Checking `bindshell'... INFECTED (PORTS:  465)

After a quick research I realized that this port 465 is SMTP over SSL on a Zimbra installation.
Further investigation reveals that port 465 is run by

# fuser -vn tcp 465

                     USER        PID ACCESS COMMAND
465/tcp:             root      19053 F.... master

And then I checked pid 19053

# ps aux|grep 19053
root     19053  0.0  0.2   6628  1236 ?        Ss   Feb09   0:00 /opt/zimbra/postfix-2.4.3.4z/libexec/master

This tells me that the postfix daemon is running on port 465 and obviously chkrootkit is giving me a false positive.

root:           user@example.com

The postfix daemon have to reread it’s config files before this change is recognized.
Do the following as zimbra user

/opt/zimbra/bin/postfix reload

The solution to this problem was to remove exim or locate the sendmail binaries and remove the symlinks to exim as emailer client and create symlinks to Zimbra’s Postfix sendmail binary. I did the latter

# whereis sendmail
sendmail: /usr/sbin/sendmail /usr/lib/sendmail

# rm /usr/sbin/sendmail
# ln -s /opt/zimbra/postfix-2.4.3.4z/sbin/sendmail sendmail
# rm /usr/lib/sendmail
# ln -s /opt/zimbra/postfix-2.4.3.4z/sbin/sendmail sendmail

Now my scripts can send e-mails as expected.

1. Edit /etc/postfix/virtual This is a plaintext file where you can specify the domains and users to accept mail for. Each virtual domain should begin with a single line containing the domain name. The subsequent lines define addresses at the domain that are deliverable. Mail will be delivered to local usernames on the right side, as demonstrated in the example below. The condition @domain allows you to deliver “all other” mail to the indicated user. You can list multiple domains in this file; just repeat the format demonstrated below.

example.com		this-text-is-ignored
postmaster@example.com	postmaster
address1@example.com	destuser1
address2@example.com	destuser2
@example.com		destuser1

2. Edit /etc/postfix/main.cf

You have to tell postfix where to look for these virtual alias mappings; the appropriate configuration directive is in the main postfix configuration file. This tells postfix to use the db-format (hash) version of your virtual mappings. Note that your system must have db support for this to work; also, the actual db file is not created until you run ‘postmap’ in step 3.

virtual_alias_maps = hash:/etc/postfix/virtual

3. Refresh configuration and mappings

Since you’ve changed main.cf, you should restart the daemon. The second command below updates the virtual mappings; you must run this ‘postmap’ command when you change your /etc/postfix/virtual file. The ‘postmap’ command actually creates the hash db file that postfix looks for.

postfix reload
postmap /etc/postfix/virtual

Now try delivering mail to virtual domain addresses. If you encounter problems, check your mailer daemon system log and make sure your server configuration has been refreshed with ‘postfix reload’ and the ‘postmap’ commands.

When Postfix does not receive or deliver mail, the first order of business is to look for errors that prevent Postfix from working properly:

% egrep '(warning|error|fatal|panic):' /some/log/file | more

Note: the most important message is near the BEGINNING of the output. Error messages that come later are less useful.

The nature of each problem is indicated as follows:

• “panic” indicates a problem in the software itself that only a programmer can fix. Postfix cannot proceed until this is fixed.
• “fatal” is the result of missing files, incorrect permissions, incorrect configuration file settings that you can fix. Postfix cannot proceed until this is fixed.
• “error” reports an error condition. For safety reasons, a Postfix process will terminate when more than 13 of these happen.
• “warning” indicates a non-fatal error. These are problems that you may not be able to fix (such as a broken DNS server elsewhere on the network) but may also indicate local configuration errors that could become a problem later.