Re: Removing Appletalk

On Fri May 02 2003 at 14:22, "Betsy Burlingame" wrote:

> Someone hacked into my development server and
> installed/started up appletalk.  I was actually
> sitting in front of my computer when I noticed
> it happening and it said "starting Appletalk"
> or something similar.

If this isn't a rootkit (as someone else mentioned)...

One simple way to disable appletalk is to add this to
/etc/modules.conf ...

alias	appletalk	off
alias	ipx		off

(I also disable ipx the same way).

> I cannot find any instructions on how to uninstall
> Appletalk -- or at least stop it from starting
> at startup.  From a few random messages I've found
> through google, etc... I think that it is
> conflicting with something else.

There is no netatalk rpm for rh72 that I am aware of (at least from
redhat), so it was probably compiled and installed from a tarball...
in which case the "make install" could have mangled parts of your
rpm-based installation.  Try running "rpm --verify --all" to find
out what has been damaged, then reinstall whatever is necessary.

If it was installed from an rpm, then "rpm -e netatalk" should
easily remove it.

> This is not the first time that this has happened --
> someone has done it to my computer several times
> recently.  But, this is the first time I saw it
> happening and can at least diagnose what caused
> everything to stop working.

It seems that you need to take some radical steps to secure both
physical (local) and remote network access to your box to prevent
this from happening.  Are you running with all the security updates
applied for rh72?  Are you running any unnecessary/insecure network
services?  Are you using a password for lilo/grub for single user
mode access?  Have you disabled boot from floppy or cdrom in the
bios (locked with a password)?

> Any help would be greatly appreciated.
> Thank you,
> Betsy

Good luck.

Cheers
Tony