KCLUG October 2004

kclug@kclug.org

53 participants
175 discussions

OT RE: long sig (was: PostNuke site cracked)
by Brian Kelsay 26 Oct '04

26 Oct '04

You're right! I had started to snooze by the time I got to the end there. Maybe it was a trait of all Roosevelts. I do like most of what I read about Teddy, but sometimes he was over the top and too cavalier. He is lucky he was successful in most of what he took on. I saw an old Sean Connery movie, "The Wind and the Lion," a few weeks ago. Brian Keith was playing Teddy. I don't think the Secret Service would allow a lot of what he did to go on today. I did think it was cool that Teddy was testing the new Henry repeating rifles and making/demanding changes to the design. Back then, campaigns were run from train cars on whistle-stop tours. Brian Kelsay >>> "Brian Densmore" <> 10/26/04 01:06PM >>> Wrong Roosevelt! ;') This is the one responsible for the National Park System. And the Boone & Crockett Club. We had no wars during his presidency, probably everyone was scared sh****** of the guy (just kiddin').

1 0

RE: spamassassin question [with blacklist question]
by Brian Densmore 26 Oct '04

26 Oct '04

I happen to like apache 1.3 and see no problems with the 2.4 kernel. The SA version in stable is 2.2 so it's quite out of date. Then there is exim using version 3.36. The thing I like about stable is that the security patches happen first in stable. Having been hacked once, I tend to be a bit more conservative these days (*and by the way, I've also been seeing a lot of those scripted hack attacks). At least where my "production" software is concerned. At home I run testing/unstable. Not sure how I accomplished that, but there it is. * I've added some code to my firewall rules to read in my personal blacklisted ipaddresses from a file and make drop rules out of it. Now I need to write a little script to put in cron to scan my logs once a day and extract ip-addresses that are attempting to login and add them to the blacklist and restart the firewall. something like: MYADDR=xxx.xxx.xxx.xxx BLACKLIST=/etc/blacklist.txt FWSCRIPT=/etc/init.d/firewall.sh cat /var/log/auth.log |grep -i failed\ password | cut -d\ -f11 |uniq > nuiq.txt if [ -e nuiq.txt ] then while read ipaddr do if [ $ipaddr ne $MYADDR ] ; then echo $ipaddr >> $BLACKLIST fi done < nuiq.txt $FWSCRIPT restart fi My only problem here is sometimes I need to use 'cut -d\ -f11' and sometimes 'cut -d\ f12'. Sometimes I have to do both in the same file. So I guess it's time to pull out the sed pocket reference I have and learn something in there to help. It's because of the way the date is being posted to the log file: Oct 9 ... Oct 10 ... So I get one extra delimiter when the date has one digit. I'd also like to be able to skip the saving of the list to a file step. Alas my script skill are insufficient for the task. Also I might soon need to use a case or some other control method to ignore perhaps a half a dozen ipaddresses or even a range of ipaddresses for other users of the system. Brian > -----Original Message----- > From: Jeremy Turner > > I said the heck with it and pinned my server on sarge. It'll > be the new > stable soon enough. I can't stand SA 2.4 or whatever is in > stable, same > with 2.4 kernel, Apache 1.3, etc. > > Jeremy > > -- > Jeremy Turner <jeremy(a)linuxwebguy.com> > Linux Tips and News! ---> http://linuxwebguy.com > >

3 2

OT: long sig (was: PostNuke site cracked)
by Brian Kelsay 26 Oct '04

26 Oct '04

Brian, I nominate you for Longest .sig. This also works for one of my theories; Roosevelt was a blow-hard. It's quite possible that the House and Senate agreed w/ his plans out of sheer boredom and a fight-flight instinctual response. Lucky for us that the war finally encouraged investment from the people in charge of spending real and borrowed money. <flame-retardant suit on> Brian Kelsay >>> "Brian Densmore" <> 10/26/04 12:34PM >>> "The President is ..... than about any one else." --Theodore Roosevelt, Kansas City Star, May 7, 1918

1 0

PostNuke site cracked
by Brian Densmore 26 Oct '04

26 Oct '04

Anyone who downloaded PostNuke between Sunday and Tuesday need to get rid of it and re-download it. Their site was cracked and an altered PostNuke download posted. http://www.newsforge.com/article.pl?sid=04/10/26/1356232 Brian "The President is merely the most important among a large number of public servants. He should be supported or opposed exactly to the degree which is warranted by his good conduct or bad conduct, his efficiency or inefficiency in rendering loyal, able, and disinterested service to the Nation as a whole. Therefore it is absolutely necessary that there should be full liberty to tell the truth about his acts, and this means that it is exactly necessary to blame him when he does wrong as to praise him when he does right. Any other attitude in an American citizen is both base and servile. To announce that there must be no criticism of the President, or that we are to stand by the President, right or wrong, is not only unpatriotic and servile, but is morally treasonable to the American public. Nothing but the truth should be spoken about him or any one else. But it is even more important to tell the truth, pleasant or unpleasant, about him than about any one else." --Theodore Roosevelt, Kansas City Star, May 7, 1918

1 0

CD Labels
by Bill Cavalieri 26 Oct '04

26 Oct '04

ok ready to print the knoppix labels now, who has the final KCLUG label? I have 50 Suse 9.1 Live CDS, and 100 knoppix cds (50 stable, 50 unstable), and if wife doesn't smack me too much will have mr roboto do 50-100 more. -Bill

