Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There's lots of sh: 1: /usr/sbin/sendmail: not found in my apache2 error.log, the problem is, I don't recall any of my site/apps trying to send mails or whatever, and I've already installed WP Mail SMTP on my wordpress blogs, which works all right, so my problem is, how do I find out which app or site is trying to do this all the time?

Edit: I did find interesting lines in /var/log/mail.log:

Jun 22 07:27:31 sm-mta[29654]: r5H8U4O1014238: to=<you@yourdomain.com>, ctladdr=<www-data@xxxx@xxxx.net> (33/33), delay=4+22:57:27, xdelay=00:00:01, mailer=esmtp, pri=63391559, relay=mx00.1and1.com. [74.208.5.3], dsn=4.0.0, stat=Deferred: 421 invalid sender domain.

I've already followed instructions to completely uninstall any mailer apps on my server like this:

apt-get remove sendmail sendmail-bin postfix
apt-get purge postfix exim4 sendmail sendmail-bin

Those annoying lines are still showing up every now and then, what do I do now?

Thanks, Shane

share|improve this question

Then this is abuse attempts for sending out spam emails.

Grep your logs for POST requests and you will find which PHP script are abused pretty fast.

e.g:

grep -R POST /var/log/apache2

UPDATE maybe your sendmail is still running?
check with:

ps auxww | grep sendmail

also

netstat -anp |grep :25

You can find the pid number of a still running daemon.

share|improve this answer
    
Unfortunately, I couldn't find any PHP script doing such POST request. But I did find something interesting in /var/log/mail.log: Jun 22 07:27:31 sm-mta[29654]: r5H8U4O1014238: to=<you@yourdomain.com>, ctladdr=<www-data@xxxx@xxxx.net> (33/33), delay=4+22:57:27, xdelay=00:00:01, mailer=esmtp, pri=63391559, relay=mx00.1and1.com. [74.208.5.3], dsn=4.0.0, stat=Deferred: 421 invalid sender domain , I've already completely uninstalled sendmail/postfix/sendmail-bin/exim4, how come such stuff still popping up in my logs? – Shane Jun 22 '13 at 7:39

You can make fake sendmail which logs what is the message. Maybe the content of the message helps you figure this out.

Another option (in case when app does not use sendmail but try to connect to port 25) is to make a fake mail server like: python -m smtpd -n -c DebuggingServer localhost:25 and catch all stuff.

share|improve this answer

This is a known issue if you are using Drupal and SMTP module

https://www.drupal.org/node/1078106

share|improve this answer
1  
can you provide a reference to this bug in a bug tracker or blog? – chicks May 23 at 0:13
    
I added the link – Frode Stenstrøm May 29 at 8:36
1  
Thanks and welcome to Server Fault. – chicks May 29 at 13:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.