> On Tuesday 04 December 2001 01:42 pm, you wrote: > > <SNIP!> > > > > What alert program are you using? > > I have no idea! And I don't know how to find out...this is > all what came set up...I DID run something to start > something called "tripwire" (and now I'm sorry)...a mail > came as soon as I booted RH7.1 for the very first time > after installing, and told me to run "tripwire --init" or > whatever, so I did. But I didn't do anything else; these > just started coming for no reason (well, no reason that_I_ > I can see! ;-)
This is not from tripwire. The original message had this line: X-Mailer: /usr/lib/mon/alert.d/mail.alert Try rpm -q --whatprovides /usr/lib/mon/alert.d/mail.alert o see if it is an rpm package. Otherwise, do you remember installing some program like this? > > > It looks to me like > > some program (possibly the alert program) is trying to > > telnet to localhost. > > Either that, or someone is trying to break into the system? > But it says that the "connection [was] refused"...anyway, > what the heck can I do to trace down this problem? What > makes things run automatically on a Linux system? Where > does it have the files to configure this? I know it's > something easy, but the ol' grey cells are getting scarce > these days... :-) > > --mVIIs Your original post also had this: localhost: problem connecting to "localhost", port 23: Connection refused Which tells me that something was telnetting to localhost (i.e. not from the outside). If you or any other users of that system are not telnetting to localhost, I would say that it must be some program. Try looking in /usr/lib/mon/alert.d/ and see what you can find. Forrest _______________________________________________ Seawolf-list mailing list [EMAIL PROTECTED] https://listman.redhat.com/mailman/listinfo/seawolf-list
