RE: [cobalt-security] Re: [cobalt-users] ssh on port 44658???

[Åke Brännström <ake@xxxxxxxxxxx>]

On Tue, 17 Apr 2001, you wrote:
> I've found that "/usr/sbin/nscd" is the responsible program for that port
> being open. I don't know what that program is, as it is not found on our
> backup RaQ4 server (which mind you has a lot less updates and programs
> installed).
> I know that my server is now untrustworthy, but would it be a good idea to
> rename/delete this file in the meantime?

There's a small risk that you have the 't0rnkit' rootkit installetd on your
RaQ4. You can read more about this at CERT:

http://www.cert.org/incident_notes/IN-2000-10.html

If your RaQ4 have been hacked, as seems likely, my recommendation is that you
immediately make a safe copy of all important data and then reinstall the
operating system from scratch, install all patches and disable all services
that you do not need. If you merely disable nscd, there is a risk that the
hackers will find out that you're on to them and wipe your entire disk or
something equally nasty. 

Sincerely, 
Ake Brannstrom