KCLUG November 2005

kclug@kclug.org

43 participants
67 discussions

Re: Has my server been hacked?
by Don Erickson 14 Nov '05

14 Nov '05

On Mon, 14 Nov 2005, Matt Graham wrote: > I don't see the lupii file in /tmp. I see the following: > > There is no netstat output with lupii. Okay, so you're (probably) a victim of the awstats hole, but not the worm that exploits it. > It's been a while since I've done an apt-get upgrade. Those always seem > to make my system unbootable for some reason, so I guess I put them off > too long. Subscribe to debian-security(a)lists.debian.org. Then just upgrade the packages you're running that have security holes. I'd be real interested in what returns if you do a # zgrep awstats.pl\? /var/log/apache/access.log.?.gz|less That'd show who was testing for the exploit in the last 10 weeks, and probably the exploit itself. I'm still assuming that the awstats hole is the method of entry, as you were vulnerable and the above "grep" run on three separate web servers show 25 to 37 exploit attempts each. I'd also be curious if what you get by running a # ps -u www-data which would show any processes running that are owned by the www-data user. If you've got anything other than a web servers and gcache, kill the process and save the file for forensics. > My plan is to backup important stuff, format the system > partition (my /home is on a different drive altogether), reinstall debian > stable and do regular (weekly?) apt-get updates. You might try mondoarchive as a last ditch bare-metal recovery backup system. It hisorically has had a few issues running on debian, but worked for me the one time my normal backups were corrupted and I _really_ needed it. Regards, -Don

1 0

RE: SWB cable and sshd
by Kelsay, Brian - Kansas City, MO 14 Nov '05

14 Nov '05

Any number of things could be wrong. First, does he have a hardware firewall between him and the modem? If so, it probably does NAT and port-forwarding, but you need to specifically allow port 22 or another port open to connections from your IP, and have it forward to his PC on port 22. Next, software firewall, add a rule to allow connections from your IP to his port 22. ******************************************* If the automobile had followed the same development cycle as the computer, a Rolls-Royce would today cost $100, get a million miles per gallon, and explode once a year, killing everyone inside. - Robert X. Cringely -----Original Message----- From: Behalf Of Jack Greetings, I am looking for help on how to get ssh working for a client. I recently converted a client over to Linux for one of his computers. I have ssh running on his machine, but things are not the way they should be. Here's the thing, the computer is using a private ip address. So in order to find out what his ip address was, I connected from his machine to one of mine, thus capturing the ip address in my logs (sure I know there are other ways). So, when I try to connect from my machine, to his I get connection refused. While I can ping his box, and it appears to be up, neither ssh nor telnet work. I didn't really expect telnet to work. Is there something that SWB does to prevent this? Or could his modem be rejecting ssh? Another possibility I can think of is, when I installed Ubuntu on his machine it installed a firewall. Anyone? Thanks, Brian JD

1 0

Missing extension cable
by Arthur Pemberton 14 Nov '05

14 Nov '05

Two meetings ago I brought in an electrical extension cable to the meeting (the meeting when we had to use a different room). Anyone has that cord or no what may have happened to it? -- As a boy I jumped through Windows, as a man I play with Penguins.

1 0

Has my server been hacked?
by Matt Graham 13 Nov '05

13 Nov '05

Hi. I got this email (below) from someone saying that my server is attacking theirs. They used my IP in the subject line as well. Is this what happens when a system is rooted? If I suspect that this has happened, is my best option to reinstall? Matt --------------- Hello, I am not sure if you are aware that your server is conducting a vulnerability search and is continually hitting my server. I am guessing that you are unaware of it since the attacking IP is riddled with personal pictures of your self and your sister. Could you please look into this ASAP. Grant. --------------- -- matt(a)bizniche.com http://themdg.org

