My logs are filling up with an error that something wants to send an email notification. It tries every ten minutes, and fails, because it is trying to send to 'root'. The email settings in SMTP are correct, I can send the test message successfully. I've turned off every notification I can find in settings. I've turned off all my docker apps, and it still occurs. If I 'break' my SMTP settings, I get a different error, but still get them every ten minutes. I've done reboots, and just upgraded to 6.12.3 a few hours ago, and it is still happening. 

 

Here's the error in the logs when SMTP is correct:

 

Jul 14 10:50:17 Valaskjalf  sSMTP[2599]: Creating SSL connection to host
Jul 14 10:50:17 Valaskjalf  sSMTP[2599]: SSL connection using TLS_AES_256_GCM_SHA384
Jul 14 10:50:20 Valaskjalf  sSMTP[2599]: 550 5.2.254 InvalidRecipientsException; Sender throttled due to continuous invalid recipients errors.; STOREDRV.Submission.Exception:InvalidRecipientsException; Failed to process message due to a permanent exception with message [BeginDiagnosticData]Recipient 'root' is not resolved. All recipients must be resolved before a message can be submitted. InvalidRecipientsException: Recipient 'root' is not resolved. All recipients must be resolved before a message can be submitted.[EndDiagnosticData] [Hostname=SN7PR06MB9281.namprd06.prod.outlook.com]

 

and this is when SMTP is broken:

Jul 14 11:00:16 Valaskjalf  sSMTP[7332]: Unable to locate 
Jul 14 11:00:16 Valaskjalf  sSMTP[7332]: Cannot open :0

 

 

How do I find what is trying to send this notification?

 

 

valaskjalf-diagnostics-20230715-0603.zip

tor
/usr/local/sbin/emhttp &
/bin/bash /boot/config/wireguard/go

 

Except for the emhttp line these entries in you go file look suspicious, I believe other users had the same after finding some crypto thing running, remove those lines and any files in /boot/extra and reboot.

I did indeed get the crypto hack a while back. I thought it was all cleaned out... I'll fix those items.