Sendmail aliases doesn't work

[jzhu]

Hi all,

Can anyone help me with this one? We are running Sendmail 8.8.8b on a SCO Unix box (V 5.0.5). I got the following errors as attached, when trying to create an alias by running /usr/lib/./sendmail -bi.

Thanks in advance,

Joe

_______
Error messages:

# /usr/lib/./sendmail -bi
WARNING: writable directory /usr
WARNING: writable directory /usr/spool
WARNING: writable directory /usr/spool/mqueue
WARNING: writable directory /usr
WARNING: writable directory /usr
WARNING: writable directory /usr
WARNING: writable directory /usr
hash map "Alias0": unsafe map file /usr/lib/mail/aliases: Symbolic links not allowed
WARNING: writable directory /usr
WARNING: writable directory /usr
WARNING: writable directory /usr
WARNING: writable directory /usr
ndbm_map_open(/usr/lib/mail/aliases): file changed after open
WARNING: cannot open alias database /usr/lib/mail/aliases
Cannot create database for alias file /usr/lib/mail/aliases: No such device

 

[Annihilannic]

You might want to run a fixmog to check the permissions of your directories under /usr.

Does your /usr/lib/mail/aliases file exist? Can you include the contents here (unless you're sure they're not the problem). Annihilannic.

 

[jzhu]

Thanks for your prompt reply to this question, Annihilannic.

/usr/lib/mail/aliases does exist and point to /var/opt/K/SCO/8.8.8b/lib/aliases, which has the permission 644 for root:bin:world, but /usr/lib/mail/aliases(the soft link itself) has the permission as 644 for root:sys:world, is there any problem with this inconsistency?

As I look at the /usr/lib/mail/aliases.pag and /usr/lib/mail/aliases.dir, they are both 0 byte in size.

We have been having problems with file/dir permissions and missing links to certain system files, for several times in the past few months. My manager managed to find/fix them by running certain cmd or utility. Do you know what it is by any chance. I only know that the utility created a log file, /u/sysdept/descrepancy.txt. And I need your help in helping me find out what might have caused these permission or missing link problems. Last time when this happened, it was so bad that the host wouldn't boot since we lost the root user from the system, and I had to restore /etc/passwd from a backup copy. As you might have noticed that this is a mail server, could there be any Virus, or this server had been compromised by any internet hacker.

We do have a whole bunch of messages within syslog, saying no user for user@ourdomain.com found for this domain. Looks like someone out there is trying to hack into it by running certain script of trial and failure to send email randomly to perceived user@ourdomain.com.

Any suggestions would be much appreciated,

Joe

 

[Annihilannic]

On all our systems /usr/lib/mail/aliases and /var/opt/K/SCO/SendMail/8.8.8b/lib/aliases are not linked, but are copies of the same file, so I suggest you remove the symbolic link in /usr/lib/mail and copy the other file over. Especially since it says 'symbolic links not allowed' in your error messages.

It does sound like a spammer is perhaps attempting to use your system to relay mail perhaps, but I'm no security expert so I couldn't really say.

That 'descrepancy.txt' sounds like someone has just redirected something to a file (looking at the spelling!). Maybe he was using custom -V thorough -x which verifies all software and and attempts to fix any problems found? Annihilannic.

 

[jzhu]

I tried to make /usr/lib/mail/aliases a file instead of a softlink to no avail, and got exactly the same error message as before. I'll wait and try using custom -V thorough -x in hope to fix any discrepancies in the Aliases DB files.

Your help is much appreciated, Annihilannic.

Joe