Seeing these entries in your auth.log is completely normal when Sendmail is installed on your Ubuntu server, even if you're primarily using Postfix. The smmsp user (Sendmail Mail Submission Program) is part of Sendmail's architecture for handling mail queue processing.

# Typical log entries you might see
Oct 26 08:40:01 server CRON[4737]: pam_unix(cron:session): session opened for user smmsp by (uid=0)
Oct 26 08:40:01 server CRON[4737]: pam_unix(cron:session): session closed for user smmsp

Even though you're using Postfix as your MTA, some Ubuntu/Debian packages may still install Sendmail components for compatibility. The cron job you're seeing comes from /etc/cron.d/sendmail:

# Contents of /etc/cron.d/sendmail
*/20 * * * * smmsp test -x /etc/init.d/sendmail && /usr/share/sendmail/sendmail cron-msp

The cron job performs several important functions every 20 minutes:

1. Checks if Sendmail is executable (test -x /etc/init.d/sendmail)
2. Runs the Sendmail MSP (Mail Submission Program) queue processing
3. Handles any stuck messages in the submission queue

This is generally harmless, but there are a few considerations:

# Check if Sendmail is actually running
$ service sendmail status
MSP: is run via cron (20m)
MTA: is not running
QUE: Same as MTA

Since your MTA (Postfix) is separate from Sendmail's MSP, there's minimal conflict. However, if you want to completely remove Sendmail:

# Complete removal (if you don't need Sendmail compatibility)
$ sudo apt-get purge sendmail*
$ sudo rm /etc/cron.d/sendmail

If you want to keep Sendmail components but disable the cron job:

# Option 1: Remove execute permissions
$ sudo chmod -x /etc/init.d/sendmail

# Option 2: Comment out the cron entry
$ sudo nano /etc/cron.d/sendmail
# Add # at the beginning of the line

After any changes, test your mail system:

# Send a test email
$ echo "Test message" | mail -s "Test Subject" your@email.com

# Check mail queues
$ mailq  # For Postfix
$ sudo -u smmsp /usr/share/sendmail/sendmail -bp  # For Sendmail MSP

---

When examining Ubuntu server logs, finding repeated cron jobs executing as the smmsp user is generally normal behavior in mail server configurations. The smmsp (Sendmail Message Submission Program) user is specifically created for Sendmail operations.

The auth.log entries indicate regular cron sessions:

Oct 26 08:40:01 andre CRON[4737]: pam_unix(cron:session): session opened for user smmsp by (uid=0)
Oct 26 08:40:01 andre CRON[4737]: pam_unix(cron:session): session closed for user smmsp

These correspond with the Sendmail MSP (Message Submission Program) queue runner executing every 20 minutes as shown by:

service sendmail status
MSP: is run via cron (20m)

The /etc/cron.d/sendmail file contains the job definition:

# /etc/cron.d/sendmail: crontab entries for the sendmail package
*/20 * * * * smmsp test -x /etc/init.d/sendmail && /usr/share/sendmail/sendmail cron-msp

This configuration is standard in Debian/Ubuntu systems using Sendmail.

Even though POSTFIX is handling mail delivery, Sendmail compatibility layers remain active:

Oct 27 08:20:01 andre postfix/pickup[1272]: 1F29212C7FF: uid=107 from=
Oct 27 08:20:01 andre postfix/local[7685]: 1F29212C7FF: to=

The cron-msp process submits messages to POSTFIX via the sendmail compatibility interface.

While this behavior is normal, you should verify:

1. The smmsp user has restricted permissions (typically uid 107)
2. No unusual commands are being executed in the cron jobs
3. Mail queue contents are legitimate

Check the user entry with:

grep smmsp /etc/passwd
smmsp:x:107:113:Mail Submission User,,,:/var/lib/sendmail:/bin/false

If you're not using Sendmail compatibility features, you can safely disable:

sudo chmod -x /etc/cron.d/sendmail
sudo systemctl disable sendmail

However, some legacy applications may still expect the sendmail binary to be present.

For pure POSTFIX systems, consider removing sendmail entirely:

sudo apt-get purge sendmail sendmail-bin sendmail-cf
sudo apt-get autoremove

This will eliminate the cron jobs while maintaining POSTFIX functionality.