>On Wed, 25 Sep 2002 11:12:04 -0400 (EDT), Keith Mastin
><kmastin@beechtree.ca> wrote:
>
>> If it was a compromise, my guess is that the perp needed you to reboot
>> to activate a "new" kernal with some additional "bonuses". Considering
>> the age of the machine and the distro you're running, my guess is that
>> you're using older versions of bind and possibly sendmail? Both are
>> susceptible to buffer overruns in older versions, which would provide an
>> entry point.
>
>Keith, 
>
>Thanks for your help.  If Manuel hadn't leapt in with what sure-as-heck
>sounds like the right answer, I'd have physically disconnected the machine
>(and given upstream mail hosts indigestion in the process).  
>
>BTW, I am running sendmail from pkgsrc, to close what started as an open
>relay.  Not that that makes your observations any less valid, of course.  

Lucky break, I hope the machine's secure and it is the db issue. You still 
might consider moving your world up to the 1.6 release. :)

-- 
Keith Mastin       BeechTree Information Technology Services Inc.
137 Laird Drive    Toronto    M4G 3V5     http://www.beechtree.ca
  (416)696-6070      Fax(416)696-6072      kmastin@beechtree.ca