Strange qmail processes?

[rbhaydon]

Suffering the same problem with outgoing email taking forever, I did a "ps -aux" to show all the running processes. I got the following:

qmailr 8215 0.0 0.1 3284 948 ? S 14:31 0:00 qmail-remote svolkov.com [email protected] ebanner@svol
qmailr 8403 0.0 0.1 3280 948 ? S 14:33 0:00 qmail-remote lovemail.com [email protected] tyrannosaurus_re
qmailr 8677 0.0 0.1 3280 964 ? S 14:37 0:00 qmail-remote sco.com [email protected] [email protected]
qmailr 9523 0.0 0.1 3288 940 ? S 14:41 0:00 qmail-remote aport.ru [email protected] [email protected]
qmailr 9535 0.0 0.1 3284 936 ? S 14:41 0:00 qmail-remote aport.ru [email protected] planeta_tour@ap
qmailr 9543 0.0 0.1 3280 932 ? S 14:41 0:00 qmail-remote thgas.dn.ua [email protected] [email protected]
qmailr 9561 0.0 0.1 3280 932 ? S 14:41 0:00 qmail-remote format.org.ua [email protected] [email protected]
qmailr 9586 0.0 0.1 3284 936 ? S 14:42 0:00 qmail-remote bashprom.com [email protected] rapoport@bashprom.
qmailr 9594 0.0 0.1 3284 936 ? S 14:42 0:00 qmail-remote mcbn.ru [email protected] [email protected]
root 9605 0.0 0.0 1452 452 ? S 14:42 0:00 tcp-env /var/qmail/bin/relaylock /var/qmail/bin/qmail-smtpd
qmailr 9621 0.0 0.1 3280 928 ? S 14:42 0:00 qmail-remote lnmz.sumy.ua [email protected] [email protected].
qmailr 9622 0.0 0.1 3280 932 ? S 14:42 0:00 qmail-remote omen.ru [email protected] [email protected]
qmailr 9623 0.0 0.1 3280 932 ? S 14:42 0:00 qmail-remote chuvashia.ru [email protected] nostalgi@chuvashia
qmailr 9634 0.2 0.1 3280 928 ? S 14:42 0:00 qmail-remote ite.cv.ua [email protected] [email protected]
qmailr 9635 0.0 0.1 3284 936 ? S 14:42 0:00 qmail-remote newmail.net [email protected] albaross@newmail
qmailr 9637 0.2 0.1 3288 936 ? S 14:42 0:00 qmail-remote uanet.com.ua [email protected] [email protected].u
qmailr 9639 0.3 0.1 3280 924 ? S 14:42 0:00 qmail-remote uagunix.gdl.uag.mx [email protected] gvillanu@
qmailr 9643 0.0 0.1 3284 960 ? S 14:42 0:00 qmail-remote zt.ukrtel.net [email protected] [email protected]el.n
qmailr 9645 0.0 0.1 3288 928 ? S 14:42 0:00 qmail-remote snf.e-mail.com [email protected] [email protected]

What on earth are these? I recognize none of these addresses...anyone have any guess as to what is going on?

Are these spammers? unauthorized relayers?

Thanks,
Bruce

 

[etan]

someone on your system running a mailing list, doing a mail out ?

 

[rbhaydon]

My Plesk server is an OPEN RELAY!

I figured out what the problemis - despite having it set otherwise in the control panel, it appears my PLESK server is an open relay....

QMAIL is letting anyone pass stuff through...that's why I've got all these processes... It's all spam.


Does anyone have any fixes for this? Urgent!

Bruce

 

[RexAdmin]

Open relay? Plesk Panel should allow you to re-set this, if it doesn't work you need to do it your self (hope you have administrator skills).

OTOH, you should check for php scripts (forms, phpNuke exploits), you should harden /tmp directory)

Good luck.

 

[rbhaydon]

Plesk 7.5.1 fixed it...

PLESK 7.5.1. fixed all the problems with SMTP Authorization not working.