>From yesterday I discover very strange behavior of spamdyke, all time
before all was good:
First running copy stay resident and listen network. Short log:
host# strace -p 12787 -e trace=network
Process 12787 attached - interrupt to quit
accept(3, 0xbfffc050, [16]) = ? ERESTARTSYS (To be
restarted)
--- SIGCHLD (Child exited) @ 0 (0) ---
accept(3, {sa_family=AF_INET, sin_port=htons(4430), sin_addr=inet_addr
("88.229.222.135")}, [16]) = 0 accept(3, {sa_family=AF_INET,
sin_port=htons(3953), sin_addr=inet_addr("83.166.219.102")}, [16]) = 0
accept(3, {sa_family=AF_INET, sin_port=htons(2396), sin_addr=inet_addr
("189.0.199.23")}, [16]) = 0 accept(3, {sa_family=AF_INET,
sin_port=htons(13776), sin_addr=inet_addr("122.164.34.160")}, [16]) = 0
accept(3, 0xbfffc050, [16]) = ? ERESTARTSYS (To be
restarted)
--- SIGCHLD (Child exited) @ 0 (0) ---
accept(3, 0xbfffc050, [16]) = ? ERESTARTSYS (To be
restarted)
--- SIGCHLD (Child exited) @ 0 (0) ---
accept(3, 0xbfffc050, [16]) = ? ERESTARTSYS (To be
restarted)
--- SIGCHLD (Child exited) @ 0 (0) ---
accept(3, {sa_family=AF_INET, sin_port=htons(58206), sin_addr=inet_addr
("123.248.102.135")}, [16]) = 0 accept(3, 0xbfffc050, [16])
= ? ERESTARTSYS (To be restarted)
--- SIGCHLD (Child exited) @ 0 (0) ---
accept(3, {sa_family=AF_INET, sin_port=htons(2693), sin_addr=inet_addr
("85.104.38.223")}, [16]) = 0 accept(3, 0xbfffc050, [16])
= ? ERESTARTSYS (To be restarted)
--- SIGCHLD (Child exited) @ 0 (0) ---
accept(3, {sa_family=AF_INET, sin_port=htons(4269), sin_addr=inet_addr
("83.166.219.102")}, [16]) = 0 accept(3, {sa_family=AF_INET,
sin_port=htons(2788), sin_addr=inet_addr("85.104.38.223")}, [16]) = 0
accept(3, 0xbfffc050, [16]) = ? ERESTARTSYS (To be
restarted)
--- SIGCHLD (Child exited) @ 0 (0) ---
accept(3, 0xbfffc050, [16]) = ? ERESTARTSYS (To be
restarted)
--- SIGCHLD (Child exited) @ 0 (0) ---
accept(3, {sa_family=AF_INET, sin_port=htons(2852), sin_addr=inet_addr
("85.104.38.223")}, [16]) = 0 accept(3, {sa_family=AF_INET,
sin_port=htons(4547), sin_addr=inet_addr("83.166.219.102")}, [16]) = 0
accept(3, 0xbfffc050, [16]) = ? ERESTARTSYS (To be
restarted)
--- SIGCHLD (Child exited) @ 0 (0) ---
accept(3, 0xbfffc050, [16]) = ? ERESTARTSYS (To be
restarted)
--- SIGCHLD (Child exited) @ 0 (0) ---
accept(3, {sa_family=AF_INET, sin_port=htons(2894), sin_addr=inet_addr
("85.104.38.223")}, [16]) = 0 accept(3, {sa_family=AF_INET,
sin_port=htons(1268), sin_addr=inet_addr("200.88.97.100")}, [16]) = 0
accept(3, {sa_family=AF_INET, sin_port=htons(1269), sin_addr=inet_addr
("200.88.97.100")}, [16]) = 0
and so on...
What is it - some bug in configuration of qmail (I didn't change
anything in a work spamdyke conf) or new hacker attack?
P.S. I'm sorry about previous mail - I didn't wait for full stop of all
smtp processes.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Regards
Nicholas A. Novozhilov, NAN6-RIPE
NTR Lab
System administrator
_______________________________________________
spamdyke-users mailing list
[email protected]
http://www.spamdyke.org/mailman/listinfo/spamdyke-users
