Hello,

ENVIRONMENT:
OS: Solaris 10
Sendmail: 8.13.8+Sun

BACKGROUND:
We had a user account that was compromised and was used as a relay. She sent out (or would have if we didn't kill sendmail) ~10K emails alerting people they just won $75K.

The target for this spam was everyone internal to our company and EVERYONE with an @aol.com address, maybe other domains as well, we just stopped looking. Stopping all mail for our company until we took her offline was not a suitable solution.

QUESTION:
Is it possible to configure sendmail as to block ALL OUTGOING email from ONE user? I don't want to shut down mail for the entire organization again. I've seen solutions on how to block INCOMING and how to block outgoing TO targets, but not how to block ALL OUTGOING FROM the sender.

Any help would be greatly appreciated.

You did block/stop/delete whatever caused the one account to become a spambot, right? Othwerise the problem will spread to other user accounts. And this answer becomnes pointless.

You can employ setfacl to block execute access for the sendmail image for use by one specific username. I would completely disable that account, and move it to the nobody group if you have one. I would also question any file that user had write acces to. Then give the user another, new account.