Page 1 of 1

Suspicious process running under user postfix

Posted: 10 Oct 2013, 16:45
by bluedog
Hi,

can anybody help me with this error MSG. Is this something I can ignore or its something really serious? Thanks!

Time: Thu Oct 10 17:28:01 2013 +0200
PID: 22646 (Parent PID:12999)
Account: postfix
Uptime: 99 seconds

Executable:

/usr/libexec/postfix/smtp


Command Line (often faked in exploits):

smtp -t unix -u


Network connections by the process (if any):

tcp: MYIO:52335 -> 173.194.70.26:25

Files open by the process (if any):

/dev/null
/dev/null
/dev/null
/var/spool/postfix/pid/unix.smtp
anon_inode:[eventpoll]
/var/spool/postfix/active/68029568007B

Re: Suspicious process running under user postfix

Posted: 11 Oct 2013, 09:53
by voytek
if you're running postfix on this system, then, you can ignore it

I run postfix, and, I have in my ignore this:

grep postfix csf.pignore
exe:/usr/libexec/postfix/smtp
exe:/usr/libexec/postfix/smtpd
exe:/usr/libexec/postfix/pickup
exe:/usr/libexec/postfix/tlsmgr
exe:/usr/libexec/postfix/qmgr
exe:/usr/libexec/postfix/virtual
exe:/usr/libexec/postfix/proxymap
exe:/usr/libexec/postfix/anvil
exe:/usr/libexec/postfix/lmtp
exe:/usr/libexec/postfix/scache
exe:/usr/libexec/postfix/cleanup
exe:/usr/libexec/postfix/trivial-rewrite
exe:/usr/libexec/postfix/master