[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [cobalt-security] No more users in the webinterface.
- Subject: Re: [cobalt-security] No more users in the webinterface.
- From: Gerald Waugh <gwaugh@xxxxxxxxxxxxxxxxxxxxxxx>
- Date: Sun, 22 Sep 2002 11:43:26 -0400
- Organization: Front Street Networks LLC
- List-id: Mailing list for users to address network security on Cobalt products. <cobalt-security.list.cobalt.com>
On Sunday 22 September 2002 11:21, Christoph Jäger wrote:
> Hello all,
>
> Today I had something strange on my RAQ4:
> 1. In the Webinterface no more sites there
> 2. Repaired it with fixsite.pl
> 3. Now: No more users in the webinterface - but in passwd
> 4. No more mail is working...
>
> What was this - nobody configured something on the machine since about
> four days! What to do?
>
1st thing I would do,
check to see if the server was hacked.
run chkrootkit and tripwire
If OK
See if sendmail is running
ps aux | grep sendmail
if it's not running - try to start it
/etc/rc.d/init.d/sendmail start
Also look to see if it is listening
netstat -tupan | grep sendmail
Now try and run meta-verify to see if that will fix the users
Gerald
--
http://frontstreetnetworks.com http://raqware.com
Front Street Networks LLC | Phone: 203-785-0699
229 Front Street, Ste C, New Haven, CT 06513-3203