Thanks for the answers so far. So NOQUEUE: [218.79.178.192] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA is nothing to worry about. However I'm very worried about the PAM-warn[19900]: user: (uid=0) -> admin [remote: ?nobody@?nowhere] messages. It looks to me as if someone already has gained root rights and made an su to "admin" (which should be impossible, because /etc/passwd as I see it doesn't contain that user). I hope to be misleaded... Best regards, Matthias