[no subject]

I found suspicious reports in the last few 'logwatch' reports on my 
RH-7.3 setup. The latest couple say:

=-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-=
 --------------------- sendmail Begin ------------------------

1011642 bytes transferred
186 messages sent

**Unmatched Entries**

iBE2IgI27139: Authentication-Warning: otter.localdomain: jmills owned 
process doing -bs
iBE2R4927161: Authentication-Warning: otter.localdomain: jmills owned 
process doing -bs
iBE2UeP27173: Authentication-Warning: otter.localdomain: jmills owned 
process doing -bs
iBE2Yri27184: Authentication-Warning: otter.localdomain: jmills owned 
process doing -bs


 ---------------------- sendmail End -------------------------
...
=-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-=

and:
=-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-=
...
 --------------------- sendmail Begin ------------------------

9038537 bytes transferred
390 messages sent
 
 ---------------------- sendmail End -------------------------
...
=-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-=

I've been seeing those "doing -bs" lines since setting up my mail service, 
but I can't account for those massive numbers of messages.

Coincidentally(?), I no longer see those bogus attempts at SSH logins 
from scripts that try all manner of ususal accounts and passwords.

I'm running 'sendmail-8.11.6-23.73' from the RH rpms, and use 
'fetchmail-5.9.0-21.7.3' to collect mail from my ISP's POP server.

What should I look for in /var/log/maillog (or elsewhere) to track this 
down?

TIA.

 - John Mills
   john.m.mills at alum.mit.edu


</pre>
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
<hr>
<ul><li><strong>Follow-Ups</strong>:
<ul>
<li><strong><a name="00637" href="msg00637.html">[ale] Hacked to spam??</a></strong>
<ul><li><em>From:</em> jdr at xcorps.net (Jonathan Rickman)</li></ul></li>
<li><strong><a name="00651" href="msg00651.html">[ale] Hacked to spam??</a></strong>
<ul><li><em>From:</em> bob at verysecurelinux.com (Bob Toxen)</li></ul></li>
</ul></li></ul>
<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->
<ul>
<li>Prev by Date:
<strong><a href="msg00633.html">[ale] need working dial up</a></strong>
</li>
<li>Next by Date:
<strong><a href="msg00635.html">[ale] C2900</a></strong>
</li>
<li>Previous by thread:
<strong><a href="msg00621.html">[ale] ssh for automated management</a></strong>
</li>
<li>Next by thread:
<strong><a href="msg00637.html">[ale] Hacked to spam??</a></strong>
</li>
<li>Index(es):
<ul>
<li><a href="maillist.html#00634"><strong>Date</strong></a></li>
<li><a href="threads.html#00634"><strong>Thread</strong></a></li>
</ul>
</li>
</ul>

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->
</body>
</html>