com
RPFD:
rRFC822; jennduckworth@yahoo.com
RPFD:
rRFC822; jenndooley03@yahoo.com
RPFD:
rRFC822; jenndobscha@yahoo.com
RPFD:
rRFC822; jenndeemartin@yahoo.com
RPFD:
rRFC822; jenndannwill@yahoo.com
RPFD:
rRFC822; jennd926@yahoo.com
RPFD:
rRFC822; jenncummisky@yahoo.com
RPFD:
rRFC822; jenncradduck@yahoo.com
RPFD:
rRFC822; jenncoffin@yahoo.com
RPFD:
rRFC822; jennchrischristopher@yahoo.com
RPFD:
MDeferred
rRFC822; jenncepero@yahoo.com
RPFD:
H?P?Return-Path: 
H??Received: from User (localhost [127.0.0.1])
    by [server name] (8.13.1/8.13.1) with SMTP id p96I9K1r020960;
    Fri, 7 Oct 2011 05:09:22 +1100
H?M?Message-Id: 
H??From: "Match.com"
H??Subject: Your Match Account Has Been Hold - Re-Connect Now
H??Date: Thu, 6 Oct 2011 11:12:59 -0700
H??MIME-Version: 1.0
H??Content-Type: text/html;
    charset="Windows-1251"
H??Content-Transfer-Encoding: 7bit
H??X-Priority: 3
H??X-MSMail-Priority: Normal
H??X-Mailer: Microsoft Outlook Express 6.00.2600.0000
H??X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

Update 1:

Once I cleaned up /var/spool/mqueue folder, it quickly fills up with new spam emails. Once I restarted sendmail service, it stopped filling up with spam emails, but it will come back later on in couple of hours. What does this indicate? Thanks.

share|improve this question
2  
grep "Your Match Account" over user's sites files: Received: from User (localhost [127.0.0.1]) by s11.tel.net.au (8.13.1/8.13.1) with SMTP id p96I9K1r020960; tells me it's local delivery –  Lazy Badger Oct 9 '11 at 4:23
    
And beter will be see and monitor sendmail's log –  Lazy Badger Oct 9 '11 at 4:26
    
Thanks Lazy. I did this: grep -r "Your Match Account" /home/sites/ but returned nothing. –  starchx Oct 12 '11 at 10:09
1  
well, spam sent from your host. grep -i, maybe, "match" or "Windows-1251" ??? Another (ditry hack) solution is temporary intercept all outgoing mail by sending in to smarthost and inspecting texts –  Lazy Badger Oct 12 '11 at 11:14
    
Thanks Lazy. I am doing the grep -i now. Sorry, could you give me more hints on the smarthost solution? I don't really know how to do it. –  starchx Oct 12 '11 at 23:55

1 Answer 1

up vote 2 down vote accepted

Depending on the way your applications are set up, you may be able to see the offending user account by inspect all running processes on the server and see which user account(s) are hogging the CPU. Something like this:

ps -eo pcpu,pid,user,args | sort -k 1 -r | head -10

Hopefully it's as simple as a userspace process that's abusing known privileges and nothing like a rooted box that needs to be wiped down and rebuilt. Ready the flamethrower.

share|improve this answer
    
Hi David, Thanks for this. When I ran that command (without head filter), I only saw: <br/> <pre> 0.0 9063 smmsp sendmail: Queue runner@00:15:00 for /var/spool/clientmqueue</pre><br/> <pre> 0.0 9052 root sendmail: accepting connections </pre><br/> Does that mean our server is not well configured? Thanks –  starchx Oct 10 '11 at 0:59
    
@user67953 Based on that information, I don't think I can make a definitive statement about your servers configuration. It's likely that the spam being sent out is not from a user owned process, but rather from a user submitting mail to a process owned by root. –  Wesley Oct 12 '11 at 5:03
    
Thanks David. Found the issue. Your user processes monitoring was helpful. It was me that didn't notice there was a user running on pop process for hours - I thought was a dead process. Thanks. –  starchx Oct 13 '11 at 0:30
    
@XinChen Great! Glad you found the problem user. =) –  Wesley Oct 13 '11 at 0:54
    
@XinChen Please do not add significant content to other people's posts. Please post it as a comment or as your own Answer. Thank you! –  Chris S Oct 13 '11 at 3:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.