[OT?] strange /root/dead.letter file

[Julian Field]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

MailScanner does not generate any file called "dead.letter".

Miguel Koren O'Brien de Lacy wrote:

> I use tripwire to monitor file integrity. This morning it pointed to
> the existence of a dead.letter file in the /root directory, the ones I
> get when I abort a pine session. This file has the content of a
> typical spam email, directed outside our domains from outside our
> server. If I search the maillog for the message ID in the header I get
> this:
>
> Feb 24 03:30:53 rivendell sendmail[32044]: j1O4Uftl032044: timeout
> waiting for input from 200-161-96-153.dsl.telesp.net.br during message
> collect
> Feb 24 03:30:53 rivendell sendmail[32044]: j1O4Uftl032044:
> from=<root at konsultex.com.br>, size=1398, class=0, nrcpts=1,
> msgid=<200502240430.j1O4Uftl032044 at rivendell.konsultex.com.br>,
> proto=SMTP, daemon=MTA, relay=200-161-96-153.dsl.telesp.net.br
> [200.161.96.153]
> Feb 24 03:30:53 rivendell sendmail[32044]: j1O4Uftl032044:
> to=<root at konsultex.com.br>, delay=02:00:03, pri=30170, stat=timeout
> waiting for input during message collect
>
> Since this is definitely not a time when anyone on this server would
> be using pine, especially as root. Is it possible that Mailscanner
> causes this? To me it looks like a relay attempt that was blocked by
> sendmail itself. But why would it generate a dead.letter file?
>
> Miguel
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!