-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Thanks to all, who helped
it definitely was a rootkit. came in by this exim bug: - - http://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=exim4+root - - http://www.exim.org/lurker/message/20101210.164935.385e04d0.en.html - - http://www.exim.org/lurker/message/20101207.215955.bb32d4f2.en.html - - http://www.h-online.com/open/news/item/Possible-root-vulnerability-in-Exim-internet-mailer-Update-1150631.html - - http://blog.steve.org.uk/the_remote_root_hole_in_exim4_is_painful.html - - http://www.exploit-db.com/exploits/15725/ - - http://www.gossamer-threads.com/lists/exim/dev/89477 reinstalled an had a painful night seting up all services again Am 01.01.2011 21:09, schrieb Chris Davies: > Martin Lorenz <mar...@lorenz.priv.at> wrote: >> i recently noticed some errors at my mail-server and so I tried to drill >> it down with my limited abilities. > >> what I found is really strange: >> when copying a file (no matter which) the copy gets zero permissions. > > Silly question time, because I've encountered this kind of problem myself, > once before... > > Is your filesystem remotely mounted from another server? > Chris > > -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJNJDDRAAoJECZ8myNlGwU1B/kH/1Rwlpl7GEzo5X7yzBjgKkcp NNezyv1X9+ncsqWOxrXstHH26ta9Ajht4KUm+MtmFMY90b0d7NpPMK7d0sEfx16M VxmdUnR7e8qH1R0aBOqcSlXM3GwAdCDL+LbL6FQ3nAqyX84ln4VFr2hQwej25eTQ J+dEvLKiKY3YRM84VN+uuqIy0RQcXSBFm7FWpj1/F2AOa0fzaT9vF4N72imGbJOA y6fMtWV1hnUjGWVRTNUKTvEdrJhO82GSHgCuJ0uYBnSUCvSBVLfsjmeQ/vD62v+Y uc4qsRoI12Q0o4ro0y7147ckf7JsfSC5hi3qee5ZxAx+K0ONBD09gQUKi0WWcBc= =S+XN -----END PGP SIGNATURE----- -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/4d2430db.4000...@lorenz.priv.at
