Hi all, On a dedicated email server (on a multi server setup) I got the following email earlier: email1.mydomain.com : Dec 1 09:16:26 : sysweb : a password is required ; TTY=pts/0 ; PWD=/var/lib/sysweb ; USER=root ; COMMAND=/usr/bin/mc I've never created that user and I'm not sure if it is required from any of the running software. This is a default installation of email server as per ISPConfig docs with spamassassin, rspamd etc. From the log is seems that someone tried to run the midnight commander as sysweb or what?
The user sysweb s not from ISPConfig and I don't have it on my ISPConfig mail server, so nothing that gets set up as part of the ISPConfig install guides. Also such reports are not enty by any software installed as part of the ISPConfig setup, so you probably added additional software and the user and also report email belongs to that.
