[cobalt-users] RE: Hacked? Telnet gone, SSH gone, strange ports open

["Juan Carlos Murillo" <murillo@xxxxxxxxxxxxxxxxx>]

Hello again, I was hoping someone would help us with this because we are
stumped.  We need to reinstall a shell from the GUI because our Telnet and
SSH are dead.  How did this happen we are yet to find out.  The telnet
prompt prints out a message about the OS and dies:

Cobalt Linux release 5.0 (Pacifica)
Kernel 2.2.14C10 on an i586
[TELNET] INFO: DISCONNECTED

The SSH doesn't even respond:

[SSH] FAIL: CONNECT NOT SUCCESSFUL (SERVER/PORT/CONNECTION PROBLEM)

I don't see its port open.  We were hoping that perhaps we could reinstall
an earlier SSH, a rlogin or rsh or something to get in, but cannot find a
package to use with the GUI.

BTW managed to find out that port 514 that is open in the machine is for rsh
a remote shell, which makes me believe the server's been tinkered with.

Help will be greatly appreciated.

Warm regards,
Juan

-----Original Message-----
From: Juan Carlos Murillo [mailto:murillo@xxxxxxxxxxxxxxxxx]
Sent: Friday, May 18, 2001 7:06 PM
To: cobalt-users@xxxxxxxxxxxxxxx
Subject: Hacked? Telnet gone, SSH gone, strange ports open


Hello all,

We are running a RaQ3 and about a month ago our telnet prompt started
failing, it would display the OS info but not the login.  After reading the
archives for a while and not finding an answer we decided to install SSH.
Now SSH is gone too and we cannot get into the machine other than from ftp.
I have run a port scan against our machine and got the following ports open:

21 FTP
25 SMTP
53 Domain
79 Finger  ??
80 WWW
81 Hosts2-NS
110 POP3
143 IMAP
444 SNPP    ??
514 SHELL - Automatic Remote Process Execution ????????????????????????????
1008 UFSD   ??

NO SSH port.  An we have this weird 514 port open.

What should I be looking for to determined if the server was compromised?

TIA

Depeupleur