Root Mail was Fwd: Re: Postfix, Mutt And No Root Mail?

[NoOp]

On 10/26/2007 06:21 PM, NoOp wrote:
> On 10/26/2007 05:15 PM, Leonard Chatagnier wrote:
>> --- NoOp <glgxg at sbcglobal.net> wrote:
>> 
>>> On 10/26/2007 11:07 AM, Leonard Chatagnier wrote:
>>> 
>>> >> 
>>> > Hey, Gary,
>>> > My experience with Debian was just opposite.  On a
>>> tty<snip>
>>> > you who you wanted root mail to be sent to. 
>>> Haven't
>>> > seen that on Ubuntu that I recall.  FWIW.
>>> > 
>>> > Len
>>> 
>>> Found the culprit... Back in August I had run
>>> Rootkit Hunter - that sent
>>> the mail; found it in /var/spool/mail :-)
>>> 
>>> Thanks & sorry to have interupted the thread.
>>> 
>> Hey Gary,
>> 
>> You may have hit on my problem.  I remember playing
>> around with "rootkit" earlier, didn't understand it,
>> just forgot about it and don't know what it might have
>> done.  Would you elaborate on what you did, please?
>> All I have in /var/spool/mail is:
>> lchata at ubuntu:/var/spool/mail$ ls -al
>> total 6564
>> drwxrwsr-x  2 root   mail    4096 2007-10-26 15:03 .
>> drwxr-xr-x 17 root   root    4096 2007-08-12 17:04 ..
>> -rw-------  1 lchata mail 6664829 2007-10-26 18:07
>> lchata
>> -rw-r--r--  1 lchata mail   32490 2007-10-26 18:07
>> msg-id-archive-file
>> lchata at ubuntu:/var/spool/mail$ 
>> Thyanks,
> 
> rkhunter by default installs a mail server:
> 
> http://packages.ubuntu.com/gutsy/admin/rkhunter
> <quote>
> exim4
>     meta-package to ease Exim MTA (v4) installation
> or postfix
>     High-performance mail transport agent
> or sendmail
>     powerful, efficient, and scalable Mail Transport Agent
> or mail-transport-agent
>     Virtual package
>  .
>  .
>  .
> mailx
>     A simple mail user agent
> </quote>
> 
> I can't recall exactly what I did when I ran it (it was in August) but
> it will also send an email to root@<username> advising you of what it
> has found. When I looked at /var/spool/mail from Nautilus I found the
> file & also found that I couldn't delete it from a standard terminal - I
> had to go to root to do it (gksu nautilus).
> 
> Unfortunately I've deleted the mail that I found from it in
> /var/spool/mail but I can reinstall on the test server & see if I can
> recreate if you'd like.
> 

Added note: I was able to view the email in the folder by just opening
in the text editor.