Checking logs the following caught my eye... Oct 29 13:16:53 ns sendmail[16229]: alias database /etc/aliases autorebuilt by petplan
Now we designed the site and administer it so I knew there was no changed done to the account... When I go into the site admin for that account - I notice that the telnet icon is showing ??? Telnet is disabled from the main Admin GUI and has been for months, when you go to the user siteadmin panel Telnet is disabled there also but the icon is showing ??? Now when I go back to check all the sites using the same IP I notice that some have their telnet icons showing in the site admin box. I then went to the main Admin GUI and activated then deactivated Telnet, then restarted services then checked all the sites on the box, now other sites with different IP's are showing the telnet icon in the siteadmin. I also noticed that several sites had their Telnet activated in the GUI's - now I know that each account on this box was physically checked months back and everyone had the Telnet disabled. I have now gone and changed the main admin password in case their is a compromised from the collocation centre. Can anyone tell me if this is a know issue, bug, virus or hack - I'm a bit concerned that all of a sudden sites have Telnet activated or at least showing activated in the admin panels. I have also tried to Telnet into the various IP's but keep getting a time out connection - I assume that Telnet is still disabled. Many thanks in advance Chae _______________________________________________ cobalt-security mailing list [EMAIL PROTECTED] http://list.cobalt.com/mailman/listinfo/cobalt-security
