Re: [cobalt-users] chkrootkit query pls and SMTP failure

["Carrie Bartkowiak" <ravencarrie@xxxxxxxx>]

> Can anyone advise whether I should check whether this is a problem?
> Checking `z2'... lastlog entry may be corrupted
Leonard,
I get this too. I don't think it's anything to be worried about. (I
might learn differently, though! *L*)
If you install portsentry on the box the chkrootkit will also come up
with BINDSHELL - INFECTED. Just an argument between portsentry and
chkrootkit, it's not really infected.

> I have also noticed that the Active Monitor says my SMTP server
hasnt worked
> since last thursday. Well I wouldnt notice cos the system aint live
yet.

Don't forget that while the system is running, it sends you (the
admin) messages from time to time. So even if the box isn't live,
you've probably got mail in there in your admin's queue. Webalizer
will send you an email every night, portsentry will send you an email
according to when you told it to run (every fifteen minutes?).
If Cron gets any problems rotating logs or the smtp server starts
acting up, you'll get an email about it.
So see if you can check your mail on the box and make sure you haven't
choked up something with a huge backlog of unread mail.  ;)
That probably isn't the cause of your problem, but it's something to
check and be aware of nonetheless.

> Howver I rebooted and the thing still insn't online.
> Any ideas where I should look - ie what startup file and what entry

Try going to root and stopping, then starting sendmail and see what it
tells you:
/etc/rc.d/init.d/sendmail stop
/etc/rc.d/init.d/sendmail start


CarrieB