Re: [cobalt-security] sendmail and yay i got a r00t

["Michael Zimmermann" <zim@xxxxxxxx>]

From: dylan <dylan@xxxxxxxxxxxxxx>
> Anyone have any tips for upgrading Sendmail? 
> There doesnt seem to be an official patch. This is for a raq2. 

Just curious - why not use the new sendmail compiling it from
the sources? Is this not possible on a RaQ2?

> [...] I couldnt get root because the /var/ partition was full 
> (thats /dev/hd*c ) so I had to mount it in a Mandrake box and 
> remove the file - analog.dns which was .. well.. it was massive.
>
> Yup, an official bug. Edit analog.cfg and use /tmp instead of /var 

It's normal behaviour for analog to let its dns-resolution 
cache-file grow and grow and grow. I'd think it would
be better to install a (say) weekly cron-job, which keeps
only the last (say) 10000 records of analog.dns. 
Depending of course on the span your analyzed 
http-logs are going to cover (and the time-intervall 
after which analog is asked to do fresh dns-lookups - 
DNSGOODHOURS and DNSBADHOURS)


Michael