[GRLUG] Exim4

[John-Thomas Richards]

On Tue, Nov 10, 2015 at 03:26:21PM -0600, L. V. Lammert wrote:
> Any Exim folks around? Have an interesting issue with an old CentOS 5 box
> that we use for a VNC relay:
> 
> It was build with Exim4 in 2007, and I just realized that there tons of
> junk mails generated on the system every day, IOW:
> 
>  1m  1.5K 1ZwGNe-0001aZ-Gm <> *** frozen ***
>           root at omnitec.net
> 
>  0m  1.5K 1ZwGOc-0001aj-LC <> *** frozen ***
>           root at omnitec.net
> 
> So, the question is exactly where is "root at omnitec.net" being generated?
> There is a *different* root alias in /etc/aliases:
> 
> root: noc at omnitec.net
> 
> I just redid the configuration, but no change.
> 
> Would anyone have an idea How/where these bogus root email destination is
> originating?

>From cron? It's sending the message to root and affixing the domain name
to it. My guess is exim isn't set up for local domains and so exim is
not filtering them before the smarthost.
-- 
john-thomas
-----
A business that makes nothing but money is a poor business.
Henry Ford, industrialist (30 Jul 1863-1947)