Mailing List
Home
Linux - General Red Hat Linux discussion list
Enterprise Linux 3 - Discussion of Red Hat Enterprise Linux 3 (Taroon)
Red Hat Linux 9 - Discussion of Red Hat Linux 9 (Shrike)
Installation - Getting started with Red Hat Linux
Red Hat Linux 7.3 - Discussion of Red Hat Linux 7.3 (Valhalla)
Red Hat Linux 8.0 - Discussion of Red Hat Linux 8.0 (Psyche)
Red Hat Linux 7.2 - Discussion of Red Hat Linux 7.2 (Enigma)
Red Hat Linux 7.1 - Discussion of Red Hat Linux 7.1 (Seawolf)
Apache Web Server
Oracle database, Microsoft SQL server ...
Subjects
• application/x mplayer2 plugin
• RPM error: db4 error(16) from dbenv >remove: Device or resource
   busy
• Command stream end of file while reading
• X Windows problem (xauth)
• Upgrading openoffice 1 1 rpm
• FTP: connection refused
• FTP: connection refused
• mount: /dev/cdrom: is not a valid block device
• Dell Precision 650, RedHat 9, no sound
• how to trace the cause resulting in the crash of bind server
• Virus on the list
• UNINSTALL RPM MYSQL
• usb pen drives: mounting as a user
• broadcom network interface
• make mrproper
• sendmail configuration on redhat
• Couldn 't open PID file /var/run/named/named pid Permission denied
• Promise 378 controller
• kernel 2 6 and /dev/sound/mixer not found
• Problem using up2date
• mrtg step by step howto/configuration for a newbie?
• Compiling and Installing Kernel 2 6
• Can 't locate module ppp0, can 't locate module ppp compress 21
• HOW I CAN MAKE BOOTABLE FLOPPY DISKET
• Lotus Notes under Wine
• /etc/security/limits conf question
• Intel E/1000 driver
• Command stream end of file while reading
• rpm database corrupt
• qla2300 modules
 
Search:  
Power your search with and, or, +, -, or "some phrase" operators.
Someone is probing me thru sendmail?

Someone is probing me thru sendmail?

2004-01-29       - By Reuben D. Budiardja

 Back
Reply:     1     2     3     4  


Hi all,
I 'm wondering if someone can help me interpret this. I got lots of this in my
maillog:
..
1958:Jan 27 05:52:03 voyager sendmail[13700]: i0RAq3413700:
<peter@(protected) >... User unknown
1962:Jan 27 06:01:10 voyager sendmail[13758]: i0RB19413758:
<sandra@(protected) >... User unknown
1969:Jan 27 06:08:46 voyager sendmail[13808]: i0RB8j413808:
<ray@(protected) >... User unknown
..

and (sometimes) correspondingly in the next line the following also exist:

jan 27 05:36:58 voyager sendmail[13585]: i0RAaw413585: lost input channel from
adsl-66-73-195-63.dsl.chcgil.ameritech.net [66.73.195.63] to MTA after rcpt
Jan 27 05:36:58 voyager sendmail[13585]: i0RAaw413585:
from= <ruiglopes@(protected) >, size=0, class=0, nrcpts=0, proto=ESMTP,
daemon=MTA, relay=adsl-66-73-195-63.dsl.chcgil.ameritech.net [66.73.195.63]
Jan 27 05:38:30 voyager sendmail[13590]: i0RAcU413590: lost input channel from
adsl-66-73-195-63.dsl.chcgil.ameritech.net [66.73.195.63] to MTA after rcpt
Jan 27 05:38:30 voyager sendmail[13590]: i0RAcU413590:

What is the "lost input channel " mean? Does this mean someone try to probe
what user exists on my server? should I be worried?

I just noticed also this happen to my other machine. One of the email got thru
and I received mail that contains file.zip and document.zip. I looked at the
header and it looks like it 's from 66.73.195.63, althouh I know it can be
forged.

Any help is greatly appreciated. Thanks.
RDB
--
Reuben D. Budiardja
Department of Physics and Astronomy
The University of Tennessee, Knoxville, TN
-- ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ----
"To be a nemesis, you have to actively try to destroy
something, don 't you? Really, I 'm not out to destroy
Microsoft. That will just be a completely unintentional
side effect. "
- Linus Torvalds -


--
redhat-list mailing list
unsubscribe mailto:redhat-list-request@(protected)?subject=unsubscribe
https://www.redhat.com/mailman/listinfo/redhat-list