[cobalt-users] RAQ3 & Telnet mysteriously activating in GUI's

["Render-Vue" <sales@xxxxxxxxxxxxxx>]

Sorry for cross post but users group replies are a lot faster than the
security...

Checking logs the following caught my eye...
Oct 29 13:16:53 ns sendmail[16229]: alias database /etc/aliases autorebuilt
by petplan

Now we designed the site and administer it so I knew there was no changed
done to the account...

When I go into the site admin for that account - I notice that the telnet
icon is showing ???
Telnet is disabled from the main Admin GUI and has been for months, when you
go to the user siteadmin panel Telnet is disabled there also but the icon is
showing ???

Now when I go back to check all the sites using the same IP I notice that
some have their telnet icons showing in the site admin box.
I then went to the main Admin GUI and activated then deactivated Telnet,
then restarted services then checked all the sites on the box, now other
sites with different IP's are showing the telnet icon in the siteadmin.

I also noticed that several sites had their Telnet activated in the GUI's -
now I know that each account on this box was physically checked months back
and everyone had the Telnet disabled.

I have now gone and changed the main admin password in case their is a
compromised from the collocation centre.

Can anyone tell me if this is a know issue, bug, virus or hack - I'm a bit
concerned that all of a sudden sites have Telnet activated or at least
showing activated in the admin panels.

I have also tried to Telnet into the various IP's but keep getting a time
out connection - I assume that Telnet is still disabled.

Many thanks in advance

Chae