We have an e-mail server running on Sun machine. Recently, some unauthorized logins were reported which we eventually blocked. The person doing use to login from different servers around the globe. But the intruder still gets to know when a new account is created or password changed. There doesn't seem to be running any script on server which could inform the intruder about it but it is sure that he comes to know immediately when there is any change in /etc/passwd file and exactly what the change is.
Could anybody help to stop the abuse.