(SOLVED) nologin: Attempted login by root on UNKNOWN

[Tuc at T-B-O-H]

> You'll have to figure out how that person is getting access as 
> apparently they are reaching the box.
> 
Hi,

	Turns out has NOTHING to do with someone trying to hack
the box. I narrowed it down to every time there was a "clean"
message from SpamAssassin I would get the message.

	I put :

		SHELL=/bin/sh

	at the top of all the users .procmailrc and it hasn't
appeared since.

	Thanks to everyone who emailed on and off list!

			Tuc/TBOH