<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN">
<html><body style='font-family: Verdana,Geneva,sans-serif'>
<p>That IP address is a Latin American address belonging to </p>
<pre>SERVICIOS DE SISTEMAS Y TECNOLOGIA HIWAY NETWORKS</pre>
<pre><br /></pre>
<pre>If you do a netstat what types of connections to that IP address do you show? What does your mail queue show? What do the sendmail logs show? </pre>
<pre><br /></pre>
<pre>Those would be the next things I would look at troubleshooting the issue. </pre>
<pre><br /></pre>
<pre>Do you show root logged on from somewhere else? (If so, why is root able to remote into the box to begin with?) </pre>
<pre><br /></pre>
<pre>Drew.</pre>
<pre><br /></pre>
<p>On 02/27/2013 8:30 am, Steven Howes wrote:</p>
<blockquote style="padding-left: 5px; border-left: #1010ff 2px solid; margin-left: 5px; width: 100%;">
<div>
<div>On 27 Feb 2013, at 13:23, Will Nordmeyer wrote:</div>
<blockquote style="padding-left: 5px; border-left: #1010ff 2px solid; margin-left: 5px; width: 100%;">
<p>I've been monitoring the ssh vulnerability and don't see anything there, but I did notice that I have multiple processes when I do a PS looking like this:</p>
<p>root 7499 24331 0 14:13 ? 00:00:00 sendmail: server [201.238.254.243] cmd read<br />root 7550 24331 0 14:13 ? 00:00:00 sendmail: server [201.238.254.243] cmd read<br />root 8127 24331 0 14:13 ? 00:00:00 sendmail: server [201.238.254.243] cmd read<br />root 8523 24331 0 14:13 ? 00:00:00 sendmail: server [201.238.254.243] cmd read<br />root 9165 24331 0 14:13 ? 00:00:00 sendmail: server [201.238.254.243] cmd read<br />root 10050 24331 0 14:13 ? 00:00:00 sendmail: server [201.238.254.243] cmd read<br />root 10562 24331 0 14:13 ? 00:00:00 sendmail: server [201.238.254.243] cmd read<br />root 10706 24331 0 14:13 ? 00:00:00 sendmail: server [201.238.254.243] cmd read<br />root 11208 24331 0 14:13 ? 00:00:00 sendmail: server [201.238.254.243] startup<br /><br /></p>
<p>I don't know who 201.238.254.243 is - and I'm not sure where that server startup is coming from. Any advice? Quick? help?</p>
</blockquote>
</div>
Well that's not ssh. Could be someone exploiting your sendmail (well, trying random passwords at least). Just firewall them out... It's unlikely to be real mail, 201.238.254.243 doesn't listen on SMTP.
<div>S</div>
<br />
<pre>_______________________________________________
Blueonyx mailing list
<a href="mailto:Blueonyx@mail.blueonyx.it">Blueonyx@mail.blueonyx.it</a>
<a href="http://mail.blueonyx.it/mailman/listinfo/blueonyx">http://mail.blueonyx.it/mailman/listinfo/blueonyx</a>
</pre>
</blockquote>
</body></html>