Root Mail was Fwd: Re: Postfix, Mutt And No Root Mail?

[NoOp]

On 10/26/2007 05:15 PM, Leonard Chatagnier wrote:
> --- NoOp <glgxg at sbcglobal.net> wrote:
> 
>> On 10/26/2007 11:07 AM, Leonard Chatagnier wrote:
>> 
>> >> 
>> > Hey, Gary,
>> > My experience with Debian was just opposite.  On a
>> tty<snip>
>> > you who you wanted root mail to be sent to. 
>> Haven't
>> > seen that on Ubuntu that I recall.  FWIW.
>> > 
>> > Len
>> 
>> Found the culprit... Back in August I had run
>> Rootkit Hunter - that sent
>> the mail; found it in /var/spool/mail :-)
>> 
>> Thanks & sorry to have interupted the thread.
>> 
> Hey Gary,
> 
> You may have hit on my problem.  I remember playing
> around with "rootkit" earlier, didn't understand it,
> just forgot about it and don't know what it might have
> done.  Would you elaborate on what you did, please?
> All I have in /var/spool/mail is:
> lchata at ubuntu:/var/spool/mail$ ls -al
> total 6564
> drwxrwsr-x  2 root   mail    4096 2007-10-26 15:03 .
> drwxr-xr-x 17 root   root    4096 2007-08-12 17:04 ..
> -rw-------  1 lchata mail 6664829 2007-10-26 18:07
> lchata
> -rw-r--r--  1 lchata mail   32490 2007-10-26 18:07
> msg-id-archive-file
> lchata at ubuntu:/var/spool/mail$ 
> Thyanks,

rkhunter by default installs a mail server:

http://packages.ubuntu.com/gutsy/admin/rkhunter
<quote>
exim4
    meta-package to ease Exim MTA (v4) installation
or postfix
    High-performance mail transport agent
or sendmail
    powerful, efficient, and scalable Mail Transport Agent
or mail-transport-agent
    Virtual package
 .
 .
 .
mailx
    A simple mail user agent
</quote>

I can't recall exactly what I did when I ran it (it was in August) but
it will also send an email to root@<username> advising you of what it
has found. When I looked at /var/spool/mail from Nautilus I found the
file & also found that I couldn't delete it from a standard terminal - I
had to go to root to do it (gksu nautilus).

Unfortunately I've deleted the mail that I found from it in
/var/spool/mail but I can reinstall on the test server & see if I can
recreate if you'd like.