0

The exchange mail server showed that there is a server is sending emails with 17000+ emails in queue. After blocking the server from sending emails, we investigated the outgoing traffic using Wireshark (filter is set to smtp) and there is some traffic on port 25 trying to come out from the server. When a new filtered traffic arrived, netstat -atnp showed that sendmail is sending emails. What causes sendmail to send emails like this? Be advised that there are no crontabs running.

closed as too broad by Rui F Ribeiro, EightBitTony, Stephen Rauch, Satō Katsura, Jeff Schaller Dec 11 '17 at 18:12

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • if you are wise to wireshark you could have investigated the content of the emails. – Rui F Ribeiro Dec 11 '17 at 12:50
  • There are no emails being sent, the system admins blocked the server from sending emails, but sendmail kept sending SMTP commands like EHLO and STARTTLS – 3bdalla Dec 12 '17 at 10:16
  • see the queue, clean it, figure out if they only blocked sending and not receiving and try to use common sense. – Rui F Ribeiro Dec 12 '17 at 10:34
6

sendmail would not send mail by itself. You either have another program running that is using sendmail to send out mail, or you have sendmail listening on a port and relaying mail to outside.

Use mailq to see if you have any mail pending in the queue.

Look at /var/log/maillog to see what log messages are written by sendmail

Try netstat -nlatup|grep sendmail to see which ports sendmail is listening on.

Not the answer you're looking for? Browse other questions tagged or ask your own question.