I will e-mail josswin, as he maybe compromised. I am using Postfix, what should I look for on the server? Not sure if I have been broken into, but its certainly shaken me up (and its best to assume that I have been compromised, better safe than sorry). Now checking through Nix's website, nice to have a rescource like that! Matt On Sunday 28 January 2001 05:53 pm, Nix wrote:
At 12:40 PM 29/01/2001, you wrote:
Dear All
Here is the contents of that e-mail:
From: FETCHMAIL-DAEMON@josswinn.org To: matthew@psychohorse.com Date: Mon, 29 Jan 2001 07:04:08 +0900
I've been getting these for a few days. Not sure where from ?
On Thursday night at midnight my net facing box was broken into and someone replaced sendmail.cf with another one. What this meant was that when my box downloaded mail it then forwarded ti to many people on the internet. I discovered this and replaced sendmail.cf before any damage was done.
Tonight I was about to reply to this e-mail at about midnight and someone broke in and destroyed my Pine 4.32 mail app. That meant that I couldn't send this mail either.
So, what's going on ? I don't know either.
Mate, Unplug the box from the net. If it has been broken into you don't know what has been compromised Please email me back privately if you need help. I will be contactable for the next 8hrs or so by email. (I am ducking out to grab some lunch now, but will be back in 20min..)
Cheers
--- Nix - nix@susesecurity.com http://www.susesecurity.com
--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com