[SunHELP] mail read

[Kevin Maguire]

Hi

One of my users asked:

---
Subject: Somebody reading my emails ? (second time)

I logged into host1 from my host at home (host2) and I got the message
"You have mail" (not "You have new mail").  But I got 15 new emails
... hence it looks like somebody else already read my emails.

---

The user mounts /var/mail from our mail server on host1.

We looked into this when he first reported this a while back, and
found that in /etc/profile

  if [ ! -f .hushlogin ]
  then
          /usr/sbin/quota
          #       Allow the user to break the Message-Of-The-Day only.
          trap "trap '' 2"  2
          /bin/cat -s /etc/motd
          trap "" 2

          /bin/mail -E
          case $? in
          0) 
                  echo "You have new mail."
                  ;;
          2) 
                  echo "You have mail."
                  ;;
          esac
  fi

"mail -E" does not seem to be documneted, but by trial and error we
found that if the modification-time is more recent than access-time
then it said "You have new mail.", otherwise just "You have mail.".
So it seems some process has changed the atime of the mail file,
without changing mtime.  Simply "cat"-ing the file does that.  However
how to find out which process, when, and why?

Is there any utility that can "watch" a file/inode and trace accesses
to/from that file, sort of like a tracepoint in a debugger?  On our
mail server we offer several methods of retrieving mail, POP,IMAP, and
NFS.  The user is a bit paranoid, and I'd like to be able to explain
this to him.  And now I'm a bit curious myself too ....

Cheers,
Kevin

                         \|///
                       \  - -  //
                        (  @ @  )
+---------------------oOOo-(_)-oOOo-------------------------+
| Kevin Maguire                                Unix Support |
| kmaguire at eso.org            European Southern Observatory |
| Tel:+49 (0)89 3200 6387      Karl-Schwarzschild-Strasse 2 |
| Fax:+49 (0)89 3200 6380     D-85748 Garching bei Muenchen |
|    *     *      *     *     *     *     *     *     *     |
|      "The merely Difficult we will do immediately.        |
|         The Impossible will take slightly longer"         |
+-----------------------------Oooo--------------------------+
                       oooO   (   )
                      (   )    ) /
                       \ (    (_/
                        _)