Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On a webserver, I am seeing unknown processes invoking sendmail like

root      1544  1188  0 03:42 ?        00:00:00 sendmail: ./qBBJ2gNg014264 user open

I have DROPed all SMTP destination ports via iptables. Have confirmed this by seeing SYN_SENT for such connections via netstat.

How can I find / stop / remove these unknown processes running sendmail?

UPDATE: The OP has said that the machine is running Drupal.

share|improve this question

closed as not a real question by mdpc, Ward, Scott Pack, freiheit, Tom O'Connor Dec 17 '12 at 12:03

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

possible duplicate of How do I deal with a compromised server? – Tom O'Connor Dec 17 '12 at 12:03

My best guess is that your machine is running a web server with php and someone has managed to use it in order to send mail from the machine.

share|improve this answer
Yes. It does run Drupal (php)! What can I do to fix it!? – Nishant Dec 16 '12 at 17:53
Added Drupal in the question tags for people who do Drupal may be able to help. – adamo Dec 16 '12 at 18:45

Based from the presented ps clip in your question is processing by sendmail for a specified queued mail entry on your local host -- nothing externally initiated (except for getting a local sendmail message from probably an application program running on the local server, invoked by some website program?).

Thus there is no unknown process here playing around with sendmail based on the information presented in your question.

Did you traceback to the process that invoked sendmail (i.e. process 1188 in this case?).

If you are asking how to stop all sendmail processing, then you could simply remove the sendmail package from your server.

share|improve this answer
yes. I figured that it was some local application program running these. But then, how should I locate such program and probably remove it? All I see is just ./qBBJ2gNg014264 user open – Nishant Dec 16 '12 at 6:59
1188 is sendmail itself. root 1188 1 0 Nov20 ? 00:02:25 sendmail: accepting connections – Nishant Dec 16 '12 at 7:22

Not the answer you're looking for? Browse other questions tagged or ask your own question.