Hi Mark, Mark E. Levy wrote: > First the root password changes, now I'm getting the following in the > maillog and the mail server stops:
POSSIBLY, you have been hacked. I'd start looking around for other signs, as well. > NOQUEUE: SYSERR(root): /etc/mail/sendmail.cf: line 101: fileclass: cannot > open '/etc/mail/local-host-names': World-writable directory > > I also see /etc/mail/virthosts and /etc/mail/truster-users with the same > error. > > What should the permissions be for this tree? Maybe this will help: # ls -lah /etc/mail total 336K drwxr-xr-x 2 root root 4.0K Feb 7 03:18 . drwxr-xr-x 83 root root 12K Feb 8 18:15 .. -rw-r--r-- 1 root root 2.3K Feb 7 03:18 access -rw-r----- 1 smmsp root 12K Feb 7 03:18 access.db -rw-r--r-- 1 root root 1.6K Sep 17 11:15 aliases -rw-r----- 1 smmsp root 12K Feb 7 04:51 aliases.db -rw-r--r-- 1 root root 0 Mar 14 2007 domaintable -rw-r----- 1 smmsp root 12K Oct 3 02:20 domaintable.db -rw-r--r-- 1 root root 249 Jun 6 2006 fix_sendmail_header.mc -rw-r--r-- 1 root root 5.4K Mar 14 2007 helpfile -rw-r--r-- 1 root root 373 Feb 7 03:18 local-host-names -rw-r--r-- 1 root root 69 Nov 2 18:04 mailertable -rw-r----- 1 smmsp root 12K Nov 2 18:04 mailertable.db -rw-r--r-- 1 root root 1.1K Oct 3 02:22 Makefile -rw-r----- 1 root root 12K Feb 8 18:15 popip.db -rw-r----- 1 root root 3.9K Jun 3 2008 poprelay.conf -rw-r--r-- 1 root root 59K Feb 7 04:51 sendmail.cf -rw-r--r-- 1 root root 8.4K Dec 2 2008 sendmail.mc -r--r--r-- 1 root root 41K Mar 14 2007 submit.cf -rw-r--r-- 1 root root 940 Mar 14 2007 submit.mc -rw-r--r-- 1 root root 127 Mar 14 2007 trusted-users -rw------- 1 root root 0 Sep 17 11:15 virthosts -rw-r--r-- 1 root root 2.2K Feb 7 03:18 virtusertable -rw-r----- 1 smmsp root 12K Feb 7 03:18 virtusertable.db -- Chris Gebhardt VIRTBIZ Internet Services Access, Web Hosting, Colocation, Dedicated www.virtbiz.com | toll-free (866) 4 VIRTBIZ _______________________________________________ Blueonyx mailing list Blueonyx@blueonyx.it http://www.blueonyx.it/mailman/listinfo/blueonyx