Able to send mail without running MTA (sendmail)?

UNIX AIX
1

Hi,

I am facing a (for me and coworkers) strange behaviour. When I stop sendmail on a plain AIX 5.3 testing box (there is definetly no sendmail process left running anymore), I am still able to send mails to remote addresses via the mail command. I tried that on another box which is not a testing box just to make sure there is nothing awkward on the testing box.

If I try that on a Linux box after having postfix stopped, it doesn't send any mail but queues it, as expected.

I have no clue what is still enabling the AIX box to send mail after sendmail is stopped. Any ideas? Thanks in forward.

Cheers
zaxxon

2

I can reproduce this behavior on Solaris 10. Even when sendmail is stopped, mailx is able to send mails.

I looked into this with "truss" and found, that mailx is executing /usr/lib/sendmail to deliver the mail. This happens no matter if sendmail is running as daemon or not.

I suppose this is true for AIX too.

3

Now I started this thread after some time of searching I just found this:

IBM Info Center - bellmail

So it seems that mail is calling bellmail as MDA to transfer mail. That might explain it, ok, sorry for the trouble but any confirmations on that are welcome though.

4

No trouble at all, glad I could help.

1 Like
5

truss did not show which tool has been called (maybe wrong parameters, not sure), sadly, but it seems bellmail is the one being called to deliver. Thanks again though ^^

6

Did you call truss with the -f switch to follow childs? In this case you can see the execve system call. Here it looks like this:

...
22307:  fork1()                                         = 22315
22307:  lwp_sigmask(SIG_SETMASK, 0x00000000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF]
22307:  llseek(6, 0, SEEK_CUR)                          = 0
22315:  fork1()         (returning as child ...)        = 22307
...
22315:  execve("/usr/lib/sendmail", 0x08084B40, 0x08047D00)  argc = 3
22315:      *** SGID: rgid/egid/sgid = 0 / 25 / 25  ***
22315:  resolvepath("/usr/lib/ld.so.1", "/lib/ld.so.1", 1023) = 12
...
1 Like
7

That was the one, thanks :slight_smile:

331994: execve("/usr/sbin/sendmail", 0x200CAD18, 0x2FF22AD4)  argc: 4
331994: access("/usr/lib/nls/msg/en_US.8859-15/sendmail811.cat", 0) = 0
331994: statx("/etc/mail/sendmail.cf", 0x2FF1EFB0, 76, 0) = 0
331994: open("/etc/mail/sendmail.cf", O_RDONLY)         = 4
331994: auditlog("SENDMAIL_Config", 0, "Sendmail configuration file read.", 34) Err#22 EINVAL
331994: open("/usr/lib/nls/msg/en_US.8859-15/sendmail811.cat", O_RDONLY) = 5
278564: open("/usr/lib/nls/msg/en_US.8859-15/sendmail811.cat", O_RDONLY) = 4

So it is calling sendmail as well, not bellmail.