Re: [suse-security] pop3d bug? did i get hacked?

The problem with using qmail is that YaST2 will attempt to install one of its supported email packages whenever you run the software installation tool under YaST2. I complained to SuSE about that, and they didn't sound interested in changing YaST2 to accept qmail unless I paid them to do it. Easier and cheaper to learn to use Postfix, which they do support. Seems easy to configure, and no problems. Chris Shaker ----- Original Message ----- From: "spiekey" To: Sent: Thursday, February 14, 2002 4:51 AM Subject: Re: [suse-security] pop3d bug? did i get hacked?

you can get it from:

www.qmail.com

;D

Spiekey

----- Original Message ----- From: Mark Tinka To: spiekey Sent: Thursday, February 14, 2002 1:45 PM Subject: Re: [suse-security] pop3d bug? did i get hacked?

hi.. i was wondering whether u could tell me where you got qmail/pop3d from... i have been looking for it on the SuSE CDs, and on the web, with no luck..

much obliged.. thanks..

AKNIT

--- spiekey wrote: > Hello!

...

I am running SuSE7.3, SuSE Kernel. With the latest Sendmail and qmail/pop3d.

I was messing around with iptables and NAT yesterday, then i decided to reboot, just to be sure to flush all rules, but when the machine was back online, it wouldnt let me log into my mailaccount again. I doubt that it has something to do with the iptables stuff. I checked the traffic with tcpdump and everything goes to the right place. I can login with my username and passwd via ssh, so the account seems to be fine. What could the problem be? but my Server still seems to recive mails, where are they stored, cause i am expecting a very very important one. I send a testmail to it, but i couldt find it in /var/mail/username

