Fedora Linux Support Community & Resources Center
  #1  
Old 23rd May 2012, 11:00 AM
glennzo Offline
Un-Retired Administrator
 
Join Date: Mar 2004
Location: Salem, Mass USA
Age: 57
Posts: 14,673
linuxfirefox
Why, why, why do I get ALL of this mail?

On my server. There are literally hundred(s) of mails for root every day. The trouble is I'm not sure what is sending them. I've configured, on this server, the following:
Code:
denyhosts
fail2ban
rkhunter
logwatch
(Maybe some overkill there)

If I remember correctly, I've set them all to e-mail root when there are issues. This seems to have "backfired" to some degree what with the overabundance of mail. The other day there were over 1200 mails for root! Anyhow, I'm attaching the latest one. Apologies in advance for the length of the mail. I'll shorten it if necessary.
Quote:
Return-Path: <MAILER-DAEMON>
Received: from localhost (localhost)
by server.hsd1.ma.comcast.net. (8.14.5/8.14.5) id q4I99s2t001261;
Fri, 18 May 2012 05:12:07 -0400
Date: Fri, 18 May 2012 05:12:07 -0400
From: Mail Delivery Subsystem <MAILER-DAEMON>
Message-Id: <201205180912.q4I99s2t001261@server.hsd1.ma.comcas t.net.>
To: <root@server.hsd1.ma.comcast.net>
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
boundary="q4I99s2t001261.1337332327/server.hsd1.ma.comcast.net."
Subject: Warning: could not send message for past 4 hours
Auto-Submitted: auto-generated (warning-timeout)

This is a MIME-encapsulated message

--q4I99s2t001261.1337332327/server.hsd1.ma.comcast.net.

**********************************************
** THIS IS A WARNING MESSAGE ONLY **
** YOU DO NOT NEED TO RESEND YOUR MESSAGE **
**********************************************

The original message was received at Fri, 18 May 2012 00:50:49 -0400
from localhost [127.0.0.1]

----- Transcript of session follows -----
<root@server.hsd1.ma.comcast.net>... Deferred: Connection timed out with server.hsd1.ma.comcast.net.
Warning: message still undelivered after 4 hours
Will keep trying until message is 5 days old

--q4I99s2t001261.1337332327/server.hsd1.ma.comcast.net.
Content-Type: message/delivery-status

Reporting-MTA: dns; server.hsd1.ma.comcast.net.
Arrival-Date: Fri, 18 May 2012 00:50:49 -0400

Final-Recipient: RFC822; root@server.hsd1.ma.comcast.net
Action: delayed
Status: 4.4.1
Remote-MTA: DNS; server.hsd1.ma.comcast.net
Last-Attempt-Date: Fri, 18 May 2012 05:12:07 -0400
Will-Retry-Until: Wed, 23 May 2012 00:50:49 -0400

--q4I99s2t001261.1337332327/server.hsd1.ma.comcast.net.
Content-Type: message/rfc822

Return-Path: <root@server.hsd1.ma.comcast.net>
Received: from server.hsd1.ma.comcast.net. (localhost [127.0.0.1])
by server.hsd1.ma.comcast.net. (8.14.5/8.14.5) with ESMTP id q4I4onhT024217
for <root@server.hsd1.ma.comcast.net>; Fri, 18 May 2012 00:50:49 -0400
Received: (from root@localhost)
by server.hsd1.ma.comcast.net. (8.14.5/8.14.5/Submit) id q4I4o4AN013257;
Fri, 18 May 2012 00:50:04 -0400
Date: Fri, 18 May 2012 00:50:04 -0400
Message-Id: <201205180450.q4I4o4AN013257@server.hsd1.ma.comcas t.net.>
From: root@server.hsd1.ma.comcast.net (Cron Daemon)
To: root@server.hsd1.ma.comcast.net
Subject: Cron <root@server> rkhunter --propupd
Content-Type: text/plain; charset=UTF-8
Auto-Submitted: auto-generated
X-Cron-Env: <SHELL=/bin/bash>
X-Cron-Env: <PATH=/sbin:/bin:/usr/sbin:/usr/bin>
X-Cron-Env: <MAILTO=root>
X-Cron-Env: <HOME=/root>
X-Cron-Env: <LOGNAME=root>
X-Cron-Env: <USER=root>

