what does this sendmail message in Logwatch showing? hacking?

Paul Howarth paul at city-fan.org
Tue Jun 6 20:45:26 UTC 2006


On Tue, 2006-06-06 at 10:58 -0700, M E Fieu wrote:
> Thanks how about the following ?? 
> 
> ################### LogWatch 4.3.2 (02/18/03) #################### 
>        Processing Initiated: Tue Jun  6 04:02:01 2006
>        Date Range Processed: yesterday
>      Detail Level of Output: 0
>           Logfiles for Host: www3
>  ################################################################ 
> 
>  --------------------- sendmail Begin ------------------------ 
> 
> Unknown users:
> 
>     believeworld0303
>       from localhost.localdomain [127.0.0.1]    2 time(s).
> 
>     lichungchung
>       from localhost.localdomain [127.0.0.1]    1 time(s).

What don't you understand about this? Someone on this machine tried
sending mail to the non-existent users believeworld0303 and
lichungchung. Look in /var/log/maillog for those usernames to see when
it happened, and possibly more details.

And why are you running such an ancient version of logwatch?

Paul.





More information about the users mailing list