Re: /varmail BOGUS files .

From: Tommy Reynolds (TommyReynolds_at_yahoo.com)
Date: 08/16/04 

Date: Mon, 16 Aug 2004 12:32:38 -0500

On Mon, 16 Aug 2004 17:20:09 +0000, Administrateur de systemes wrote:

> -r-------- 1 nobody nobody 1 Aug 16 13:14 BOGUS.root.tC
> -r-------- 1 nobody nobody 1 Aug 16 13:14 BOGUS.root.E
> -r-------- 1 nobody nobody 1 Aug 16 13:14 BOGUS.root.D
> -r-------- 1 nobody nobody 1 Aug 16 13:14 BOGUS.root.qG
> -r-------- 1 nobody nobody 1 Aug 16 13:14 BOGUS.root.eG
> -r-------- 1 nobody nobody 1 Aug 16 13:14 BOGUS.root.ZG
> -r-------- 1 nobody nobody 1 Aug 16 13:14 BOGUS.root.8F

They come from sendmail. IIRC, they should not be in the "/var/mail"
tree at all: it is for per-user mail and un-delivered mail files
should never even visit here. Their correct place should be
in "/var/spool/mqueue" or the like.

Are there any clues in the file "/var/log/maillog"?

You should be able to view these bogus files. Anything suspicious
there?

HTH.