From owner-freebsd-security  Tue Jun 15 11:11:34 1999
Delivered-To: freebsd-security@freebsd.org
Received: from rover.village.org (rover.village.org [204.144.255.49])
	by hub.freebsd.org (Postfix) with ESMTP id 6A8F5155C8
	for <security@FreeBSD.ORG>; Tue, 15 Jun 1999 11:11:22 -0700 (PDT)
	(envelope-from imp@harmony.village.org)
Received: from harmony.village.org (harmony.village.org [10.0.0.6])
	by rover.village.org (8.9.3/8.9.3) with ESMTP id MAA48216;
	Tue, 15 Jun 1999 12:11:20 -0600 (MDT)
	(envelope-from imp@harmony.village.org)
Received: from harmony.village.org (localhost.village.org [127.0.0.1]) by harmony.village.org (8.9.3/8.8.3) with ESMTP id MAA93541; Tue, 15 Jun 1999 12:11:10 -0600 (MDT)
Message-Id: <199906151811.MAA93541@harmony.village.org>
To: Nick Rogness <nick@rapidnet.com>
Subject: Re: New Attack via sendmail? 
Cc: LutzRab@omc.net, security@FreeBSD.ORG
In-reply-to: Your message of "Tue, 15 Jun 1999 12:07:32 MDT."
		<Pine.BSF.4.05.9906151205420.28138-100000@rapidnet.com> 
References: <Pine.BSF.4.05.9906151205420.28138-100000@rapidnet.com>  
Date: Tue, 15 Jun 1999 12:11:10 -0600
From: Warner Losh <imp@harmony.village.org>
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

In message <Pine.BSF.4.05.9906151205420.28138-100000@rapidnet.com>
Nick Rogness writes: 
: 	Or even 'top' shows a bit more detail than ps -auxww does.
: 	But either one should help ya see what is going on.  Problem is
: 	you have to be on the server when this happens.

True.  It looked from the logs like it was happening often, so looking 
at the server in a most-mortum fassion may also be a benefit.

Warner


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message