Re: [cobalt-users] last bit of hacker droppings.

[Byron Servies <bservies@xxxxxxx>]

Tony wrote:

> +> Resolved that, thanks. Killed the bogus init and restored the other bogus
> +> system files.
> +> Just installed logcheck and netstat shows these ports which I didn't see
> +> before:
> +> udp        0      0 0.0.0.0:7938            0.0.0.0:*
> +> raw        0      0 0.0.0.0:1               0.0.0.0:*               7
> +> raw        0      0 0.0.0.0:6               0.0.0.0:*               7
> +> Any idea what ports these are?
> +
> +
> +The two raw port are normal, put the udp at port 7938 isn't, do a 
> +netstat -nuap
> +to see which process is controlling it and investigate that process.
> +
> +Jeff-
>
>
> 7937 and 7938 are Knox Arkeia ports. I actually noticed these before the 
> hack and forgot about them. Why does the Raq3 load and run these if Arkeia
> is not GUI-enabled? How do you shut them down?

FYI: Knox Arkeia runs on port 617.  These two are NetWorker ports.

Byron

--
Byron Servies       Sun Microsystems, Inc.    bservies@xxxxxxx