Here is my log: Feb 14 09:30:43 susi kernel: Kernel log daemon terminating. Feb 14 09:30:44 susi exiting on signal 15 Feb 14 09:31:49 susi syslogd 1.4.1: restart. Feb 14 09:31:50 susi ctl_mboxlist[361]: done running mboxlist recovery Feb 14 09:31:50 susi master[481]: about to exec /usr/cyrus/bin/ctl_deliver Feb 14 09:31:50 susi in.identd[484]: started Feb 14 09:31:50 susi master[336]: no service 'sieve' in /etc/services, disabling sieve Feb 14 09:31:50 susi master[336]: ready for work Feb 14 09:31:50 susi master[500]: about to exec /usr/cyrus/bin/ctl_mboxlist Feb 14 09:31:50 susi ctl_mboxlist[500]: checkpointing mboxlist Feb 14 09:31:50 susi master[501]: about to exec /usr/cyrus/bin/ctl_deliver Feb 14 09:31:50 susi ctl_deliver[501]: duplicate_prune: pruning back 3 days Feb 14 09:31:50 susi master[336]: process 500 exited, status 0 Feb 14 09:31:50 susi ctl_deliver[501]: duplicate_prune: /var/imap/deliverdb/deliver-a.db: purged 0 out of 0 entries Feb 14 09:31:51 susi ctl_deliver[501]: duplicate_prune: /var/imap/deliverdb/deliver-b.db: purged 0 out of 0 entries Feb 14 09:31:51 susi ctl_deliver[501]: duplicate_prune: /var/imap/deliverdb/deliver-c.db: purged 0 out of 0 entries Feb 14 09:31:51 susi ctl_deliver[501]: duplicate_prune: /var/imap/deliverdb/deliver-d.db: purged 0 out of 0 entries Feb 14 09:31:51 susi ctl_deliver[501]: duplicate_prune: /var/imap/deliverdb/deliver-e.db: purged 0 out of 0 entries Feb 14 09:31:51 susi ctl_deliver[501]: duplicate_prune: /var/imap/deliverdb/deliver-f.db: purged 0 out of 0 entries Feb 14 09:31:51 susi ctl_deliver[501]: duplicate_prune: /var/imap/deliverdb/deliver-g.db: purged 0 out of 0 entries Feb 14 09:31:51 susi ctl_deliver[501]: duplicate_prune: /var/imap/deliverdb/deliver-h.db: purged 0 out of 0 entries Feb 14 09:31:51 susi ctl_deliver[501]: duplicate_prune: /var/imap/deliverdb/deliver-i.db: purged 0 out of 0 entries Feb 14 09:31:52 susi ctl_deliver[501]: duplicate_prune: /var/imap/deliverdb/deliver-j.db: purged 0 out of 0 entries Feb 14 09:31:53 susi ctl_deliver[501]: duplicate_prune: /var/imap/deliverdb/deliver-k.db: purged 0 out of 0 entries Feb 14 09:31:53 susi ctl_deliver[501]: duplicate_prune: /var/imap/deliverdb/deliver-l.db: purged 0 out of 0 entries Feb 14 09:31:53 susi ctl_deliver[501]: duplicate_prune: /var/imap/deliverdb/deliver-m.db: purged 0 out of 0 entries Feb 14 09:31:53 susi ctl_deliver[501]: duplicate_prune: /var/imap/deliverdb/deliver-n.db: purged 0 out of 0 entries Feb 14 09:31:53 susi ctl_deliver[501]: duplicate_prune: /var/imap/deliverdb/deliver-o.db: purged 0 out of 0 entries Feb 14 09:31:53 susi ctl_deliver[501]: duplicate_prune: /var/imap/deliverdb/deliver-p.db: purged 0 out of 0 entries Feb 14 09:31:53 susi ctl_deliver[501]: duplicate_prune: /var/imap/deliverdb/deliver-q.db: purged 0 out of 0 entries Feb 14 09:31:53 susi ctl_deliver[501]: duplicate_prune: /var/imap/deliverdb/deliver-r.db: purged 0 out of 0 entries Feb 14 09:31:53 susi ctl_deliver[501]: duplicate_prune: /var/imap/deliverdb/deliver-s.db: purged 0 out of 0 entries Feb 14 09:31:53 susi ctl_deliver[501]: duplicate_prune: /var/imap/deliverdb/deliver-t.db: purged 0 out of 0 entries ---snip--- Feb 14 09:32:02 susi /usr/sbin/cron[841]: (CRON) STARTUP (fork ok) Feb 14 09:32:32 susi sshd[1044]: Could not reverse map address 212.185.31.101. Feb 14 09:32:33 susi sshd[1044]: Accepted password for ROOT from ::ffff:212.185.31.101 port 2121 Feb 14 09:32:53 susi master[1066]: about to exec /usr/cyrus/bin/pop3d Feb 14 09:32:53 susi service-pop3[1066]: executed Feb 14 09:32:53 susi pop3d[1066]: accepted connection Feb 14 09:32:57 susi master[336]: process 1066 exited, status 0 Feb 14 09:33:02 susi master[1067]: about to exec /usr/cyrus/bin/pop3d Feb 14 09:33:02 susi service-pop3[1067]: executed Feb 14 09:33:02 susi pop3d[1067]: accepted connection Feb 14 09:33:02 susi pop3d[1067]: login: [212.185.31.101] mario plaintext Feb 14 09:33:06 susi master[336]: process 1067 exited, status 0 Feb 14 09:33:39 susi master[1069]: about to exec /usr/cyrus/bin/pop3d Feb 14 09:33:39 susi service-pop3[1069]: executed Feb 14 09:33:39 susi pop3d[1069]: accepted connection Feb 14 09:33:40 susi pop3d[1069]: login: [212.185.31.101] mario plaintext Feb 14 09:33:43 susi master[336]: process 1069 exited, status 0 Feb 14 09:33:46 susi master[1070]: about to exec /usr/cyrus/bin/pop3d Feb 14 09:33:46 susi service-pop3[1070]: executed Feb 14 09:33:46 susi pop3d[1070]: accepted connection Feb 14 09:33:46 susi pop3d[1070]: login: [212.185.31.101] mario plaintext Feb 14 09:33:49 susi master[336]: process 1070 exited, status 0

MY Error log from Outlook: There was a problem logging onto your mail server. Your Password was rejected. Account: 'ohnewald.2y.net', Server: 'ohnewald.2y.net', Protocol: POP3, Server Response: '-ERR Invalid login', Port: 110, Secure(SSL): No, Server Error: 0x800CCC90, Error Number: 0x800CCC92

Thanks a lot!

Spiekey

-- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com

__________________________________________________ Do You Yahoo!? Everything you'll ever need on one web page from News and Sport to Email and Music Charts http://uk.my.yahoo.com

-- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com