Re: [cobalt-security] Spam Users

["@lfa" <alfa@xxxxxxxxxx>]

Hi Andres

Install "POP before SMTP".

find your patches here: http://sunsolve.sun.com/patches/cobalt/

if you have it installed you might need to patch read this: 

"POPRelayD Relay Authentication Vulnerability"
http://us.cns911.com/holes/otherapp/otherapp01071002.php

@lfa

*********** REPLY SEPARATOR  ***********

Once upon a time  31.08.2002 at 11:30 Andres C. scribbled:

>I got some probmlem on one of my cobalts
>When y do a ps x | grep sendmail, they show me a lots of users conected and
>sending mail from my own server like u could see below.
>
>How can i stop this use from remote users?
>Doing the same in another raq, this not happen'
>
>
>[root admin]# ps x | grep sendmail
>21965 ?        S      0:13 sendmail: accepting connections
>21968 ?        S      0:00 /usr/sbin/sendmail -q15m
>24826 ?        S      0:00 sendmail: q1/g7R2MFZ11795 uctem.cl.: user open
>13760 ?        S      0:00 sendmail: q1/g7QN3n028095 compugraph.com.: user
>open
>18055 ?        S      0:00 sendmail: q1/g7QKpE015291 nomail.o0o.net.: user
>open
>18728 ?        S      0:00 sendmail: q1/g7QN3a028055 bedfordnet.com.: user
>open
>19519 ?        S      0:00 sendmail: q1/g7SAhRr03928 neunet.com.: user open
>22239 ?        S      0:00 sendmail: q1/g7QLh9020253 mail.cwi.net.: user
>open
>23134 ?        S      0:00 sendmail: q1/g7QM7v022467 mail.cwi.net.: user
>open
>24066 ?        S      0:00 sendmail: q1/g7QDv0012340 bedfordnet.com.: user
>open
>24863 ?        S      0:00 sendmail: q1/g7QD0P007842 10.0.0.1.: user open
>25637 ?        S      0:00 sendmail: q1/g7QD9W008548 bedfordnet.com.: user
>open
>26493 ?        S      0:00 sendmail: q1/g7QDKm009457 mail.cwi.net.: user
>open
>27293 ?        S      0:00 sendmail: q3/g7S1Zb924974 chilesite.com.: user
>open
>28218 ?        S      0:00 sendmail: q1/g7REkc027549 bbs.pinos.com.: user
>open
>29378 ?        S      0:00 sendmail: q1/g7SJcir22287
>mta2-mail.england.com.:
>use
>30690 ?        S      0:00 sendmail: q1/g7SJV9r21587
>mta2-mail.england.com.:
>use
>31810 ?        S      0:00 sendmail: q1/g7V2dFZ14954
>mail.eroticmailcenter.com.:
>31811 ?        S      0:00 sendmail: q2/g7V6d6G29464
>smtp.sbs-promotion.co.jp.:
>32483 pts/1    S      0:00 grep sendmail
>
>
>_______________________________________________
>cobalt-security mailing list
>cobalt-security@xxxxxxxxxxxxxxx
>http://list.cobalt.com/mailman/listinfo/cobalt-security