From rowan at rownetco.com  Mon Aug 14 13:00:58 2006
From: rowan at rownetco.com (John Rowan)
Date: Mon Aug 14 13:01:39 2006
Subject: verify_user problem
Message-ID: <44E0AC4A.20500@rownetco.com>

I'm running Sendmail version 8.13.1, config V10/Berkeley on a CentOS 
Linux 4.3 server.  Today I noticed there were 7000 plus messages in the 
outbound queue.  They are the result of rejections of verifying user 
attempts.

Does anyone know if this is a new virus/worm or Trojan?


Aug 14 08:02:51 softtail sendmail[4553]: k7EC2esr004553: from=<>, 
size=6877, class=0, nrcpts=1, 
msgid=<200608141202.k7EC2esr004553@softtail..com>, proto=SMTP, 
daemon=MTA, relay=extsmtp3.localnet.com [207.251.201.55]
Aug 14 08:02:51 softtail lmtpunix[4519]: accepted connection
Aug 14 08:02:51 softtail lmtpunix[4519]: lmtp connection preauth'd as 
postman
Aug 14 08:02:51 softtail lmtpunix[4519]: verify_user(user.p.holland) 
failed: Mailbox does not exist
Aug 14 08:02:51 softtail sendmail[4559]: k7EC2esr004553: 
to=<p.Holland@.com>, delay=00:00:00, xdelay=00:00:00, mailer=cyrusv2, 
pri=126877, relay=localhost, dsn=5.1.1, stat=User unknown
Aug 14 08:02:51 softtail sendmail[4559]: k7EC2esr004553: k7EC2psr004559: 
postmaster notify: User unknown


Aug 14 08:02:57 softtail sendmail[4533]: k7EC2Y7A004533: 
from=<gormlaithead@horacio.com>, size=2037, class=0, nrcpts=1, 
msgid=<000001c6bf99$7fd5d720$d61ca8c0@hgr94>, proto=SMTP, daemon=MTA, 
relay=AStDenis-105-1-6-150.w81-248.abo.wanadoo.fr [81.248.193.150]
Aug 14 08:02:57 softtail lmtpunix[4515]: accepted connection
Aug 14 08:02:57 softtail lmtpunix[4515]: lmtp connection preauth'd as 
postman
Aug 14 08:02:57 softtail lmtpunix[4519]: accepted connection
Aug 14 08:02:57 softtail lmtpunix[4519]: lmtp connection preauth'd as 
postman
Aug 14 08:02:57 softtail master[4567]: about to exec 
/usr/lib/cyrus-imapd/lmtpd
Aug 14 08:02:57 softtail lmtpunix[4519]: verify_user(user.vxp-hatcher) 
failed: Mailbox does not exist
Aug 14 08:02:57 softtail sendmail[4566]: k7EC2Y7A004533: 
to=<vxp-hatcher@.com>, delay=00:00:01, xdelay=00:00:00, mailer=cyrusv2, 
pri=122037, relay=localhost, dsn=5.1.1, stat=User unknown
Aug 14 08:02:57 softtail lmtpunix[4567]: executed
Aug 14 08:02:57 softtail sendmail[4566]: k7EC2Y7A004533: k7EC2v7A004566: 
DSN: User unknown

-------------- next part --------------
A non-text attachment was scrubbed...
Name: rowan.vcf
Type: text/x-vcard
Size: 235 bytes
Desc: not available
Url : http://lists.andrew.cmu.edu/pipermail/cyrus-announce/attachments/20060814/cfbac99d/rowan.vcf