These are the suspisious records in the /var/log/messages:
messages.2:Jan 14 18:06:06 mail PAM_pwdb[5947]: password for (root/0) changed by ((null)/0)
messages.3:Jan 8 21:00:13 mail PAM_pwdb[2528]: password for (root/0) changed by ((null)/0)
[root@mail log]#
And the root password was indeed changed. By whom ?
==================================================
Evgeny Popov Network and Security Administrator
Phone: 972-9-9594995 [EMAIL PROTECTED]
Tecnomatix Tecnologies Ltd.
==================================================
"Unix IS user friendly, it is just selective about who his friends are." Anonymous
************************************************************************************************** ** eSafe-IL scanned this outgoing email for viruses, vandals and malicious content ** **************************************************************************************************
