Re: [cobalt-users] Hacked?? Help!!

[Wayne Sagar <wsagar@xxxxxxxx>]

Hi Gerald,

>The .s.PGSQL.5583 is normal. Cobalt uses postgreSQL, so don't let that
>worry you. These files are really in /home/tmp, /tmp is a ln
>mysql and php also use this directory.
>So, I think that is normal.
>Maybe it was active monitor, that was connected, although I think that
>normally is in the log-files.

Bad night for the list archives to be down! I know the postgreSQL is
supposed to be in there but there is, I believe something going on anyway..
For sure something is going on.. what, I'm not sure... but I did just
happen to manage to pick the right time to log in and do a netstat and see
the telnet user conencted.. whoever it was bailed as soon as I logged in..
but they were in there.. 

Now my logcheck report shows an su login by user name postgres.. This is
what worries me.. I've never seen this entry before and I do check every
report that comes in... Is postgres supposed to be a user with su privleges?

So now.. how to find the "phantom" telnet server... Sometimes stuff like
this makes one wonder if all this is worth the effort....

gaaa!!!
Wayne