Disable or limit email in root?

[Jorge Biquez]

At 11:25 p.m. 26/05/2011, you wrote:
>On Fri, May 27, 2011 at 12:16 AM, Jorge Biquez 
><jbiquez at intranet.com.mx> wrote:
> > I am trying to find if sendmail was the problem or what... thing 
> is not that
> > root receive email but that root was used to send email to a list of
> > address...
>
>Was the root account on the box actually used, or did someone spoof
>email coming from root on the box?  Did you receive a spam report
>about email coming from the IP address of the box?  Do you have the
>header of the email/s in question?  Is sendmail running locally, or is
>it running SMTP on an open port?



Yes the user root was actually used. I noticed becasue since the 
machine is too small (an old pentium III) the mail queue grows too 
much and the service for nomal email was very slow. When I logged to 
the server the mail queue was big and all the emailes were sent by 
the root user.
I have not received, yet, spam reports but I sure will do, I guess a 
least some thousand of emailes were sent.
Sendmail is running on port 587 and 25

At the end a small part of the log (all the entries the same), when I 
logged in and disabled bind (I thought that could help to stop the 
emailes. I killed sendmail processes but the system was too slow and 
there were too many snedmail process running that it took a while to 
stop them all.

------------


May 26 18:22:42 krusty sendmail[36370]: p4P5EjU0070745: 
to=<superletras at yahoo.com.mx>, delay=1+18:06:12, xdelay=00:00:00, 
mailer=esmtp, pri=1290845, relay=l.mx.mail.yahoo.com., dsn=4.0.0, 
stat=Deferred: Name server: l.mx.mail.yahoo.com.: host name lookup failure
May 26 18:22:42 krusty sendmail[69923]: p4PK75tT069923: 
to=<tuempresacrece at yahoo.com>, delay=00:00:04, xdelay=00:00:00, 
mailer=esmtp, pri=32151, relay=l.mx.mail.yahoo.com., dsn=4.0.0, 
stat=Deferred: Name server: l.mx.mail.yahoo.com.: host name lookup failure
May 26 18:22:43 krusty sendmail[58754]: p4P7Y2SC035537: 
to=<inamexico at infosel.net.mx>, delay=1+15:18:04, xdelay=00:00:00, 
mailer=esmtp, pri=1380845, relay=mx.vmx.terra.com., dsn=4.0.0, 
stat=Deferred: Name server: mx.vmx.terra.com.: host name lookup failure
May 26 18:22:43 krusty sendmail[67814]: p4P6wdj8025797: 
to=<consensus at infosel.com.mx>, delay=1+16:18:24, xdelay=00:00:00, 
mailer=esmtp, pri=1650845, relay=mx.terra.com.br., dsn=4.0.0, 
stat=Deferred: Name server: mx.terra.com.br.: host name lookup failure
May 26 18:22:43 krusty sendmail[25300]: p4P7R0qe033668: 
to=<ffernando at infosel.net.mx>, delay=1+15:19:29, xdelay=00:00:00, 
mailer=esmtp, pri=930845, relay=mx.vmx.terra.com., dsn=4.0.0, 
stat=Deferred: Name server: mx.vmx.terra.com.: host name lookup failure
May 26 18:22:43 krusty sendmail[63747]: p4P9v9sg074187: 
to=<claudianero at yahoo.com.mx>, delay=1+13:13:37, xdelay=00:00:00, 
mailer=esmtp, pri=1560845, relay=h.mx.mail.yahoo.com., dsn=4.0.0, 
stat=Deferred: Name server: h.mx.mail.yahoo.com.: host name lookup failure
May 26 18:22:43 krusty sendmail[17900]: p4P9MGns065419: 
to=<eballesteros at terra.com.mx>, delay=1+13:57:01, xdelay=00:00:00, 
mailer=esmtp, pri=210846, relay=mx.vmx.terra.com., dsn=4.0.0, 
stat=Deferred: Name server: mx.vmx.terra.com.: host name lookup failure
May 26 18:22:46 krusty sendmail[41317]: p4P8BXIs045878: 
to=<juliortelli at yahoo.com.mx>, delay=1+14:38:56, xdelay=00:00:00, 
mailer=esmtp, pri=1470845, relay=b.mx.mail.yahoo.com., dsn=4.0.0, 
stat=Deferred: Name server: b.mx.mail.yahoo.com.: host name lookup failure
May 26 18:22:47 krusty sendmail[4586]: p4P3wNVF036046: 
to=<albertnovias at yahoo.com.mx>, delay=1+19:23:15, xdelay=00:00:00, 
mailer=esmtp, pri=570846, relay=e.mx.mail.yahoo.com., dsn=4.0.0, 
stat=Deferred: Name server: e.mx.mail.yahoo.com.: host name lookup failure
May 26 18:22:47 krusty sendmail[87746]: p4P6vbd5025549: 
to=<andrealterna at yahoo.com.mx>, delay=1+16:07:29, xdelay=00:00:00, 
mailer=esmtp, pri=390846, relay=j.mx.mail.yahoo.com., dsn=4.0.0, 
stat=Deferred: Name server: j.mx.mail.yahoo.com.: host name lookup failure
May 26 18:22:47 krusty sendmail[41819]: p4P9YOFb068525: 
to=<conimazzina at yahoo.com.mx>, delay=1+13:45:19, xdelay=00:00:00, 
mailer=esmtp, pri=1650845, relay=k.mx.mail.yahoo.com., dsn=4.0.0, 
stat=Deferred: Name server: k.mx.mail.yahoo.com.: host name lookup failure
May 26 18:22:47 krusty sendmail[66017]: p4PJ75P2066017: 
to=<tuempresacrece at yahoo.com>, delay=00:00:05, xdelay=00:00:00, 
mailer=esmtp, pri=32151,


------------