[root@doctor.nl2k.ab.ca: New 550s getting automagically placed into access file]

[Hugo van der Kooij]

On Tue, 8 May 2007, Dave Shariff Yadallee - System Administrator a.k.a. The Root of the Problem wrote:

> On Tue, May 08, 2007 at 04:27:29PM +0100, Martin.Hepworth wrote:
>> Dave
>>
>> There's a CustomFunction called IPBlock that will update this list based
>> on number of messages received from an ip-address.....
>>
>> Normally it's attached to "Always Looked Up Last" in the following
>> manner inside MailScanner.conf..
>>
>> Always Looked Up Last = &IPBlock
>>
>
> As I said this is set to no;
> however, when I did a tail on /etc/mail/acess I got:
>
>
>
> As I said this is set to no;
> however, when I did a tail on /etc/mail/acess I got:
>
>
>
> As I said this is set to no;
> however, when I did a tail on /etc/mail/acess I got:

..... (Zillion more of these removed)

I am not exactly what is happening on your system. But I would start 
scanning for other roots. I have strong reservations if someone starts to 
send email as root.

To troubleshoot the issue I would round up the usual suspects and start 
grepping some files for the exact string.

Then I would set the file readonly to see who is complaining.

I think with these two steps you should have a reasonable chang to find 
out who is adding the entries.

Hugo.

-- 
 	hvdkooij at vanderkooij.org	http://hugo.vanderkooij.org/
 	    This message is using 100% recycled electrons.

 	Some men see computers as they are and say "Windows"
 	I use computers with Linux and say "Why Windows?"
 		(Thanks JFK, for the insight.)