Re: [cobalt-security] sendmail questions...?

["WebFusion System Administrator" <graeme.f@xxxxxxxxxxxxxxx>]

Micheal Zimmerman wrote in reply to Theodore Jones:

> > Can anyone help me decipher what such a process running would
indicate?:
> >
> > 641 ttyS0    S      0:00 /sbin/mgetty -s 115200 -r -b ttyS0
> >
> > I also have ten or more sendmail processs running which I don't know
> > about either...:
> >
> > 17623 ?        S      0:00 sendmail: server mail1.loadmail.com
> > [206.159.180.3] c
> > 17624 ?        S      0:00 sendmail: PAA17624 mail1.loadmail.com
> [snip]
>
> Looks like a) an uucp connection thru your searial port
> and b) sendmail receiving lots of mails from loadmail.com (LA area).
> Perhaps sendmail receiving lots of mail via the the old fashioned
> uucp over a dial-up line (I don't know; haven't seen that
> old technique for years).

Not UUCP - it's the default serial console login setup, listening for
people attaching a console or console emulator to the serial port -
ttyS0. It's a very useful way to debug and repair broken RAQs when you
can't get into them - like if they've been trashed by a cracker, or not
patched to fix the 'Large groups -> FTP slowdown' bug.

As for sendmail - you have one process listening on port 25 which will
say something like the following output from 'ps ax':
32285 ?        S      0:00 sendmail: accepting connections on port 25

...and a whole load of other sendmail processes all sending mail to the
remote machine listed in the output from ps. On a heavily loaded
mailserver, or one with a slow connection, you could end up with up to a
hundred running concurrently. If the box has enough resources to do it,
mind you ;-)

Panic not, it's not a security problem.


Best Wishes,

Graeme Fowler
Systems Administrator
graeme.f@xxxxxxxxxxxxxxx
--
***************************************************************
WebFusion Internet Solutions Ltd.
The UK's Largest Web Hosting Company
http://www.webfusion.co.uk
***************************************************************