Hi,

at 1st sorry for my bad english =)

my problem:
the user "dustman" collect 250 mails every day from "Mail Delivery
Subsystem" with the following content:

The original message was received at Fri, 15 Sep 2006 14:40:11 +0200
from mailservice@localhost

----- The following addresses had permanent fatal errors -----
dilutecombination@rothschildinv.com
(reason: 553 mail.xxxmydomainxxx.local does not exist)

----- Transcript of session follows -----
.... while talking to mailto.t-dsl-business.de.:
>>> MAIL From:<mailservice@mail.mueller-sut.local> SIZE=1159
AUTH=mailservice@mail.xxxmydomain.local
<<< 553 mail.mueller-sut.local does not exist
501 5.6.0 dilutecombination@rothschildinv.com... Data format error

the recipient varied from mail to mail. i think the recipient are spam
mailers

i know that the recipient not exist. but i don't know wich user or
process send this email to the recipient. is this a spam filter problem ?

here is the "mail" logfile

Sep 15 13:00:08 mail sendmail[10508]: k8FB08d10508: from=mailservice,
size=22241, class=0, nrcpts=1,
msgid=<001b01c6d893$4ee76ee0$069c820c@Lindsey>, relay=mailservice@localhost
Sep 15 13:00:09 mail sendmail[10510]: k8FB08d10508: to=afr,
ctladdr=mailservice (500/500), delay=00:00:01, xdelay=00:00:01,
mailer=local, pri=52241, dsn=2.0.0, stat=Sent
Sep 15 13:00:09 mail sendmail[10520]: k8FB09T10520: from=mailservice,
size=2197, class=0, nrcpts=1,
msgid=<48CB587F8235318.5533487449@bellsouth.net>,
relay=mailservice@localhost
Sep 15 13:00:09 mail sendmail[10516]: k8FB09W10516: from=mailservice,
size=1948, class=0, nrcpts=1,
msgid=<200609151100.k8FB09W10516@mail.xxxmydomainx xx.xxx>,
relay=mailservice@localhost
Sep 15 13:00:09 mail sendmail[10523]: k8FB09T10520: to=afr,
ctladdr=mailservice (500/500), delay=00:00:00, xdelay=00:00:00,
mailer=local, pri=32197, dsn=2.0.0, stat=Sent
Sep 15 13:00:10 mail sendmail[10531]: k8FB09F10531: from=mailservice,
size=1005, class=0, nrcpts=1,
msgid=<200609151100.k8FB09F10531@mail.xxxmydomainx xx.xxx>,
relay=mailservice@localhost
Sep 15 13:00:10 mail sendmail[10526]: k8FB09W10516:
to=weisgei@adcycle.com, ctladdr=mailservice (500/500), delay=00:00:01,
xdelay=00:00:01, mailer=relay, pri=31948,
relay=mailto.t-dsl-business.de. [80.152.31.56], dsn=5.6.0, stat=Data
format error
Sep 15 13:00:10 mail sendmail[10526]: k8FB09W10516: k8FB0AV10526: DSN:
Data format error
Sep 15 13:00:10 mail sendmail[10526]: k8FB0AV10526: to=dustman,
delay=00:00:00, xdelay=00:00:00, mailer=local, pri=32048, dsn=2.0.0,
stat=Sent
Sep 15 13:00:10 mail sendmail[10536]: k8FB09F10531:
to=crissy@wagged.com, ctladdr=mailservice (500/500), delay=00:00:01,
xdelay=00:00:00, mailer=relay, pri=31005,
relay=mailto.t-dsl-business.de. [80.152.31.56], dsn=5.6.0, stat=Data
format error
Sep 15 13:00:10 mail sendmail[10536]: k8FB09F10531: k8FB0AE10536: DSN:
Data format error
Sep 15 13:00:10 mail sendmail[10536]: k8FB0AE10536: to=dustman,
delay=00:00:00, xdelay=00:00:00, mailer=local, pri=31105, dsn=2.0.0,
stat=Sent

best regards & thanks for your efforts

horstazrael

On Fri, 15 Sep 2006 16:02:15 +0200 HorstAzRaEl wrote:

> my problem:
> the user "dustman" collect 250 mails every day from "Mail Delivery
> Subsystem" with the following content:

"dustman" is an alias for root in aliases_db, and root the alias target
for postmaster?

> The original message was received at Fri, 15 Sep 2006 14:40:11 +0200
> from mailservice@localhost
>
> ----- The following addresses had permanent fatal errors -----
> dilutecombination@rothschildinv.com
> (reason: 553 mail.xxxmydomainxxx.local does not exist)

Mail didn't reach the recipient as your machine has not a public
resolvable FQDN.

