Where does sendmail queue messages

[mikeg2005]

Sendmail is trying to send a bunch of deferred mail from a recent spam attack on our server.

I now have the server offline but whenever I turn start the sendmail service it begins sending a bunch of deferred email. My question is where is this mail being stored? I used the mailq command and it turns up nothing: 0 messages.

Webmin is installed. The machine has Fedora 6 on it.

Thanks, Mike

 

[RhythmAce]

Try /var/spool/mqueue. Webmin should be able to find it for you and give you an option to purge the queue. If it's not working, check to make sure that the module is setup for sendmail and not postfix.

 

[mikeg2005]

I've looked there too and nothing. Hmmm...

Thanks,
Mike

 

[mikeg2005]

The other day when a spammer was sending email from our server, I noticed that the sender was apache. So, I know the compromise was through a web page but which one? Do you know of any way of configuring sendmail to provide more info?

Thanks, Mike

 

[RhythmAce]

You may want to look at /var/log/maillog. Depending on when your logs get rotated, this may be a very small file. On the other hand, you will notice that the old logs that are rotated out are saved as maillog.1, maillog.2, etc. You can open any of these logs with a text editor to read them. My guess is that you'll find that these emails are coming from a form mail script on one or more of your websites. There are bots that go around the web looking for forms to fill out and submit. There is no way to prevent this but some form to mail scripts can be configured to cut down on what these spambots can do. I like formmail.php from

http://www.tectite.com.