While hunting a Spammer on my mashine I notised that all my postfix file get changed the same time todsay Is this NORMAL? How can I track the changes to see who and what changes these? root@artemis:/etc/postfix# ll total 240K drwxr-xr-x 3 root client13 4.0K Apr 25 07:55 ./ drwxr-xr-x 111 root root 12K May 13 08:25 ../ -rw-r--r-- 1 root root 0 Apr 25 07:55 body_checks -rw-r--r-- 1 root root 431 Aug 1 2014 dynamicmaps.cf -rw-r--r-- 1 root root 0 Apr 25 07:55 header_checks -rw-r--r-- 1 root root 5.0K Apr 25 07:55 main.cf -rw-r--r-- 1 root root 5.0K Apr 25 07:55 main.cf~ -rw-r--r-- 1 root root 5.0K Apr 25 07:55 main.cf~2 -rw-r--r-- 1 root root 6.3K Apr 25 07:55 master.cf -r-------- 1 root root 6.3K Apr 25 07:55 master.cf~ -rw-r--r-- 1 root root 0 Apr 25 07:55 mime_header_checks -rw-r----- 1 root postfix 231 Apr 25 07:55 mysql-virtual_client.cf -rw-r----- 1 root postfix 231 Apr 25 07:55 mysql-virtual_client.cf~ -rw-r----- 1 root postfix 221 Apr 25 07:55 mysql-virtual_domains.cf -rw-r----- 1 root postfix 221 Apr 25 07:55 mysql-virtual_domains.cf~ -rw-r----- 1 root postfix 218 Apr 25 07:55 mysql-virtual_email2email.cf -rw-r----- 1 root postfix 218 Apr 25 07:55 mysql-virtual_email2email.cf~ -rw-r----- 1 root postfix 317 Apr 25 07:55 mysql-virtual_forwardings.cf -rw-r----- 1 root postfix 317 Apr 25 07:55 mysql-virtual_forwardings.cf~ -rw-r----- 1 root postfix 288 Apr 25 07:55 mysql-virtual_mailboxes.cf -rw-r----- 1 root postfix 288 Apr 25 07:55 mysql-virtual_mailboxes.cf~ -rw-r----- 1 root postfix 252 Apr 25 07:55 mysql-virtual_recipient.cf -rw-r----- 1 root postfix 252 Apr 25 07:55 mysql-virtual_recipient.cf~ -rw-r----- 1 root postfix 224 Apr 25 07:55 mysql-virtual_relaydomains.cf -rw-r----- 1 root postfix 224 Apr 25 07:55 mysql-virtual_relaydomains.cf~ -rw-r----- 1 root postfix 230 Apr 25 07:55 mysql-virtual_relayrecipientmaps.cf -rw-r----- 1 root postfix 230 Apr 25 07:55 mysql-virtual_relayrecipientmaps.cf~ -rw-r----- 1 root postfix 249 Apr 25 07:55 mysql-virtual_sender.cf -rw-r----- 1 root postfix 249 Apr 25 07:55 mysql-virtual_sender.cf~ -rw-r----- 1 root postfix 227 Apr 25 07:55 mysql-virtual_transports.cf -rw-r----- 1 root postfix 227 Apr 25 07:55 mysql-virtual_transports.cf~ -rw-r--r-- 1 root root 0 Apr 25 07:55 nested_header_checks
