Re: [cobalt-security] [RaQ3] Hacked ... a summary

[Michael Stauber <michael@xxxxxxxxxxxxxx>]

Hi Jose,

> The bug is really stupid. The Control Panel checks to see if the start up
> script for Legato Netwroker is in the rc3.d directory. [...]
> that is in the rc3.d directory (S95networker and S99networker
> respectively). Therefore, the control panel thinks it is disabled and will
> not remove the existing start up script (link).

Outch. That's of course a stupid error. Thanks for the pointers! I just 
removed the links for Arkeia and Networker and the mysterious ports are no 
longer open. S99... starts Postgres on my end. 

Reminds me of something: When I disable Postgres (which I don't need as I 
have MySQL installed), then the security monitor mails me periodically that 
Postgres is no longer running. Does anyone know where this security monitor 
is located, so that I can take a look at it?

Best regards,

Michael Stauber