OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
(no subject)

From: Bunting, Glen, IG (GBunting864Worldsavings.com)
Date: Wed Mar 29 2006 - 12:39:45 CST


Unfortunately I inherited the servers and do not know exactly what was
installed on them. Here is a bigger snippet of the log file:

Mar 29 10:33:04 sl2smtp11 postfix/smtpd[20749]: connect from
localhost.localdomain[127.0.0.1]
Mar 29 10:33:04 sl2smtp11 postfix/smtpd[20749]: EDB0EF4006:
client=localhost.localdomain[127.0.0.1]
Mar 29 10:33:05 sl2smtp11 postfix/cleanup[20751]: EDB0EF4006:
message-id=<200603291833.k2TIX4rx020747sl2smtp11.wsecomsl.com>
Mar 29 10:33:05 sl2smtp11 postfix/nqmgr[28969]: EDB0EF4006:
from=<rootsl2smtp11.wsecomsl.com>, size=626, nrcpt=1 (queue active)
Mar 29 10:33:05 sl2smtp11 sendmail[20747]: k2TIX4rx020747:
to=gbunting864worldsavings.com, ctladdr=root (0/0), delay=00:00:01,
xdelay=00:00:01, mailer=relay, pri=30089, relay=[127.0.0.1] [127.0.0.1],
dsn=2.0.0, stat=Sent (Ok: queued as EDB0EF4006)
Mar 29 10:33:05 sl2smtp11 postfix/smtpd[20749]: disconnect from
localhost.localdomain[127.0.0.1]
Mar 29 10:33:05 sl2smtp11 postfix/smtp[20754]: EDB0EF4006:
to=<testuser1worldsavings.com>, relay=mail.worldsavings.com[x.x.x.a],
delay=1, status=sent (250 2.0.0 Message received OK)
Mar 29 10:33:31 sl2smtp11 sendmail[20932]: k2TIXVwc020932: from=root,
size=68, class=0, nrcpts=1,
msgid=<200603291833.k2TIXVwc020932sl2smtp11.wsecomsl.com>,
relay=rootlocalhost
Mar 29 10:33:31 sl2smtp11 postfix/smtpd[20749]: connect from
localhost.localdomain[127.0.0.1]
Mar 29 10:33:31 sl2smtp11 postfix/smtpd[20749]: 36343F4006:
client=localhost.localdomain[127.0.0.1]
Mar 29 10:33:31 sl2smtp11 postfix/cleanup[20751]: 36343F4006:
message-id=<200603291833.k2TIXVwc020932sl2smtp11.wsecomsl.com>
Mar 29 10:33:31 sl2smtp11 postfix/nqmgr[28969]: 36343F4006:
from=<rootsl2smtp11.wsecomsl.com>, size=581, nrcpt=1 (queue active)
Mar 29 10:33:31 sl2smtp11 sendmail[20932]: k2TIXVwc020932:
to=testuser2wsl.com, ctladdr=root (0/0), delay=00:00:00,
xdelay=00:00:00, mailer=relay, pri=30068, relay=[127.0.0.1] [127.0.0.1],
dsn=2.0.0, stat=Sent (Ok: queued as 36343F4006)
Mar 29 10:33:31 sl2smtp11 postfix/smtpd[20749]: disconnect from
localhost.localdomain[127.0.0.1]
Mar 29 10:33:31 sl2smtp11 postfix/smtp[20754]: 36343F4006:
to=<gbuntingwsl.com>, relay=mail.wsl.com[x.x.x.b], delay=0, status=sent
(250 2.6.0 <200603291833.k2TIXVwc020932sl2smtp11.wsecomsl.com> Queued
mail for delivery)
Mar 29 10:34:30 sl2smtp11 sendmail[21131]: k2TIY0qX021131: from=root,
size=72, class=0, nrcpts=1,
msgid=<200603291834.k2TIY0qX021131sl2smtp11.wsecomsl.com>,
relay=rootlocalhost
Mar 29 10:34:30 sl2smtp11 sendmail[21131]: k2TIY0qX021131:
to=testuser3gmail.com, delay=00:00:30, mailer=esmtp, pri=30072,
dsn=4.4.3, stat=queued

How can I tell if I am using the sendmail binary from postfix?

Would that explain the occasional sendmail processes that I see in the
maillog?

Thanks

Glen
-----Original Message-----
From: owner-postfix-userspostfix.org
[mailto:owner-postfix-userspostfix.org] On Behalf Of Sandy Drobic
Sent: Wednesday, March 29, 2006 10:29 AM
To: postfix-userspostfix.org
Subject: Re:

John Peach wrote:
> On Wed, 29 Mar 2006 10:08:03 -0800
> "Bunting, Glen, IG" <GBunting864Worldsavings.com> wrote:
>
>
>>Sandy,
>>
>>I have verified than I am running postfix:
>
> [snip]
>
>>>Output from maillog:
>>>
>>>Mar 29 09:53:16 sl2smtp12 sendmail[2617]: k2THqjqe002617:
>>
>>from=ig864gb,
>>
>>>size=62, class=0, nrcpts=1,
>>>msgid=<200603291752.k2THqjqe002617sl2smtp12.wsecomsl.com>,
>>>relay=ig864gblocalhost
>>>Mar 29 09:53:16 sl2smtp12 sendmail[2617]: k2THqjqe002617:
>>>to=testgmail.com, delay=00:00:31, mailer=esmtp, pri=30062,
>>>dsn=4.4.3, stat=queued
>
>
> You are not running sendmail as a daemon, but the binary is obviously
> still there and being used for locally submitted mail.

That would be an explanation for the sendmail log while running the
postfix master. I hadn't thought of that, though it does crop up again
and
again.

Many scripts and filters also make use of sendmail, that makes it urgent

to make sure you are using the sendmail binary from postfix.

Sandy

*****************************************************************************
If you are not the intended recipient of this e-mail, please notify
the sender immediately. The contents of this e-mail do not amend
any existing disclosures or agreements unless expressly stated.
*****************************************************************************