bvh(_at_)inetnebr(_dot_)com (Obi-Wan) writes:
I've installed procmail 3.11pre4 on a Solaris 2.5 box. I periodically
get the following error on the console:
Jan 14 19:43:27 falcon procmail[6845]: Renamed bogus "/var/mail/erojhan" into
"/var/mail/BOGUS.43LB"
...
After the error occurs, I get two files:
-rw-rw---- 1 erojhan mail 0 Jan 14 19:43 /var/mail/BOGUS.43LB
-rw-rw---- 1 erojhan mail 31537 Jan 14 19:43 /var/mail/erojhan
Is this something I need to be worried about?
What are the perms on /var/mail? Is the 'sticky bit' set? If not,
someone may be trying to play bait-and-swap tricks with your mailbox.
The renaming will also occur if $DEFAULT is a symlink or has more than
one name (i.e., if a hardlink has been made to it).
If this continues, I'd suggest hacking the source a little to have procmail
log more information, in particular, the "mode", and uid of the file.
Philip Guenther