RE: [cobalt-users] CPU heavily loaded, low on memory, smtp server not responding

["E.B. Dreger" <eddy+public+spam@xxxxxxxxxxxxxxxxx>]

> Date: Tue, 22 Jan 2002 21:30:20 -0500
> From: Brian Rahill <cobalt@xxxxxxxxxxxxxxxxxxxxxxx>

> Their seems to be a hole in the maillog from 4:45 to 5:07 but
> perhaps the high load screwed with the logs.

> When the logs do come back, I get a bunch of "illegal seek"
> messages (see below).  Any ideas on these?

http://www.eudora.com/qpopper/faq.html#EOF

If you had disk I/O problems, that would explain the high
loadavg.  I'd expect additional errors in your kernel logfile,
however.

The POP3 client dropping the connection sounds plausible.  If the
POP3 client must wait forever on a system with a high loadavg, it
would time out and kill the connection.  (I'd have to play with
qpopper or examine source to determine the exact mechanism, so be
advised that this is but a SWAG.)

Hmmmm.

> There isn't any FormMail.pl on the server but there may be some
> vulnerable .cgi scripts.  I can look for that.

Or a rogue spamming CGI if customers have access.


Eddy

---------------------------------------------------------------------------
Brotsman & Dreger, Inc. - EverQuick Internet Division
Phone: +1 (316) 794-8922 Wichita/(Inter)national
Phone: +1 (785) 865-5885 Lawrence
---------------------------------------------------------------------------

Date: Mon, 21 May 2001 11:23:58 +0000 (GMT)
From: A Trap <blacklist@xxxxxxxxx>
To: blacklist@xxxxxxxxx
Subject: Please ignore this portion of my mail signature.

These last few lines are a trap for address-harvesting spambots.  Do NOT
send mail to <blacklist@xxxxxxxxx>, or you are likely to be blocked.