[ Rootkit Hunter version 1.3.8 ]
File updated: searched for 165 files, found 133

--q4I99s2t001261.1337332327/server.hsd1.ma.comcast.net.--

Return-Path: <MAILER-DAEMON>
Received: from localhost (localhost)
by server.hsd1.ma.comcast.net. (8.14.5/8.14.5) id q4I99s2t001261;
Fri, 18 May 2012 05:12:07 -0400
Date: Fri, 18 May 2012 05:12:07 -0400
From: Mail Delivery Subsystem <MAILER-DAEMON>
Message-Id: <201205180912.q4I99s2t001261@server.hsd1.ma.comcas t.net.>
To: <root@server.hsd1.ma.comcast.net>
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
boundary="q4I99s2t001261.1337332327/server.hsd1.ma.comcast.net."
Subject: Warning: could not send message for past 4 hours
Auto-Submitted: auto-generated (warning-timeout)

This is a MIME-encapsulated message

--q4I99s2t001261.1337332327/server.hsd1.ma.comcast.net.

**********************************************
** THIS IS A WARNING MESSAGE ONLY **
** YOU DO NOT NEED TO RESEND YOUR MESSAGE **
**********************************************

The original message was received at Fri, 18 May 2012 00:50:49 -0400
from localhost [127.0.0.1]

----- Transcript of session follows -----
<root@server.hsd1.ma.comcast.net>... Deferred: Connection timed out with server.hsd1.ma.comcast.net.
Warning: message still undelivered after 4 hours
Will keep trying until message is 5 days old

--q4I99s2t001261.1337332327/server.hsd1.ma.comcast.net.
Content-Type: message/delivery-status

Reporting-MTA: dns; server.hsd1.ma.comcast.net.
Arrival-Date: Fri, 18 May 2012 00:50:49 -0400

Final-Recipient: RFC822; root@server.hsd1.ma.comcast.net
Action: delayed
Status: 4.4.1
Remote-MTA: DNS; server.hsd1.ma.comcast.net
Last-Attempt-Date: Fri, 18 May 2012 05:12:07 -0400
Will-Retry-Until: Wed, 23 May 2012 00:50:49 -0400

--q4I99s2t001261.1337332327/server.hsd1.ma.comcast.net.
Content-Type: message/rfc822

Return-Path: <root@server.hsd1.ma.comcast.net>
Received: from server.hsd1.ma.comcast.net. (localhost [127.0.0.1])
by server.hsd1.ma.comcast.net. (8.14.5/8.14.5) with ESMTP id q4I4onhT024217
for <root@server.hsd1.ma.comcast.net>; Fri, 18 May 2012 00:50:49 -0400
Received: (from root@localhost)
by server.hsd1.ma.comcast.net. (8.14.5/8.14.5/Submit) id q4I4o4AN013257;
Fri, 18 May 2012 00:50:04 -0400
Date: Fri, 18 May 2012 00:50:04 -0400
Message-Id: <201205180450.q4I4o4AN013257@server.hsd1.ma.comcas t.net.>
From: root@server.hsd1.ma.comcast.net (Cron Daemon)
To: root@server.hsd1.ma.comcast.net
Subject: Cron <root@server> rkhunter --propupd
Content-Type: text/plain; charset=UTF-8
Auto-Submitted: auto-generated
X-Cron-Env: <SHELL=/bin/bash>
X-Cron-Env: <PATH=/sbin:/bin:/usr/sbin:/usr/bin>
X-Cron-Env: <MAILTO=root>
X-Cron-Env: <HOME=/root>
X-Cron-Env: <LOGNAME=root>
X-Cron-Env: <USER=root>

[ Rootkit Hunter version 1.3.8 ]
File updated: searched for 165 files, found 133

--q4I99s2t001261.1337332327/server.hsd1.ma.comcast.net.--
I'm not really making heads or tails out of this. It's not clear to me what is sending the mail. Is it sendmail just telling me that it couldn't send mail and will keep trying for 5 days? One of the e-mail addresses may be mis-configured?

Any insight greatly appreciated.

