From owner-freebsd-security Wed May 1 6:33:40 2002 Delivered-To: freebsd-security@freebsd.org Received: from diarmadhi.mushhaven.net (diarmadhi.mushhaven.net [216.150.202.147]) by hub.freebsd.org (Postfix) with SMTP id 8946B37B405 for ; Wed, 1 May 2002 06:33:36 -0700 (PDT) Received: (qmail 36126 invoked by uid 1000); 1 May 2002 13:32:20 -0000 Date: Wed, 1 May 2002 09:32:20 -0400 From: Jamie Norwood To: freebsd-security@freebsd.org Subject: Re: newbie. possibly got hacked. need help. Message-ID: <20020501133220.GA36059@mushhaven.net> References: <20020430232953.A72277@mail.texas-shooters.com> <20020501044517.GF688@elvis.mu.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.3.28i Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org On Wed, May 01, 2002 at 08:31:18AM +0100, Peter McGarvey wrote: > On Wednesday 01 May 2002 05:45 am, Bill Fumerola wrote: > > On Tue, Apr 30, 2002 at 11:29:53PM -0500, pr0ject wrote: > > > hate to say it, but if you've removed something huge or you have a > > > runaway process holding the memory space, you might try rebooting. > > > > rebooting? stay away from my systems. try just installing 'lsof' (in a > > ports collection near your) and see whats holding open the file. > > Hmm, installing a port whem /var is full does not strike me as a good idea. > > I've seen a similar thing twice, turns out qmail goes haywire if you've > got softupdates turned on. The only way to fix it is to reboot into > single-user mode and fsck the disk. Remembering to turn softupdates off > when it's finished. Eh? I run qmail on a machine using softupdates with no problems... Granted, it processes maybe a thousand or two messages a day, but... > Another fun way to fill a volume is to delete a log file. Syslog will > happily backfill your volume without complaint until you HUP or restart it. Heh, yeah. :) Jamie > -- > TTFN, FNORD > > Peter McGarvey > System Administrator > Network Operations, VIA Networks UK To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message