Re: [cobalt-users] [RaQ3] Kernel IP routing table HACKED?

[flash22@xxxxxxx]

On Sat, 28 Jul 2001, enrique wrote:
> 
> [root@www admin]# grep -r "169.254.183.37" /etc/
> grep: /etc/rc.d/rc3.d/S91atalk: No such file or directory
> /etc/mail/access:169.254.183.37 550 Mail rejected due to possible SPAM
> Binary file /etc/mail/access.db matches
> /etc/sysconfig/network-scripts/ifcfg-eth0:0:IPADDR=169.254.183.37
> 
> Ok, so when I look at /etc/sysconfig/network-scripts/ifcfg-eth0:0 I get the
> following:
> 
> DEVICE=eth0:0
> IPADDR=169.254.183.37
> NETMASK=255.255.0.0
> NETWORK=169.254.0.0
> BROADCAST=169.254.255.255
> ONBOOT=yes
> ALIAS=yes
> BOOTPROTO=none
> 
> Looks like this may be the file which sets the route during boot. Do I
> simply delete this file?
> 
> I also wonder if I need to delete it from access.db, but since it is a
> binary file, I'm not sure how to view/edit this file. I've used emacs in the
> past, but doesn't seem to work with binary files. Any suggestions will be
> greatly appreciated.

no,no, leave access.db alone, that's the blocking list for email , that's
a good place to have that IP ;)

as to the ifconfig script, that seems to say you have that IP set as your
first site-web address...hmmm....

you probably need that file to exist, and have something valid in it, look
at the other files.....the GUI is supposed to create those, sometimes it
doesn't remove them tho....

before deleting things, try changing something for the GUI setup for the
first web site and saving, the GUI may rewrite all those files correctly
from the database for you...

gsh