The Planet Forums > Unknown UID 8 owned process doing -bs

Full Version: Unknown UID 8 owned process doing -bs

The Planet Forums > Security > General Security

MindLash

Apr 27 2003, 05:08 AM

Question 1)
In my daily email reports, I've been noticing this line show up more and more often. Can someone set me at ease, letting me know this is normal? (and what it means). Taken from 'Sendmail' section of LogWatch

QUOTE

**Unmatched Entries**
Authentication-Warning: server.mydomain.com: Unknown UID 8 owned process doing -bs

Question 2)
Also in my daily LogWatch under the SSHD section, I get these lines.

QUOTE

**Unmatched Entries**
lastlog_perform_login: Couldn't stat /var/log/lastlog: No such file or directory
lastlog_openseek: /var/log/lastlog is not a file or directory!
lastlog_perform_login: Couldn't stat /var/log/lastlog: No such file or directory
lastlog_openseek: /var/log/lastlog is not a file or directory!
subsystem request for sftp
getpeername 107 : Transport endpoint is not connected
Did not receive identification string from 127.0.0.1

Any help on that would be great.

Thanks

- Mindlash
- Ensim 3.1.8-2

smoker

May 15 2003, 06:03 AM

Only a hint, but I believe the unknown UID doing -bs is related to a webmail process forwarding a message. I have this showing in my logwatch too, and I have squirrelmail running and have forwarded a few messages using squirrelmail.

The only exact match using google was in Italian, sorry.
Maybe an upgrade of sendmail, or chown the local squirrelmail ( in ensim machines) to the site owner.

May try this last one later.
smoker

MindLash

May 15 2003, 07:25 AM

Thanks for the reply smoker.

I'll give that a shot.

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.