Help Sendmail

[manny_9]

Okay guys! need your help.

sendmail had been previously stopped.
Heres what I did.. service sendmail start.

service sendmail start (ok). I thought everything was okay. tested from a client, was able to send and receive.

went back to box and ran iptraf. then i noticed later iptraf was froze. tried to log in to a different console. i would type root and nothing happened. I could no longer interact with console , what did i do wrong.

the reason sendmail was stopped in the first place was a worm .


help!
thanks

[Steven E. Protter · Accepted solution]

Fred,

sendmail is just going to transmit mail. Unless it runs out of disk space, the worm isn't going to hurt it.

Here are a a few things to check. I just had a problem with sendmail that I triggered with a network change.

service sendmail status

If it says its running all is okay. If it says its dead, you've got a problem.

Take a look at your log file when you start sendmail and watch like this:

tail -f /var/log/maillog

You will be able to watch sendmail go through its death throes. You might want to upload the last few lines of the log. You can take selections from the log and search itrc and find solutions.

My problem today was triggered by network changes.

I had this line in sendmail.mc (the macro file)


DAEMON_OPTIONS(`Port=smtp,Addr=66.92.173.106, Name=MTA')

I moved this IP address to my backup server.

Everything worked great until I restarted the sendmail daemon. Then I started getting errors, like this call.

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x53235fe8b250d71190080090279cd0f9,00.html

There was no solution in this thread, but it made me realize where to look. The minute I saw the bad ip address, I knew what the problem was.

Get me some error codes Fred, and I can help. I've already got the tee-shirt.

SEP

[manny_9]

Thanks Stephen,

I am on my way to work now.

I did read the other thread too!!! quite helpful!

Thanks

[manny_9]

Hey,


the sendmail.cf is empty!!!! why

[Steven E. Protter]

sendmail.cf is probably empty because someone or some process emptied it.

Restore a backup and see if sendmail starts. Follow the diagnostic procedure in my prior post to see if sendmail runs betttr.

Its a good bet the problem you encountered was the empty sendmail.cf As to how it got emptied, start with the .bash_history file.

If you suspect yoru system has been compromised, get it off the network and take precautions.

Are you using a sendmail.mc file to specialize your sendmail.cf? Do you have a good script for building the hash databases and blocking spam?

I'm attaching my script, just in case. This script is Linux only.

SEP

[manny_9]

Thanks Stephen,

I am trying to troubleshoot as you intructed..the problem is when I start sendmail... the box freezes.There is nothing listening at port 25 with sendmail stopped.

etc/mail/sendmail.cf and bak is empty.???

I am having difficulty figuring anything out with sendmail running, I see nothing in bash_history. Could a kill sendmail have done some damage?

[Steven E. Protter]

You can kill sendmail any time you want without hurting things.

outbound mail will queue up.

inbound mail will not be delivered and based on the settings of the sending server may be bounced.

service sendmail status
# just to see what the heck is going on.
service sendmail stop

echo $?

should return zero meaning, you were successful.

service sendmail status

will say stopped.

I'm still having trouble figuring out what happened. Perhaps a manual mistake, zeroing out sendmail.cf

You should be able to copy in an older sendmail.cf or one off another server and at least get sendmail running.

Also:

From that other thread.

If port 25 is froze, lets see if someone grabbed it.

vi /etc/services

see if anything besides mail is on port 25

netstat -an | grep LISTEN | grep 25

See if anything besides sendmail is listening on port 25.

If so, identify the process and kill it.


Also, I've discovered the hard way that ps is different in Red Hat 7.3

ps -efx | grep sendmail

Should show you the process list.
Must be run as root.

When sendmail is actually working, then lets look at the logs.

I have some meetings and work, but I'll try to remember to check back on this. Also, I'll be free later in the evening.

SEP

[manny_9]

Thanks to everyone for their help.

FYI
not sure i understand completely but here it goes.

inflex is the scanner...once inflex's tmp files were deleted sendmail was operational.

there must be a line to add to inflex.cf to delete the tmp. files??

in theory maybe i could have flushed sendmails queue??

I have been unsucessfully searching for examples of inflex's ruleset.

I am currently unable to make any program changes to this box.

was told to work with what i have!


Thanks once again.