Re: [cobalt-users] Mail is not working have I been hacked

["Robbert Hamburg (HaVa Web- & Processdesign)" <user@xxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


> My mail has not been responding when I try to send a message to any of the
> accounts on my server. I cannot receive mail when I login via webmail I
> cannot see any message nor can I send any so I feel that sendmail is not
> working correctly. I have restarted the server I have restart sendmail I
> have deleted the /var/spool/mqueue/q1,q2,q3,q4

Have the dns changes propagated already ?? What happens when you do an 
nslookup ? Do you see the old or the new ip ?

have you physically deleted the q1/q2/q3/q4 or the contents ?


> The following is from
>
> tail /var/log/messages

> Feb 23 00:30:01 www proftpd[9605]: AllowChmod is deprecated, and will not
> work c
> onsistantly, use <Limit SITE_CHMOD> instead.
> Feb 23 00:30:01 www proftpd[9605]: www.mymaindomain.com
> (localhost[127.0.0.1]) - FTP se
> ssion opened.
> Feb 23 00:30:01 www proftpd[9605]: www.mymaindomain.com
> (localhost[127.0.0.1]) - FTP se
> ssion closed.

This is NOT related to your problem. There is an easy fix for this in the 
archives. Search for Limit SITE_CHMOD and / or AllowChmod



> The following is from
>
> tail /var/log/maillog
> Feb 23 00:40:15 www sendmail[9967]: h1MDbX709967: ruleset=check_mail,
> arg1=<beginners-cgi-return-8138-admin=mysite1domain.com.au@xxxxxxxx>,
> relay=[64.70.54.95], reject=451 4.1.8
> <beginners-cgi-return-8138-admin=mysite1domain.com.au@xxxxxxxx>... Domain
> of sender address
> beginners-cgi-return-8138-admin=mysite1domain.com.au@xxxxxxxx does not
> resolve
> Feb 23 00:40:51 www sendmail[10026]: h1MDcA710026: ruleset=check_mail,
> arg1=<lcoleman@xxxxxxxxxxxxxxxxxxxxxxxx>, relay=[203.1.72.90], reject=451
> 4.1.8 <lcoleman@xxxxxxxxxxxxxxxxxxxxxxxx>... Domain of sender address
> lcoleman@xxxxxxxxxxxxxxxxxxxxxxxx does not resolve

This your DNS issue. Your dns hasnt changed yet. Do you change the ttl of your 
dns records to a very short period before you made the move ?? Cause 
otherwise you will have to wait untill the TTL (default is 86400 seconds) so 
if you havent changed it you will have to sit back and wait.


Goodluck. 


PS. Did you notify your regsitar of the new dns ips ???

Robbert
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iQCVAwUBPlffn85Lo94gGAHzAQIVSwP+KecsW4wcvZRsmo0Qq4yhkX0sZPu7cp2F
epeQw/RqDM7yxpI65Owx7dqG7ruoU10/AfZ5cxyXCIO2Zj+CTgu1W94Uu5vkzAtT
s4gQJ62u+Ixn16yZTLMcFTdS/THDvzW/5udggCN3BKJQ6LdyO4/2sP9+ahTq5ECY
TfZXMyqPBEw=
=Zrsz
-----END PGP SIGNATURE-----