Good morning all!

I am trying to turn Telnet access OFF on my Raq4i. The GUI says "/etc/inetd.conf Locked". There was a lock in /etc/locks/ so I rm that file. I then tryed to pico /etc/inetd.conf and make the edit and then save the file, but I get "Cannot open file for writing: Permission denied" All changes are being done as ROOT??? I thought ROOT has full permissions?

Everytime I reboot the server, the inetd.conf file gets added to the /etc/locks What could be adding it to the locks?

Any suggestions appreciated.

GREG3f

physical access would solve your problem
or shutting down the inet daemon...

I have managed to install Webmin, could you tell me how to shut down the inet daemon?

I thought Webmin was free?
http://www.webmin.com/

Mouse

Yes mouse, webmin is free, and I managed to find a free package that is set to get the latest version before it installs it. You can get that package here

I just need to know how to use it now to stop the inet daemond as per raqtweak.com's suggestion

Perhaps I am making some head way with this one...

I installed chkrootkit from here and got the following results.

ROOTDIR is `/'
Checking `amd'... not found
Checking `basename'... not infected
Checking `biff'... not found
Checking `chfn'... not infected
Checking `chsh'... not infected
Checking `cron'... not infected
Checking `date'... not infected
Checking `du'... INFECTED
Checking `dirname'... not infected
Checking `echo'... not infected
Checking `egrep'... not infected
Checking `env'... not infected
Checking `find'... not infected
Checking `fingerd'... not found
Checking `gpm'... not infected
Checking `grep'... not infected
Checking `hdparm'... not infected
Checking `su'... not infected
Checking `ifconfig'... not infected
Checking `inetd'... not infected
Checking `inetdconf'... INFECTED
Checking `identd'... not found
Checking `killall'... INFECTED
Checking `ldsopreload'... not infected
Checking `login'... INFECTED
Checking `ls'... INFECTED
Checking `lsof'... not found
Checking `mail'... not infected
Checking `mingetty'... not infected
Checking `netstat'... INFECTED
Checking `named'... not infected
Checking `passwd'... not infected
Checking `pidof'... not infected
Checking `pop2'... not found
Checking `pop3'... not found
Checking `ps'... INFECTED
Checking `pstree'... INFECTED
Checking `rpcinfo'... not infected
Checking `rlogind'... not infected
Checking `rshd'... not infected
Checking `slogin'... not infected
Checking `sendmail'... not infected
Checking `sshd'... not infected
Checking `syslogd'... INFECTED
Checking `tar'... not infected
Checking `tcpd'... not infected
Checking `tcpdump'... not infected
Checking `top'... INFECTED
Checking `telnetd'... not infected
Checking `timed'... not found
Checking `traceroute'... not infected
Checking `w'... not infected
Checking `write'... not infected
Checking `aliens'...
/dev/ptyxx/.addr
Searching for sniffer's logs, it may take a while... nothing found
Searching for HiDrootkit's default dir... nothing found
Searching for t0rn's default files and dirs... nothing found
Searching for t0rn's v8 defaults... nothing found
Searching for Lion Worm default files and dirs... nothing found
Searching for RSHA's default files and dir... nothing found
Searching for RH-Sharpe's default files... nothing found
Searching for Ambient's rootkit (ark) default files and dirs... Possible Ambient's rootkit (ark) installed
Searching for suspicious files and dirs, it may take a while...
/usr/lib/perl5/site_perl/5.005/i386-linux/auto/mod_perl/.packlist /usr/lib/perl5/site_perl/5.005/i386-linux/auto/MD5/.packlist /usr/lib/perl5/site_perl/5.005/i386-linux/auto/Quota/.packlist /usr/lib/perl5/site_perl/5.005/i386-linux/auto/XML/Parser/.packlist /usr/lib/perl5/site_perl/5.005/i386-linux/auto/Devel/Symdump/.packlist /usr/lib/perl5/site_perl/5.005/i386-linux/auto/DBI/.packlist /usr/lib/perl5/site_perl/5.005/i386-linux/auto/Msql-Mysql-modules/.packlist /usr/lib/perl5/site_perl/5.005/i386-linux/auto/Net/SSLeay/.packlist /usr/lib/perl5/site_perl/5.005/i386-linux/auto/Jcode/.packlist /usr/lib/perl5/5.00503/i386-linux/.packlist /usr/lib/.ark?

Searching for LPD Worm files and dirs... nothing found
Searching for Ramen Worm files and dirs... nothing found
Searching for Maniac files and dirs... nothing found
Searching for RK17 files and dirs... nothing found
Searching for Ducoci rootkit... nothing found
Searching for Adore Worm... nothing found
Searching for @#!@#!@#!@#!C Worm... nothing found
Searching for Omega Worm... nothing found
Searching for Sadmind/IIS Worm... nothing found
Searching for MonKit... nothing found
Searching for Showtee... nothing found
Searching for OpticKit... nothing found
Searching for T.R.K... nothing found
Searching for Mithra... nothing found
Searching for OBSD rk v1... nothing found
Searching for LOC rootkit ... nothing found
Searching for Romanian rootkit ... nothing found
Searching for anomalies in shell history files... nothing found
Checking `asp'... not infected
Checking `bindshell'... not infected
Checking `lkm'... nothing detected
Checking `rexedcs'... not found
Checking `sniffer'...
eth0 is not promisc
eth0:0 is not promisc
eth0:1 is not promisc
eth0:2 is not promisc
eth0:3 is not promisc
eth0:4 is not promisc
Checking `wted'... nothing deleted
Checking `scalper'... not infected
Checking `slapper'... not infected
Checking `z2'...
nothing deleted


How can I fix the INFECTED files?

If you have some infected files backup your files and order a restore.

That was my immediate feeling, however after reading this post by Aussie I am hoping for a miracle cure! Is a restore my best option, or is there a viable way to salvage the server? Should we be trying to figure out how it was comprimised in order to prevent future attacks? Just don't want to cut my nose to spite my face

Sorry, these are the only steps you should take. Anything else is unwise.

1) Backup information
2) Order a restore
3) Setup and restore

-N

OK, if those are my options, could someone tell me what the best method of backup is?

I have been using raqbackup.sh, but I have never had to restore it.

Are there better wasy to backup?

raqbackup.sh works well -- make sure you get the latest cmu from cobalt (sun).

also make manual backups of mysql and other important directories.