Mailman 2.1.5-10.FC2 Problem; Probably sendmail-related

[Nigel Henry]

On Sunday 06 January 2008 16:49, Robert L Cochran wrote:
> I have a server box running Fedora Core 2 that has been just sitting
> there, dutifully working away, for a long while now. I haven't updated
> it at all since the 2.6.10-1.771_FC2 kernel, and that was a long time ago!
>
> The server runs:
>
> DNS via bind 9.2.3-13
> sendmail 8.12.11-4.6
> mailman 2.1.5-10.fc2
>
> I have two low-volume mailing lists for my family. Suddenly, I am not
> getting any incoming emails from either list. Sending test emails to one
> of the list is showing they are being posted to the list archives, but I
> am not getting any posts by email suddenly.
>
> Top is showing that sendmail is very active. There seems to be 3 or 4
> sendmail processes.
>
> My hard drive light stays resolutely on, pretty much all the time. What
> on earth can be using the hard drive so heavily?
>
> ssh connections into this server (from my internal network) take a
> terribly long time to establish. They take 30 seconds or so before I can
> get a shell prompt back over the wire. I just now ssh'ed into the
> server, then issued 'shutdown -r now', and it took more than 1 minute
> for the prompt to come back.
>
> I'm wondering if sendmail has been compromised and is sending out huge
> numbers of outgoing email. Is there a way of finding out what sendmail
> is doing, to see if it is relaying mail for someone external to my network?
>
> Can anyone suggest what might be the problem here? How can I rescue things?
>
> Thanks
>
> Bob Cochran
> Greenbelt, Maryland, USA

I'm posting from FC2, so I'm not going to have a go at you still using FC2, 
but I think you should have taken advantage of Fedora legacy before it shut 
down. there were a lot of security updates provided by it, including 
sendmail.

I have a copy of the latest sendmail security update from Fedora legacy if you 
want it (sendmail-8.12.11-4.26.legacy). Also there is a later kernel from 
Fedora legacy, but I can't e-mail that, as it's too big 
(2.6.10-2.3.legacy_FC2 , but if you have somewhere I can upload it to, I will 
do.

I may well be wrong, but I think I'd fire up ps auxw on the CLI, find out the 
PID's of the sendmail processes that are running, kill them, and then restart 
sendmail, and see if the problem persists.

Nigel.