Re: repeated system mail, /etc/.pwd.lock ?
On Tue, May 04, 2021 at 09:32:49PM -0500, David Wright wrote:
> It looks reasonable for determining whether your system files are
> being interfered with. But you just showed one example from the
> log, which was for the /etc/.pwd.lock lockfile. I assume you don't
> have 2757 of these but, rather, the names of an assortment of files.
That's an interesting interpretation. If that's actually *true*, I
wish the OP had made that more clear. I interpreted it as literally
being thousands of instances of the *same* file, the one shown in the
Subject: header and in the original message body.
(In which case, removing iwatch will certainly stop the logging, but
it won't stop whoever is locking and unlocking your passwd/shadow
files thousands of times, which is something I might care enough to
investigate -- and is a great reason for installing iwatch, to look for
such a thing.)
(Also I'd never heard of "monkeysphere" before and didn't even know
that openssh-client suggested it. So it's been an educational thread.)
Reply to: