[cobalt-users] Hacked RAQ3 port 514???

[John M Troher <admin@xxxxxxxx>]

I have a Raq3 that was hacked sometime ago that has sites on it with SSL
that I have not moved yet.

I am portscanning that machine to see what is listening. I see the shell
service
listening to port 514 but can not telnet to it, as it disconnects me right
away.

Is that port normal?

Also the server will not accept any usernames and passwords on the normal
telnet port or at the console.

Any ideas on how to get into this box and clean it up? Bind has been
disabled.