Date: Wed, 19 Jul 2006 22:12:51 -0400 (EDT) From: Tuc at T-B-O-H <ml@t-b-o-h.net> To: darek@nyi.net (Darek M) Cc: "Tuc at T-B-O-H.NET" <ml@t-b-o-h.net>, freebsd-questions@freebsd.org Subject: (SOLVED) nologin: Attempted login by root on UNKNOWN Message-ID: <200607200212.k6K2Cpro008129@vjofn.tucs-beachin-obx-house.com> In-Reply-To: <44BD9E84.1030905@nyi.net> from "Darek M" at Jul 18, 2006 10:52:52 PM
next in thread | previous in thread | raw e-mail | index | archive | help
> You'll have to figure out how that person is getting access as > apparently they are reaching the box. > Hi, Turns out has NOTHING to do with someone trying to hack the box. I narrowed it down to every time there was a "clean" message from SpamAssassin I would get the message. I put : SHELL=/bin/sh at the top of all the users .procmailrc and it hasn't appeared since. Thanks to everyone who emailed on and off list! Tuc/TBOH
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200607200212.k6K2Cpro008129>