[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
RE: [cobalt-security] ps -aux sendmail and netstat
- Subject: RE: [cobalt-security] ps -aux sendmail and netstat
- From: "Drage, Nicholas" <nickd@xxxxxxxxx>
- Date: Thu, 24 May 2001 10:24:47 +0100
- List-id: Mailing list for users to address network security on Cobalt products. <cobalt-security.list.cobalt.com>
> -----Original Message-----
> From: Carrie Bartkowiak [mailto:ravencarrie@xxxxxxxx]
> Sent: 23 May 2001 20:37
Sorry, this is a bit speculative but...
> root 27837 0.0 1.1 2636 1448 ? S 14:15 0:00
> sendmail: q4/f4NA8a102794 mail.elvisisthebomb.com.: user open
I've seen that--------------^^^^^^^^^^^^^^^^^^^^^^^^
somewhere before, and not for good reasons. Would suggest you check your
host for signs of a root kit or a mail relay.... or before all that, look in
the mailqueue and see what the email is about :)
<snip>
--
Nick Drage - Security Architecture - Demon Internet - Thus PLC
As of Thu 24/05/2001 at 9:00
This computer has been up for 26 days, 15 hours, 13 minutes, 18 seconds.