vince@tc.fluke.COM (Craig Johnson) (12/17/88)
Somebody in this newsgroup mentioned he saw a message containing "ubluit" just before his system died a horrible death. He wanted to know whether this was an indication of some prankster getting into his system. I can't give you any answers, but I have turned up an interesting clue. I happened to run strings on /usr/ucb/mail on my Sun 3/50 (BSD 4.2, Sun 3.5.2) today and what should appear in the output but *ubluit*! Here it is in the context of the strings output: sendmail /usr/lib/sendmail sendwait Should be inserting commas in recip lists To: Subject: %s Cc: Bcc: save in '%s' @(#)stralloc.c 1.2 86/10/08 SMI String too large No room for space %d Internal error @(#)temp.c 1.2 86/10/08 SMI /tmp/Rs%-d /tmp/Rq%-d /tmp/Rm%-d /tmp/Re%-d /tmp/Rx%-d /tmp/Rz%-d "%s" is not a user of this system --> ubluit Who are you!? @(#)tty.c 1.2 86/10/08 SMI gtty Subject: too long to edit @(#)vars.c 1.2 86/10/08 SMI prompt assign(%s)=%s "%s": undefined variable deassign(%s) Out of memory value(%s)=%s "%s": not a group I don't know if this will do you a bit of good, but it does provide evidence that it was not a prankster who did you in. Perhaps you can rest easier now. Good luck getting your system back up. Craig V. Johnson ...!fluke!vince John Fluke Mfg. Co. Everett, WA
guy@auspex.UUCP (Guy Harris) (12/17/88)
>I can't give you any answers, but I have turned up an interesting >clue. I happened to run strings on /usr/ucb/mail on my Sun 3/50 (BSD >4.2, Sun 3.5.2) today and what should appear in the output but >*ubluit*! "ubluit" appears to be the user name used by "Mail"/"mailx" if it can't find a user name for the current user ID any other way - for instance, if "/etc/passwd" can't be read, and, at least in the S5R3 version, the LOGNAME environment variable isn't set. Given that the file system seemed to be in the process of being eaten by moths, that might explain this.
lenny@icus.islp.ny.us (Lenny Tropiano) (12/19/88)
In article <743@auspex.UUCP> guy@auspex.UUCP (Guy Harris) writes: |>>I can't give you any answers, but I have turned up an interesting |>>clue. I happened to run strings on /usr/ucb/mail on my Sun 3/50 (BSD |>>4.2, Sun 3.5.2) today and what should appear in the output but |>>*ubluit*! |> |>"ubluit" appears to be the user name used by "Mail"/"mailx" if it can't |>find a user name for the current user ID any other way - for instance, |>if "/etc/passwd" can't be read, and, at least in the S5R3 version, the |>LOGNAME environment variable isn't set. Given that the file system |>seemed to be in the process of being eaten by moths, that might explain |>this. Probably he was running mailx on his system. That was available to from the STORE with the appropriate authorization. Most likely the old UNIX pc, "getlogin(3C)" bug has appeared. If getlogin() fails, it generally returns "LOGIN", which will not appear in /etc/passwd, therefore producing the "No mail for ubluit". At least it's better to know you probably weren't invaded. I would put a "root" password if I were you though! Better safe than sorry! :-) -Lenny -- Lenny Tropiano ICUS Software Systems [w] +1 (516) 582-5525 lenny@icus.islp.ny.us Telex; 154232428 ICUS [h] +1 (516) 968-8576 {talcott,decuac,boulder,hombre,pacbell,sbcs}!icus!lenny attmail!icus!lenny ICUS Software Systems -- PO Box 1; Islip Terrace, NY 11752