Re: [cobalt-security] No more users in the webinterface.

[Gerald Waugh <gwaugh@xxxxxxxxxxxxxxxxxxxxxxx>]

On Sunday 22 September 2002 11:21, Christoph Jäger wrote:
> Hello all,
>
> Today I had something strange on my RAQ4:
> 1. In the Webinterface no more sites there
> 2. Repaired it with fixsite.pl
> 3. Now: No more users in the webinterface - but in passwd
> 4. No more mail is working...
>
> What was this - nobody configured something on the machine since about
> four days! What to do?
>

1st thing I would do,
check to see if the server was hacked.
run chkrootkit and tripwire
If OK
See if sendmail is running
   ps aux | grep sendmail
if it's not running - try to start it
   /etc/rc.d/init.d/sendmail start
Also look to see if it is listening
   netstat -tupan | grep sendmail
Now try and run meta-verify to see if that will fix the users

Gerald
-- 
http://frontstreetnetworks.com         http://raqware.com
Front Street Networks LLC   |  Phone: 203-785-0699
229 Front Street, Ste C, New Haven, CT 06513-3203