Unsolicited e-mails

[km1kze]

Hello all,

 

I started to receive unsolicited e-mails from my Nanopi NEO and couldn't figure it out what are triggering them. I checked my crontab and there is nothing there.

Please if someone knows to clarify this, I would be very grateful, I'm relatively new to linux.

 

My root crontab:

00 02 1 * * sh /home/pi/updategeoip.sh
0 6 * * * /sbin/shutdown -r now
*/5 * * * * python /home/pi/tempalert.py 2>&1

 

My user crontab:

0,15,30,45 * * * * sh /home/pi/sendip.sh &>/dev/null

 

The e-mail is sent everyday at 06:25 +0000 and seems to be activated by this command:

test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )

 

The content of the (failed) e-mails:
 

The response was:

DNS Error: 11584654 DNS type 'mx' lookup of localhost responded with code NXDOMAIN Domain name not found: localhost

Final-Recipient: rfc822; postmaster@localhost
Action: failed
Status: 4.0.0
Diagnostic-Code: smtp; DNS Error: 11584654 DNS type 'mx' lookup of localhost responded with code NXDOMAIN
 Domain name not found: localhost
Last-Attempt-Date: Mon, 25 Sep 2017 23:25:11 -0700 (PDT)


---------- Forwarded message ----------
From: root <****private e-mail address*****>
To: root
Cc:
Bcc:
Date: Tue, 26 Sep 2017 06:25:07 +0000
Subject: Cron <root@nanopineo> test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
/etc/cron.daily/log2ram:
sending incremental file list
./
auth.log
kern.log
lastlog
mail.log
syslog
syslog.1
syslog.2.gz
syslog.3.gz
syslog.4.gz
wtmp
lightdm/
lightdm/lightdm.log
lightdm/lightdm.log.1.gz
lightdm/lightdm.log.2.gz
unattended-upgrades/unattended-upgrades.log

sent 20,636,219 bytes  received 307 bytes  13,757,684.00 bytes/sec
total size is 25,864,247  speedup is 1.25

 

[km1kze]

I manage to track where these commands come from...

I searched for a part of the command string with this (run from /etc directory):

sudo grep -R  "run-parts --report /etc/cron.daily"

 

And found out that it was inside a crontab file (called the system wide crontab - more info here )

 

After some research I managed to stop the annoying emails by writing

> /dev/null

after every command found in that crontab, and then restart the cron

sudo service cron reload