Re: [KFUG] 누군가 센드메일을 신나게 쓰는듯 합니다. ㅡ,ㅡ

[chabrothers <chabrothers@xxxxxxxxxxxxxxx>]

황지욱 wrote:

> last pid: 28426; load averages: 0.39, 0.57, 0.67 up 3+08:04:59 22:21:10
> 154 processes: 1 running, 153 sleeping
> CPU states: 8.8% user, 0.0% nice, 9.9% system, 0.3% interrupt, 81.0% idle
> Mem: 436M Active, 282M Inact, 115M Wired, 35M Cache, 112M Buf, 134M Free
> Swap: 4096M Total, 314M Used, 3782M Free, 7% Inuse, 20K In
> PID USERNAME PRI NICE SIZE RES STATE TIME WCPU CPU COMMAND
> 27876 root 35 0 2108K 1284K RUN 0:13 9.78% 9.77% top
> 27756 root 2 0 5948K 4884K select 0:03 2.25% 2.25% sendmail
> 30373 root 2 0 16276K 8520K select 2:56 0.59% 0.59% sendmail
> 27752 www 2 0 7920K 5212K poll 0:00 0.15% 0.15% httpd
> 69272 root 2 0 10176K 6068K connec 0:53 0.05% 0.05% sendmail
> 42437 root 2 0 7132K 3332K connec 0:21 0.05% 0.05% sendmail
> 3294 root 2 0 19308K 1380K select 3:43 0.00% 0.00% sendmail
> 13464 root 2 0 17088K 9128K connec 3:26 0.00% 0.00% sendmail
> 60547 root 2 0 15672K 8316K connec 2:57 0.00% 0.00% sendmail
> 2197 root 2 0 14888K 9052K connec 2:53 0.00% 0.00% sendmail
> 55670 root 2 0 13120K 7820K connec 2:50 0.00% 0.00% sendmail
> 4946 root 2 0 15020K 8884K connec 2:49 0.00% 0.00% sendmail
> 61074 root 2 0 13636K 8132K connec 2:47 0.00% 0.00% sendmail
> 47084 root 2 0 12708K 8128K select 2:32 0.00% 0.00% sendmail
> 3697 root 2 0 13216K 8812K connec 2:31 0.00% 0.00% sendmail
> 5867 root 2 0 13392K 8152K connec 2:25 0.00% 0.00% sendmail
> 4449 root 2 0 12992K 8588K connec 2:25 0.00% 0.00% sendmail
> 77646 root 2 0 12592K 8360K connec 2:24 0.00% 0.00% sendmail
> 749 root 2 0 12252K 8140K connec 2:12 0.00% 0.00% sendmail
> 31687 root 2 0 12920K 8248K connec 2:12 0.00% 0.00% sendmail
> 26481 root 2 0 12260K 7920K connec 2:09 0.00% 0.00% sendmail
> 15438 root 2 0 12436K 8168K connec 2:09 0.00% 0.00% sendmail
> 35496 root 2 0 12096K 8224K connec 2:06 0.00% 0.00% sendmail
> 72 root 2 0 988K 464K select 2:01 0.00% 0.00% syslogd
> 7908 root 2 0 11928K 4012K select 2:00 0.00% 0.00% sendmail
> 41891 root 2 0 12280K 7680K connec 1:55 0.00% 0.00% sendmail
> 39146 root 2 0 12120K 8064K connec 1:54 0.00% 0.00% sendmail
> 72949 root 2 0 12412K 7420K connec 1:52 0.00% 0.00% sendmail
> 64270 root 2 0 11860K 7464K connec 1:47 0.00% 0.00% sendmail
> 49660 root 2 0 12248K 7144K connec 1:45 0.00% 0.00% sendmail
> 78852 root 2 0 11756K 7204K connec 1:40 0.00% 0.00% sendmail
> 90058 root 2 0 12104K 7200K connec 1:37 0.00% 0.00% sendmail
> 93373 root 2 0 11716K 7312K select 1:35 0.00% 0.00% sendmail
> 94844 root 2 0 11780K 7288K connec 1:29 0.00% 0.00% sendmail
> 7068 root 2 0 12608K 7280K connec 1:29 0.00% 0.00% sendmail
> 10376 root 2 0 12764K 7064K connec 1:27 0.00% 0.00% sendmail
> 96996 root 2 0 11848K 7372K select 1:25 0.00% 0.00% sendmail
> 9206 root 2 0 11484K 7316K connec 1:25 0.00% 0.00% sendmail
> 10805 root 2 0 11036K 7044K connec 1:23 0.00% 0.00% sendmail
> 11041 root 2 0 11460K 6996K connec 1:20 0.00% 0.00% sendmail
> 62415 root 2 0 10320K 6060K select 1:17 0.00% 0.00% sendmail
> 11273 root 2 0 11248K 6772K connec 1:17 0.00% 0.00% sendmail
> 11182 root 2 0 11020K 6852K connec 1:16 0.00% 0.00% sendmail
> 12107 root 2 0 10760K 6512K connec 1:08 0.00% 0.00% sendmail
> 12462 root 2 0 10636K 6460K connec 1:05 0.00% 0.00% sendmail
> 13775 root 2 0 10456K 6336K connec 1:04 0.00% 0.00% sendmail
> 41975 root 2 0 11424K 6368K connec 1:04 0.00% 0.00% sendmail
> 51234 root 2 0 10956K 6320K connec 1:02 0.00% 0.00% sendmail
> 88 root 2 0 3056K 1588K select 1:00 0.00% 0.00% sendmail
> 66956 root 2 0 10496K 6300K connec 1:00 0.00% 0.00% sendmail
> 67718 root 2 0 10452K 6324K connec 0:57 0.00% 0.00% sendmail
> 69242 root 2 0 10540K 6116K connec 0:56 0.00% 0.00% sendmail
> 68445 root 2 0 10520K 6392K select 0:56 0.00% 0.00% sendmail
> 68506 root 2 0 10716K 6200K connec 0:56 0.00% 0.00% sendmail
>
>------------------------------------------------------------------------
>
>  
>
첫번째로 의심해보실만한 것은 doublebounce 에 대하여 점검하시기를 바라며,

그것이 아니라면
아마도 누군가가 악의적인 행동을 하고 있을것이라고 생각되며,
대부분의 경우 /var 혹은 /home 아래에 이멜주소가 잔뜩들어있는 파일이 심어
져있을수 있으니

잘 찾아보시기 바랍니다.
특히 패스워드가 없는 계정이 있는지 살펴보시기 바랍니다.

---------------------------------------------------------------
프비만세~!!!
프비씨티만만세~!!!
http://FreeBSDCity.org

>_______________________________________________
>한국 FreeBSD 사용자 그룹(KFUG) questions 메일링 리스트
>questions at kr.FreeBSD.org
>http://www.kr.FreeBSD.org/mailman/listinfo/questions
>

_______________________________________________
한국 FreeBSD 사용자 그룹(KFUG) questions 메일링 리스트
questions at kr.FreeBSD.org
http://www.kr.FreeBSD.org/mailman/listinfo/questions