Re: [cobalt-security] Should I worry

["Kevin D" <kdlists@xxxxxxxxxxxxxxx>]

If its coming from localhost (127.0.0.1) its probably just the raq polling
its own services to make sure sendmail is still running. Nothing to worry
about, you should filter these kinds of 127.0.0.1 (localhost) messages from
logcheck.

If it's from another IP, its worth looking into.

Kevin

----- Original Message -----
From: "njd 76" <njd76@xxxxxxxxxxx>
To: <cobalt-security@xxxxxxxxxxxxxxx>
Sent: Wednesday, December 12, 2001 10:09 AM
Subject: Re: [cobalt-security] Should I worry


>
> This has to be a problem. I have a RAQ4i and recieve the same problem when
i
> run logcheck.
>
> Dec 12 07:45:02 cobalt342 sendmail[6552]: NOQUEUE: localhost [127.0.0.1]
did
> not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
>
> Anyone know what it means?
>
> >From: "Audric Leperdi" <aleperdi@xxxxxxxxxxxxx>
> >Reply-To: cobalt-security@xxxxxxxxxxxxxxx
> >To: <cobalt-security@xxxxxxxxxxxxxxx>
> >Subject: [cobalt-security] Should I worry
> >Date: Wed, 12 Dec 2001 10:32:10 +0100
> >
> >During the last few days I got hundreds of these:
> >
> >Dec 12 09:04:08 qube3 sendmail[20950]: NOQUEUE: mrh.rcmail.com
> >[216.54.1.19] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
> >
> >should I worry.
> >
> >Meanwhile I changed the default rule of my firewall from accept to deny.
> >
> >Audric
> >
>
>
>
>
> _________________________________________________________________
> Get your FREE download of MSN Explorer at
http://explorer.msn.com/intl.asp.
>
> _______________________________________________
> cobalt-security mailing list
> cobalt-security@xxxxxxxxxxxxxxx
> http://list.cobalt.com/mailman/listinfo/cobalt-security
>