A friend is investigating break-ins on some of his servers, and he has noticed that on several of them (from very recent CentOS all the way back to one old ancient RHL 9) the crond process is listening on port 6550/tcp, which is identified in /etc/services as "fg-sysupdate". The crond does not appear to be hacked, and the listening is happening even one one box that he's nearly certain was not compromised.
None of my CentOS boxes have crond listening on that (or any other) port. And the crond manual doesn't have any information about configuring it to listen or not listen. So we're just puzzled as to why crond would be listening on this port, and how to turn that off if it's not needed.