[Mimedefang] Don't know what happened

[Brad Tarver]

I hope not. It's got the newest kernel and sendmail RPMs from Redhat
(with all the backported patchces). The only port open on the firewall
to that server is 25. No remote access in from the outside.

Any suggestions?



-----Original Message-----
From: mimedefang-bounces at lists.roaringpenguin.com
[mailto:mimedefang-bounces at lists.roaringpenguin.com] On Behalf Of David
F. Skoll
Sent: Tuesday, January 06, 2004 11:07 AM
To: mimedefang at lists.roaringpenguin.com
Subject: RE: [Mimedefang] Don't know what happened


On Tue, 6 Jan 2004, Brad Tarver wrote:

> I set confMILTER_LOG_LEVEL to 21. The other things you suggested were 
> already set. I even recompiled MD with the debugging flag. I still 
> don't get any indications as to why MD won't start.

This is a long shot, but I had a CanIt customer whose setup died in
exactly the way you describe.  His kernel was taking forever to execute
the "setgid" system call.  I believe it was the result of a system
compromise.

Could your kernel have been hacked?

Regards,

David.
_______________________________________________
Visit http://www.mimedefang.org and http://www.canit.ca MIMEDefang
mailing list MIMEDefang at lists.roaringpenguin.com
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang