Hi,
I m taking like this mail from csf firewall. What can i do?
thanks for helping.
Executable:
/usr/bin/python
Command Line (often faked in exploits):
/usr/bin/python /usr/libexec/postfix/policyd-spf
Network connections by the process (if any):
udp: 46.101.148.32:18973 -> 8.8.4.4:53
Files open by the process (if any):
Memory maps by the process (if any):
00400000-00401000 r-xp 00000000 fc:01 526879 /usr/bin/python
00600000-00601000 rw-p 00000000 fc:01 526879 /usr/bin/python
01312000-0163e000 rw-p 00000000 00:00 0 [heap]
7f49445ae000-7f49445b6000 r-xp 00000000 fc:01 672789 /usr/lib64/python2.6/lib-dynload/arraymodule.so
7f49445b6000-7f49447b5000 ---p 00008000 fc:01 672789 /usr/lib64/python2.6/lib-dynload/arraymodule.so
7f49447b5000-7f49447b8000 rw-p 00007000 fc:01 672789 /usr/lib64/python2.6/lib-dynload/arraymodule.so
7f49447b8000-7f4944838000 r-xp 00000000 fc:01 658509 /usr/lib64/python2.6/lib-dynload/unicodedata.so
7f4944838000-7f4944a37000 ---p 00080000 fc:01 658509 /usr/lib64/python2.6/lib-dynload/unicodedata.so
7f4944a37000-7f4944a48000 rw-p 0007f000 fc:01 658509 /usr/lib64/python2.6/lib-dynload/unicodedata.so
7f4944a48000-7f4944a4a000 r-xp 00000000 fc:01 657839 /usr/lib64/python2.6/lib-dynload/fcntlmodule.so
7f4944a4a000-7f4944c4a000 ---p 00002000 fc:01 657839 /usr/lib64/python2.6/lib-dynload/fcntlmodule.so
7f4944c4a000-7f4944c4c000 rw-p 00002000 fc:01 657839 /usr/lib64/python2.6/lib-dynload/fcntlmodule.so
7f4944c4c000-7f4944c50000 r-xp 00000000 fc:01 657798 /usr/lib64/python2.6/lib-dynload/selectmodule.so
7f4944c50000-7f4944e50000 ---p 00004000 fc:01 657798 /usr/lib64/python2.6/lib-dynload/selectmodule.so
7f4944e50000-7f4944e52000 rw-p 00004000 fc:01 657798 /usr/lib64/python2.6/lib-dynload/selectmodule.so
7f4944e52000-7f4944e55000 r-xp 00000000 fc:01 657851 /usr/lib64/python2.6/lib-dynload/_randommodule.so
7f4944e55000-7f4945054000 ---p 00003000 fc:01 657851 /usr/lib64/python2.6/lib-dynload/_randommodule.so
7f4945054000-7f4945055000 rw-p 00002000 fc:01 657851 /usr/lib64/python2.6/lib-dynload/_randommodule.so
7f4945055000-7f494505a000 r-xp 00000000 fc:01 658502 /usr/lib64/python2.6/lib-dynload/mathmodule.so
7f494505a000-7f4945259000 ---p 00005000 fc:01 658502 /usr/lib64/python2.6/lib-dynload/mathmodule.so
7f4945259000-7f494525b000 rw-p 00004000 fc:01 658502 /usr/lib64/python2.6/lib-dynload/mathmodule.so
7f494525b000-7f494525d000 r-xp 00000000 fc:01 658484 /usr/lib64/python2.6/lib-dynload/_functoolsmodule.so
7f494525d000-7f494545d000 ---p 00002000 fc:01 658484 /usr/lib64/python2.6/lib-dynload/_functoolsmodule.so
7f494545d000-7f494545e000 rw-p 00002000 fc:01 658484 /usr/lib64/python2.6/lib-dynload/_functoolsmodule.so
7f494545e000-7f4945462000 r-xp 00000000 fc:01 658494 /usr/lib64/python2.6/lib-dynload/binascii.so
7f4945462000-7f4945662000 ---p 00004000 fc:01 658494 /usr/lib64/python2.6/lib-dynload/binascii.so
7f4945662000-7f4945663000 rw-p 00004000 fc:01 658494 /usr/lib64/python2.6/lib-dynload/binascii.so
7f4945663000-7f494566c000 r-xp 00000000 fc:01 658501 /usr/lib64/python2.6/lib-dynload/itertoolsmodule.so
7f494566c000-7f494586c000 ---p 00009000 fc:01 658501 /usr/lib64/python2.6/lib-dynload/itertoolsmodule.so
7f494586c000-7f4945870000 rw-p 00009000 fc:01 658501 /usr/lib64/python2.6/lib-dynload/itertoolsmodule.so
7f4945870000-7f4945878000 r-xp 00000000 fc:01 657856 /usr/lib64/python2.6/lib-dynload/operator.so
7f4945878000-7f4945a77000 ---p 00008000 fc:01 657856 /usr/lib64/python2.6/lib-dynload/operator.so
7f4945a77000-7f4945a79000 rw-p 00007000 fc:01 657856 /usr/lib64/python2.6/lib-dynload/operator.so
7f4945a79000-7f4945a7f000 r-xp 00000000 fc:01 657863 /usr/lib64/python2.6/lib-dynload/_collectionsmodule.so
7f4945a7f000-7f4945c7e000 ---p 00006000 fc:01 657863 /usr/lib64/python2.6/lib-dynload/_collectionsmodule.so
7f4945c7e000-7f4945c80000 rw-p 00005000 fc:01 657863 /usr/lib64/python2.6/lib-dynload/_collectionsmodule.so
7f4945c80000-7f4945c85000 r-xp 00000000 fc:01 658506 /usr/lib64/python2.6/lib-dynload/stropmodule.so
7f4945c85000-7f4945e84000 ---p 00005000 fc:01 658506 /usr/lib64/python2.6/lib-dynload/stropmodule.so
7f4945e84000-7f4945e86000 rw-p 00004000 fc:01 658506 /usr/lib64/python2.6/lib-dynload/stropmodule.so
7f4945e86000-7f4945e89000 r-xp 00000000 fc:01 672805 /usr/lib64/python2.6/lib-dynload/timemodule.so
7f4945e89000-7f4946089000 ---p 00003000 fc:01 672805 /usr/lib64/python2.6/lib-dynload/timemodule.so
7f4946089000-7f494608b000 rw-p 00003000 fc:01 672805 /usr/lib64/python2.6/lib-dynload/timemodule.so
7f494608b000-7f4946092000 r-xp 00000000 fc:01 672787 /usr/lib64/python2.6/lib-dynload/_struct.so
7f4946092000-7f4946292000 ---p 00007000 fc:01 672787 /usr/lib64/python2.6/lib-dynload/_struct.so
7f4946292000-7f4946294000 rw-p 00007000 fc:01 672787 /usr/lib64/python2.6/lib-dynload/_struct.so
7f4946294000-7f4946298000 r-xp 00000000 fc:01 672793 /usr/lib64/python2.6/lib-dynload/cStringIO.so
7f4946298000-7f4946497000 ---p 00004000 fc:01 672793 /usr/lib64/python2.6/lib-dynload/cStringIO.so
7f4946497000-7f4946499000 rw-p 00003000 fc:01 672793 /usr/lib64/python2.6/lib-dynload/cStringIO.so
7f4946499000-7f49464b6000 r-xp 00000000 fc:01 917792 /lib64/libselinux.so.1
7f49464b6000-7f49466b5000 ---p 0001d000 fc:01 917792 /lib64/libselinux.so.1
7f49466b5000-7f49466b6000 r--p 0001c000 fc:01 917792 /lib64/libselinux.so.1
7f49466b6000-7f49466b7000 rw-p 0001d000 fc:01 917792 /lib64/libselinux.so.1
7f49466b7000-7f49466b8000 rw-p 00000000 00:00 0
7f49466b8000-7f49466ce000 r-xp 00000000 fc:01 917764 /lib64/libresolv-2.12.so
7f49466ce000-7f49468ce000 ---p 00016000 fc:01 917764 /lib64/libresolv-2.12.so
7f49468ce000-7f49468cf000 r--p 00016000 fc:01 917764 /lib64/libresolv-2.12.so
7f49468cf000-7f49468d0000 rw-p 00017000 fc:01 917764 /lib64/libresolv-2.12.so
7f49468d0000-7f49468d2000 rw-p 00000000 00:00 0
7f49468d2000-7f49468d4000 r-xp 00000000 fc:01 917617 /lib64/libkeyutils.so.1.3
7f49468d4000-7f4946ad3000 ---p 00002000 fc:01 917617 /lib64/libkeyutils.so.1.3
7f4946ad3000-7f4946ad4000 r--p 00001000 fc:01 917617 /lib64/libkeyutils.so.1.3
7f4946ad4000-7f4946ad5000 rw-p 00002000 fc:01 917617 /lib64/libkeyutils.so.1.3
7f4946ad5000-7f4946adf000 r-xp 00000000 fc:01 917869 /lib64/libkrb5support.so.0.1
7f4946adf000-7f4946cde000 ---p 0000a000 fc:01 917869 /lib64/libkrb5support.so.0.1
7f4946cde000-7f4946cdf000 r--p 00009000 fc:01 917869 /lib64/libkrb5support.so.0.1
7f4946cdf000-7f4946ce0000 rw-p 0000a000 fc:01 917869 /lib64/libkrb5support.so.0.1
7f4946ce0000-7f4946cf5000 r-xp 00000000 fc:01 917802 /lib64/libz.so.1.2.3
7f4946cf5000-7f4946ef4000 ---p 00015000 fc:01 917802 /lib64/libz.so.1.2.3
7f4946ef4000-7f4946ef5000 r--p 00014000 fc:01 917802 /lib64/libz.so.1.2.3
7f4946ef5000-7f4946ef6000 rw-p 00015000 fc:01 917802 /lib64/libz.so.1.2.3
7f4946ef6000-7f4946f1f000 r-xp 00000000 fc:01 917839 /lib64/libk5crypto.so.3.1
7f4946f1f000-7f494711f000 ---p 00029000 fc:01 917839 /lib64/libk5crypto.so.3.1
7f494711f000-7f4947120000 r--p 00029000 fc:01 917839 /lib64/libk5crypto.so.3.1
7f4947120000-7f4947121000 rw-p 0002a000 fc:01 917839 /lib64/libk5crypto.so.3.1
7f4947121000-7f4947122000 rw-p 00000000 00:00 0
7f4947122000-7f4947125000 r-xp 00000000 fc:01 917844 /lib64/libcom_err.so.2.1
7f4947125000-7f4947324000 ---p 00003000 fc:01 917844 /lib64/libcom_err.so.2.1
7f4947324000-7f4947325000 r--p 00002000 fc:01 917844 /lib64/libcom_err.so.2.1
7f4947325000-7f4947326000 rw-p 00003000 fc:01 917844 /lib64/libcom_err.so.2.1
7f4947326000-7f4947401000 r-xp 00000000 fc:01 917851 /lib64/libkrb5.so.3.3
7f4947401000-7f4947601000 ---p 000db000 fc:01 917851 /lib64/libkrb5.so.3.3
7f4947601000-7f494760b000 r--p 000db000 fc:01 917851 /lib64/libkrb5.so.3.3
7f494760b000-7f494760d000 rw-p 000e5000 fc:01 917851 /lib64/libkrb5.so.3.3
7f494760d000-7f494764e000 r-xp 00000000 fc:01 917804 /lib64/libgssapi_krb5.so.2.2
7f494764e000-7f494784e000 ---p 00041000 fc:01 917804 /lib64/libgssapi_krb5.so.2.2
7f494784e000-7f494784f000 r--p 00041000 fc:01 917804 /lib64/libgssapi_krb5.so.2.2
7f494784f000-7f4947851000 rw-p 00042000 fc:01 917804 /lib64/libgssapi_krb5.so.2.2
7f4947851000-7f4947a0b000 r-xp 00000000 fc:01 524547 /usr/lib64/libcrypto.so.1.0.1e
7f4947a0b000-7f4947c0a000 ---p 001ba000 fc:01 524547 /usr/lib64/libcrypto.so.1.0.1e
7f4947c0a000-7f4947c25000 r--p 001b9000 fc:01 524547 /usr/lib64/libcrypto.so.1.0.1e
7f4947c25000-7f4947c31000 rw-p 001d4000 fc:01 524547 /usr/lib64/libcrypto.so.1.0.1e
7f4947c31000-7f4947c35000 rw-p 00000000 00:00 0
7f4947c35000-7f4947c97000 r-xp 00000000 fc:01 553793 /usr/lib64/libssl.so.1.0.1e
7f4947c97000-7f4947e97000 ---p 00062000 fc:01 553793 /usr/lib64/libssl.so.1.0.1e
7f4947e97000-7f4947e9b000 r--p 00062000 fc:01 553793 /usr/lib64/libssl.so.1.0.1e
7f4947e9b000-7f4947ea2000 rw-p 00066000 fc:01 553793 /usr/lib64/libssl.so.1.0.1e
7f4947ea2000-7f4947ea9000 r-xp 00000000 fc:01 672786 /usr/lib64/python2.6/lib-dynload/_ssl.so
7f4947ea9000-7f49480a8000 ---p 00007000 fc:01 672786 /usr/lib64/python2.6/lib-dynload/_ssl.so
7f49480a8000-7f49480aa000 rw-p 00006000 fc:01 672786 /usr/lib64/python2.6/lib-dynload/_ssl.so
7f49480aa000-7f49480b5000 r-xp 00000000 fc:01 672784 /usr/lib64/python2.6/lib-dynload/_socketmodule.so
7f49480b5000-7f49482b5000 ---p 0000b000 fc:01 672784 /usr/lib64/python2.6/lib-dynload/_socketmodule.so
7f49482b5000-7f49482b9000 rw-p 0000b000 fc:01 672784 /usr/lib64/python2.6/lib-dynload/_socketmodule.so
7f49482b9000-7f49482bb000 r-xp 00000000 fc:01 672803 /usr/lib64/python2.6/lib-dynload/syslog.so
7f49482bb000-7f49484ba000 ---p 00002000 fc:01 672803 /usr/lib64/python2.6/lib-dynload/syslog.so
7f49484ba000-7f49484bb000 rw-p 00001000 fc:01 672803 /usr/lib64/python2.6/lib-dynload/syslog.so
7f49484bb000-7f49484fc000 rw-p 00000000 00:00 0
7f494853d000-7f494857e000 rw-p 00000000 00:00 0
7f494857e000-7f494858b000 r-xp 00000000 fc:01 917649 /lib64/libnss_files-2.12.so
7f494858b000-7f494878a000 ---p 0000d000 fc:01 917649 /lib64/libnss_files-2.12.so
7f494878a000-7f494878b000 r--p 0000c000 fc:01 917649 /lib64/libnss_files-2.12.so
7f494878b000-7f494878c000 rw-p 0000d000 fc:01 917649 /lib64/libnss_files-2.12.so
7f494878c000-7f4948916000 r-xp 00000000 fc:01 917548 /lib64/libc-2.12.so
7f4948916000-7f4948b16000 ---p 0018a000 fc:01 917548 /lib64/libc-2.12.so
7f4948b16000-7f4948b1a000 r--p 0018a000 fc:01 917548 /lib64/libc-2.12.so
7f4948b1a000-7f4948b1c000 rw-p 0018e000 fc:01 917548 /lib64/libc-2.12.so
7f4948b1c000-7f4948b20000 rw-p 00000000 00:00 0
7f4948b20000-7f4948ba3000 r-xp 00000000 fc:01 917600 /lib64/libm-2.12.so
7f4948ba3000-7f4948da2000 ---p 00083000 fc:01 917600 /lib64/libm-2.12.so
7f4948da2000-7f4948da3000 r--p 00082000 fc:01 917600 /lib64/libm-2.12.so
7f4948da3000-7f4948da4000 rw-p 00083000 fc:01 917600 /lib64/libm-2.12.so
7f4948da4000-7f4948da6000 r-xp 00000000 fc:01 917781 /lib64/libutil-2.12.so
7f4948da6000-7f4948fa5000 ---p 00002000 fc:01 917781 /lib64/libutil-2.12.so
7f4948fa5000-7f4948fa6000 r--p 00001000 fc:01 917781 /lib64/libutil-2.12.so
7f4948fa6000-7f4948fa7000 rw-p 00002000 fc:01 917781 /lib64/libutil-2.12.so
7f4948fa7000-7f4948fa9000 r-xp 00000000 fc:01 917597 /lib64/libdl-2.12.so
7f4948fa9000-7f49491a9000 ---p 00002000 fc:01 917597 /lib64/libdl-2.12.so
7f49491a9000-7f49491aa000 r--p 00002000 fc:01 917597 /lib64/libdl-2.12.so
7f49491aa000-7f49491ab000 rw-p 00003000 fc:01 917597 /lib64/libdl-2.12.so
7f49491ab000-7f49491c2000 r-xp 00000000 fc:01 917761 /lib64/libpthread-2.12.so
7f49491c2000-7f49493c2000 ---p 00017000 fc:01 917761 /lib64/libpthread-2.12.so
7f49493c2000-7f49493c3000 r--p 00017000 fc:01 917761 /lib64/libpthread-2.12.so
7f49493c3000-7f49493c4000 rw-p 00018000 fc:01 917761 /lib64/libpthread-2.12.so
7f49493c4000-7f49493c8000 rw-p 00000000 00:00 0
7f49493c8000-7f4949525000 r-xp 00000000 fc:01 532425 /usr/lib64/libpython2.6.so.1.0
7f4949525000-7f4949724000 ---p 0015d000 fc:01 532425 /usr/lib64/libpython2.6.so.1.0
7f4949724000-7f4949760000 rw-p 0015c000 fc:01 532425 /usr/lib64/libpython2.6.so.1.0
7f4949760000-7f494976e000 rw-p 00000000 00:00 0
7f494976e000-7f494978e000 r-xp 00000000 fc:01 917520 /lib64/ld-2.12.so
7f494984a000-7f49498fe000 rw-p 00000000 00:00 0
7f49498ff000-7f4949986000 rw-p 00000000 00:00 0
7f494998b000-7f494998d000 rw-p 00000000 00:00 0
7f494998d000-7f494998e000 r--p 0001f000 fc:01 917520 /lib64/ld-2.12.so
7f494998e000-7f494998f000 rw-p 00020000 fc:01 917520 /lib64/ld-2.12.so
7f494998f000-7f4949990000 rw-p 00000000 00:00 0
7ffd88877000-7ffd88896000 rw-p 00000000 00:00 0 [stack]
7ffd8889c000-7ffd8889d000 r-xp 00000000 00:00 0 [vdso]
Topic: Suspicious process running under user nobody (Read 11499 times)