In addition, while looking at logcheck logs I see what may be relevant information:
Quote:
--------------------- sendmail Begin ------------------------



SEVERE ERRORS
-------------

System Error Messages:
savemail: cannot save rejected email anywhere: 214 Time(s)
Permission denied: 1 Time(s)
savemail: cannot save rejected email anywhere: 1123 Time(s)

Lost Queue Files:
./qfq3K6L5L9003386: savemail panic
./qfq3I6K4RT002973: savemail panic
./qfq3L6155F000999: savemail panic
./qfq3M223Fp018124: savemail panic
./qfq3KAt1Xm027300: savemail panic
./qfq3O6I5Yl021205: savemail panic
__________________
Glenn
The Bassinator © ®

[SIGPIC][/SIGPIC]
Laptop: Toshiba Satellite / Intel Core 2 Duo 1.73 GHz / 2GB / 160GB / Intel Mobile 945GM/GMS/GME/943/940GML Integrated Graphics
Desktop: BioStar MCP6PB M2+ / AMD Phenom 9750 Quad Core / 4GB / 1TB SATA / 500GB SATA / EVGA GeForce 8400 GS 1GB
Reply With Quote
  #2  
Old 23rd May 2012, 12:38 PM
jpollard Online
Registered User
 
Join Date: Aug 2009
Location: Waldorf, Maryland
Posts: 6,815
linuxfirefox
Re: Why, why, why do I get ALL of this mail?

It may be a bad alias entry.


This appears to have been initiated by a cron job (which will send one message for every run...) Then you get the error (being sent to root on the local host, which appears to be translated to root@server.hsd1.ma.comcast.net). If this server has a bad alias entry, then it will attempt to relay.. but if malformed it may not be able to send (or has been denied connection to) a server.

And the mail system will resend the message after each attempt at a connection (which bounces).

The server that is denying a connection is server.hsd1.ma.comcast.net. It is apparently blocking a sendmail connection (either because port 25 is not open, or a firewall rule, or a hosts.deny/allow restriction, but it will be on server.hd1...).

Now, because it appears to be the same as the local host (not absolutely sure on that) this could be happening because sendmail cannot identify itself as "server.hsd1.ma.comcast.net". This can occur if the FQDN is missing from the local host table. This can be overridden in the sendmail.cf file. This is the part:
Quote:
# my official domain name
# ... define this only if sendmail cannot automatically determine your domain
#Dj$w.Foo.COM
Sendmail attempts to define the host name by combining names with the domain name... but sometimes it doesn't work. Usually it is because the FQDN is missing from the local host table, sometime because the hostname is not the same as the network name (there is no required correlation).

I'm sure stevea will note any errors I have made... He usually does.
Reply With Quote
  #3  
Old 24th May 2012, 11:15 AM
glennzo Offline
Un-Retired Administrator
 
Join Date: Mar 2004
Location: Salem, Mass USA
Age: 57
Posts: 14,673
linuxchrome
Re: Why, why, why do I get ALL of this mail?

Got some time now, albeit not much time, so I think I'll take a look at some of the mail configurations and see what I can do. Appreciate the response. Thank you.

I deleted all the mail that there was yesterday. Today there are another 500+
__________________
Glenn
The Bassinator © ®

[SIGPIC][/SIGPIC]
Laptop: Toshiba Satellite / Intel Core 2 Duo 1.73 GHz / 2GB / 160GB / Intel Mobile 945GM/GMS/GME/943/940GML Integrated Graphics
Desktop: BioStar MCP6PB M2+ / AMD Phenom 9750 Quad Core / 4GB / 1TB SATA / 500GB SATA / EVGA GeForce 8400 GS 1GB
Reply With Quote
Reply

Tags
mail

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
undelivered mail returned to sender originating from my mail server. garbagedigger Security and Privacy 2 30th November 2008 06:36 PM
Postfix won't move mail from /var/spool/mail to /home/vmail jmoschetti45 Servers & Networking 0 4th March 2007 11:44 PM
spam_buttons move from /var/spool/mail/user to $HOME/mail/Junk paul_mat Using Fedora 0 25th May 2006 08:07 AM
Spam Assassin - IMAP, Fetch Mail Send Mail` polc1410 Servers & Networking 3 12th December 2005 12:26 PM


Current GMT-time: 15:42 (Friday, 22-08-2014)

TopSubscribe to XML RSS for all Threads in all ForumsFedoraForumDotOrg Archive
logo

All trademarks, and forum posts in this site are property of their respective owner(s).
FedoraForum.org is privately owned and is not directly sponsored by the Fedora Project or Red Hat, Inc.

Privacy Policy | Term of Use | Posting Guidelines | Archive | Contact Us | Founding Members

Powered by vBulletin® Copyright ©2000 - 2012, vBulletin Solutions, Inc.

FedoraForum is Powered by RedHat