Solved! Re: [NCLUG] FW: strange message sent to root

[Mike Loseke]

Thus spake mike cullerton:
> ding, ding, ding, i think we have a winner. (thanks mike)
> 
> i found this at the very bottom of my /etc/hosts.allow
> 
> ALL : ALL : spawn (/usr/sbin/safe_finger -l @%h | /bin/mail root) & : DENY
> 
> so, let me see if i can explain what happened. someone tried to connect to a
> port on my box that i don't allow. since it was denied, this line in
> hosts.allow tried to finger the the incoming connection.
> 
> and, it mailed root on my box
> 
> yes?

 Bingo. :-)

> again, thanks mike,
> mike

 You bet. :-)


-- 
   Mike Loseke    | If at first you don't succeed,
 mike at verinet.com | increase the amperage.