> ----- Transcript of session follows -----
> ... while talking to mailto.t-dsl-business.de.:
> >>> MAIL From:<mailservice@mail.mueller-sut.local> SIZE=1159
> AUTH=mailservice@mail.xxxmydomain.local <<< 553 mail.mueller-sut.local
> does not exist 501 5.6.0 dilutecombination@rothschildinv.com... Data
> format error

Is that intended mail sending to dilutecombination@rothschildinv.com? If
yes, then set a valid FQDN or use masquerading.

> the recipient varied from mail to mail. i think the recipient are spam
> mailers
>
> i know that the recipient not exist. but i don't know wich user or
> process send this email to the recipient. is this a spam filter problem
> ?
>
> here is the "mail" logfile
>
> Sep 15 13:00:08 mail sendmail[10508]: k8FB08d10508: from=mailservice,
> size=22241, class=0, nrcpts=1,
> msgid=<001b01c6d893$4ee76ee0$069c820c@Lindsey>,
> relay=mailservice@localhost Sep 15 13:00:09 mail sendmail[10510]:
> k8FB08d10508: to=afr, ctladdr=mailservice (500/500), delay=00:00:01,
> xdelay=00:00:01, mailer=local, pri=52241, dsn=2.0.0, stat=Sent Sep 15
> 13:00:09 mail sendmail[10520]: k8FB09T10520: from=mailservice,
> size=2197, class=0, nrcpts=1,
> msgid=<48CB587F8235318.5533487449@bellsouth.net>,
> relay=mailservice@localhost
> Sep 15 13:00:09 mail sendmail[10516]: k8FB09W10516: from=mailservice,
> size=1948, class=0, nrcpts=1,
> msgid=<200609151100.k8FB09W10516@mail.xxxmydomainx xx.xxx>,
> relay=mailservice@localhost
> Sep 15 13:00:09 mail sendmail[10523]: k8FB09T10520: to=afr,
> ctladdr=mailservice (500/500), delay=00:00:00, xdelay=00:00:00,
> mailer=local, pri=32197, dsn=2.0.0, stat=Sent Sep 15 13:00:10 mail
> sendmail[10531]: k8FB09F10531: from=mailservice, size=1005, class=0,
> nrcpts=1,
> msgid=<200609151100.k8FB09F10531@mail.xxxmydomainx xx.xxx>,
> relay=mailservice@localhost
> Sep 15 13:00:10 mail sendmail[10526]: k8FB09W10516:
> to=weisgei@adcycle.com, ctladdr=mailservice (500/500), delay=00:00:01,
> xdelay=00:00:01, mailer=relay, pri=31948,
> relay=mailto.t-dsl-business.de. [80.152.31.56], dsn=5.6.0, stat=Data
> format error
> Sep 15 13:00:10 mail sendmail[10526]: k8FB09W10516: k8FB0AV10526: DSN:
> Data format error
> Sep 15 13:00:10 mail sendmail[10526]: k8FB0AV10526: to=dustman,
> delay=00:00:00, xdelay=00:00:00, mailer=local, pri=32048, dsn=2.0.0,
> stat=Sent
> Sep 15 13:00:10 mail sendmail[10536]: k8FB09F10531:
> to=crissy@wagged.com, ctladdr=mailservice (500/500), delay=00:00:01,
> xdelay=00:00:00, mailer=relay, pri=31005,
> relay=mailto.t-dsl-business.de. [80.152.31.56], dsn=5.6.0, stat=Data
> format error
> Sep 15 13:00:10 mail sendmail[10536]: k8FB09F10531: k8FB0AE10536: DSN:
> Data format error
> Sep 15 13:00:10 mail sendmail[10536]: k8FB0AE10536: to=dustman,
> delay=00:00:00, xdelay=00:00:00, mailer=local, pri=31105, dsn=2.0.0,
> stat=Sent

What is "mailservice"? It looks like a local user with UID 500. So the
mails are generated locally. Is there a software out of control or are you
hacked?

> best regards & thanks for your efforts
>
> horstazrael

Alexander


--
Alexander Dalloz | Löhne, Germany | GPG http://pgp.mit.edu 0xB366A773
legal statement: http://www.uni-x.org/legal.html
Fedora Core 2 GNU/Linux on Athlon with kernel 2.6.11-1.35_FC2smp
Serendipity 17:57:55 up 8 days, 20:07, load average: 0.20, 0.15, 0.11