RE: [cobalt-users] Hacked - Needs help

[vijay <vijay@xxxxxxxxxxxx>]

Hello,

I can access GUI interface. I tried to ON the telnet server, but
unsuccessful to do this. 

Ftp also was like that, but came back after OS upgrade was completed.

Email is ticked as Working, but responds as not working and active
monitor status is RED for this and Telnet.

Any help is appreciated. 

I was thinking to change the root (init) files to enable Telnet Server.
I can do this by accessing the server through FTp and upload it back and
reboot. Once I am successful in getting the telnet working, I think I
can check and take guard against future hacks.

Thanks

Vijay Nair

		-----Original Message-----
		From:	cobalt-users-admin@xxxxxxxxxxxxxxx
[mailto:cobalt-users-admin@xxxxxxxxxxxxxxx] On Behalf Of Sean Chester
		Sent:	Tuesday, February 20, 2001 5:49 PM
		To:	cobalt-users@xxxxxxxxxxxxxxx
		Subject:	RE: [cobalt-users] Hacked - Needs help

		>I have a Raq3i. It seems it is hacked. I was not able
to get into the
		>server at all (no FTP, no TELNET, no Emails).

		can you use your http GUI ? you can switch on/off
services through this.
		switch back on the services your require and change your
admin password.


		>I want to know what files I should change to enable
telnet server and to
		>get into the system using telnet. Also, after this is
done, I want to
		>install SSH on the server. Any ideas or suggestions??

		switch on telnet in the GUI.
		You can install the SSH .pkg from pkg.cobalt.nl its
straight forward.

		there is also a lot more you might want to do.. install
porstsentry and
		logcheck for a start.
		you should also have a good look round your server for
'suspicious' files.
		perhaps download chkrootkit and run that.

		read through the archives of this list, im sure it will
help you recover
		from the hack.

		_______________________________________________
		cobalt-users mailing list
		cobalt-users@xxxxxxxxxxxxxxx
		To Subscribe or Unsubscribe, please go to:
		http://list.cobalt.com/mailman/listinfo/cobalt-users