On Sunday 22 September 2002 11:21, Christoph J�ger wrote: > Hello all, > > Today I had something strange on my RAQ4: > 1. In the Webinterface no more sites there > 2. Repaired it with fixsite.pl > 3. Now: No more users in the webinterface - but in passwd > 4. No more mail is working... > > What was this - nobody configured something on the machine since about > four days! What to do? >
1st thing I would do, check to see if the server was hacked. run chkrootkit and tripwire If OK See if sendmail is running ps aux | grep sendmail if it's not running - try to start it /etc/rc.d/init.d/sendmail start Also look to see if it is listening netstat -tupan | grep sendmail Now try and run meta-verify to see if that will fix the users Gerald -- http://frontstreetnetworks.com http://raqware.com Front Street Networks LLC | Phone: 203-785-0699 229 Front Street, Ste C, New Haven, CT 06513-3203 _______________________________________________ cobalt-security mailing list [EMAIL PROTECTED] http://list.cobalt.com/mailman/listinfo/cobalt-security