1 0

RE: We got an ITEC Booth!
by Brian Kelsay 26 Oct '04

26 Oct '04

In all seriousness, if that is possible from me, you should probably wear business casual. Slacks or Docker type pants and a collared shirt like a Polo. Or nice jeans if you want to be a bit more comfortable. Like Dustin said, there is always the possibility of an on-the-spot job interview to consider. Just don't embarrass yourself before you get a chance to talk to someone with the ability to hire. If you are comfortably employed, then break out the bunny slippers and Cafe Press "Linux Rox" thong. Damn, I knew I couldn't do it. ;-) Brian Kelsay >>> "Dustin Decker" <> 10/26/04 10:06AM >>> > I am going to wear jeans and a black Think Geek Tux polo, my only > request (not that I am anybody mind you its just my opinion) is that > we not wear shorts/flip-flops. > > There is already a stigma that Linux users are the geeks, weirdos and > odd balls that live in the basement of our mothers house - so if we at > least present a semi-working friendly appearance, maybe we can (in a > small way I know) make a better first initial impression. I tend to agree. I know Hal Duston generally does the suit and tie for an engagement such as this... and is all the better for it if interviewed on T.V.

2 1

RE: Cymor/Evil_machine
by Brian Densmore 26 Oct '04

26 Oct '04

> -----Original Message----- > From: Brian Kelsay > > If you find out the hospital, forward the name and room > number, possibly a link via mapquest to find it. If anyone > can they should visit or send something. I'll visit if I > find out where he is. I consider Chris a good friend. He > has helped me out numerous times and an attempt to cheer him > up and show a friendly face is the least I could do. Yes that would be a good thing. > > Maybe I'll go get him a toy motorcycle to play with in the > hospital. That wouldn't be bad taste would it? Best cure is to get right back on it, but it'll be a while before he can ride again. He'll probably be inundated with toy cycles. Might I suggest you get him a bell to hang on his (next) cycle. > Anybody > remember what his "dream bike" is? I'll have some time to go > a few places tonight and visit tonight or tomorrow.

1 0

OT: Cymor/Evil_machine
by Brian Kelsay 26 Oct '04

26 Oct '04

If you find out the hospital, forward the name and room number, possibly a link via mapquest to find it. If anyone can they should visit or send something. I'll visit if I find out where he is. I consider Chris a good friend. He has helped me out numerous times and an attempt to cheer him up and show a friendly face is the least I could do. Maybe I'll go get him a toy motorcycle to play with in the hospital. That wouldn't be bad taste would it? Anybody remember what his "dream bike" is? I'll have some time to go a few places tonight and visit tonight or tomorrow. Brian Kelsay >>> Thomas Bruno <> 10/26/04 09:15AM >>> I should also add, that I was told he doesn't remember anything at all about that entire day. On Tue, 2004-10-26 at 09:13 -0500, Thomas Bruno wrote: > Chris Bier (Cymor/Evil_machine) was in a motorcycle accident on Sunday, > and is going to have surgery today for a open fracture on his arm. I was > told he was ok, and that his helmet only had a few scratches, and his > body armor wasn't damaged at all. > > He's been sitting in the hospital. I don't know what hospital or > anything yet. > > Tom (crweb/allyourrejects)

1 0

RE: spamassassin question [with blacklist question]
by Brian Densmore 26 Oct '04

26 Oct '04

Well you were right about sed. Not something I could do with sed. I wound up using awk, and temporarily putting the addresses in a separate file until I feel comfortable it won't jack up my firewall. #!/bin/sh # list of ip address to allow always MYIP=yyy.yyy.yyy.yyy MYIP2=xxx.xxx.xxx.xxx # name of logfile to scan - need to variablize so I can call it with an alternate # logfile and default to this lfl=/var/log/auth.log # ugly all on one line, but it works cat $lfl | grep -i failed\ password | awk '{ print $11 }' |uniq | grep -v $MYIP | grep -v $MYIP2 >> /etc/illegalips.txt # still to do add commands to extract ips from above file # and add to actual blacklist and call firewall restart > -----Original Message----- > From: Jeremy Turner > > > So I guess it's time > > to pull out the sed pocket reference I have and learn > > something in there to help. > > Nah... you're crying out for Perl =) > > #--------------------------------------------------------------- > #!/usr/bin/perl > > $my_ip = "192.168.0.1"; > %seen = (); > > # get input from stdin > while (<>) { > > # illegal = no username > # failed = wrong password > if (/Failed/ || /Illegal/) { > > # match an ip address > /(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/; > > if ($my_ip !~ $1) { > $seen{$1}++; > } > } > } > @ips = sort keys %seen; > foreach (@ips) { > print "$_\n"; > } > #----------------------------------------------------------- > > The "Failed" and "Illegal" words are lines you would check to > contain IP > addresses. The hash table is to knock out duplicate IP addresses. > > Jeremy > > -- > Jeremy Turner <jeremy(a)linuxwebguy.com> > Linux Tips and News! ---> http://linuxwebguy.com > > _______________________________________________ > Kclug mailing list > Kclug(a)kclug.org > http://kclug.org/mailman/listinfo/kclug >

1 0

We got an ITEC Booth!
by Chris Bier 26 Oct '04

26 Oct '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi All, ~ I just heard from ITEC a few minutes ago that they have a 10x10 booth for us. ITEC is Oct 27-28th at the Overland Park Convention Center. http://www.goitec.com/ They are also going to give us tickets to the pay sessions that they are holding. Chris - -- I digitally sign my emails. If you see an attachment with .asc, then that means your email client doesn't support PGP digital signatures. http://www.gnupg.org/(en)/documentation/faqs.html#q1.1 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBdXz6E5xXU3JS1mQRAk7UAKCfeN5BYAkST28jY3ClUY4iocsnKgCeP1PK 0fqNp7804N2z/hFYn2S0ag4= =gEdw -----END PGP SIGNATURE-----

6 7

← Newer
1
2
3
4
5
6
7
8
...
18
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

KCLUG October 2004