4 6

Re: MP3 support in Linux distros?
by Luke-Jr 13 Nov '05

13 Nov '05

On Sunday 13 November 2005 08:38, you wrote: > Fedora, Forbidden > Items<http://fedoraproject.org/wiki/ForbiddenItems#head-69c9770fc2ef79ea9a6 >91d03aa2f475eed113bfa> Except that the GPL (v2) talks nothing of patents, so it would be technically legal. > > My how to on how to add mp3/wma support to > Fedora<http://www.pembo13.com/linux/fc4-audio.php> > > On 11/12/05, Luke-Jr <luke(a)dashjr.org> wrote: > > On Saturday 12 November 2005 23:27, Leo Mauler wrote: > > > Someone on another forum lambasted my suggestion that the XviD video > > > > codec > > > > > would play on any Linux machine by saying that most distros didn't come > > > > with > > > > > MP3 support, making a lot of XviD videos play in Linux with no sound. > > > > XviD is not MP3. Generally, XviD is paired up with Vorbis, so it's not > > even a > > safe assumption that an XviD encoded video would use MP3... so the whole > > debate is irrelevant to your suggestion. Of course, I wouldn't suggest > > XviD-- > > ffmpeg's MP4 encoder is better. > > > > > I went looking and of course he's right, Debian and Ubuntu don't have > > > it > > > > for > > > > > obvious licensing reasons, Redhat pulled support for MP3 back in > > > version > > > > 8.0 > > > > > and never put it back. Mandriva still includes support for MP3s. > > > > I think the lack of MP3 support is more of a lecture on using Vorbis > > instead > > of MP3 than anything else. > > > > > What exactly is the official policy on MP3s? Is there an unwritten > > > > policy > > > > > thats sort of <nudge, nudge, wink, wink> regarding allowing free > > > > software > > > > > MP3 decoders/encoders? > > > > I think there's a written licensing policy that MP3 is licensed for any > > non-commercial use. > > _______________________________________________ > > Kclug mailing list > > Kclug(a)kclug.org > > http://kclug.org/mailman/listinfo/kclug > > -- > As a boy I jumped through Windows, as a man I play with Penguins. -- I digitally sign my emails. If you see an attachment with .asc, then that means your email client doesn't support PGP digital signatures. http://www.gnupg.org/documentation/faqs.html#q1.1

2 1

Re: Has my server been hacked? : New Worm Targets Linux Web Service Holes
by Don Erickson 13 Nov '05

13 Nov '05

Well, here's my best guess. Either upgrade awstats or dump it. You're runinng awstats 6.0, which is vulnerable to an exploit, and there's even a worm out there that attacks it. It's not a root exploit, but it's your box, so reinstall if you think that's best. And also, you should subscribe to a security mailing list. http://www.eweek.com/article2/0,1895,1882889,00.asp

1 0

RE: Program Suggestion (also Re: checkinstall (mentioned inmeeting))
by Kelsay, Brian - Kansas City, MO 13 Nov '05

13 Nov '05

RedHat has some sort of rollback to RPM. I read about it in Linux Journal. You have to execute extra command parameters at app. install-time. There is a database that is kept of the changes and locations of files. -----Original Message----- From: Behalf Of Leo Mauler The link appears to be broken. Since we can't get to the link, does "make package from source" mean that you are recompiling the source code for the application? If so, then I'd much rather have my idea about an installer "wrapper" implemented as I really don't feel like recompiling OpenOffice.org from source just to get an uninstaller script/application. I'd much rather have an application that recorded the changes to the system and then either told you what they were or provided a convenient uninstaller script, or both. --- "Sexton, Kyle" <ksexton(a)gsihosting.com> wrote: > For those who were interested in Check Install that > I mentioned in the meeting, the URL is > http://asic-linux.com.mx/~izto/checkinstall/. > From the website which describes it better than > I can: > > "CheckInstall will create a Slackware, RPM or > Debian compatible package and install it with > Slackware's installpkg, "rpm -i" or Debian's > "dpkg -i" as appropriate, so you can view it's > contents with pkgtool ("rpm -ql" for RPM users > or "dpkg -l" for Debian) or remove it with > removepkg ("rpm -e"|"dpkg -r")." > > It does this from your source packages.

3 2

computer systems / hardware to a good home.
by hanasaki 12 Nov '05

12 Nov '05

due to upgrades.... ========= 1yr old 1gig ddr400 RAM 120gig ata133 20gig AMD Barton 3000+ soyo dragon ultra platinum kt600 onboard 10/100/1000 NIC / network ========== 19" CRT - Samsung 900DF ========== nvidia 5700 128meg gainward AGP8x 2dvi out with vga attapters LCD and CRT monitor compatible ========= athlon 600 512 meg RAM low end video 40? gig ata drive asus k7m motherboard ========= intel pIII? 800 256meg Ram 6gig HD low end video ========= intel Pentium 166 128meg RAM 4gig HD low end video email at hanasaki-hw20051110(a)hanaden.com with offers for any / all.

2 1

RE: Program suggestion
by Sexton, Kyle 09 Nov '05

09 Nov '05

You should check out the checkinstall program that I sent a link about a few days ago. It basically does exactly that, with the advantage of creating packages for the programs. Kyle Sexton -----Original Message----- From: kclug-bounces(a)kclug.org [mailto:kclug-bounces@kclug.org] On Behalf Of Leo Mauler Sent: Tuesday, November 08, 2005 4:58 AM To: kclug(a)kclug.org Subject: Re: Program suggestion A decent uninstaller for source-compiled and standalone installer applications. Some kind of installer "wrapper" which would make a record of installed files and either offer the option to uninstall them for you, or at least give you a "roadmap" to do it by hand. It could be as simple as a script which does a recursive ls from root directory before and after the install, and then reports the changes in the "after" file. An added bonus would be if the whole process was automatic, such as the following command line (using an example standalone installer): uninstaller /root/install/OOo/setup ...which makes the text dbase of the system, runs /root/install/OOo/setup, then makes another text dbase and reports the differences between the two. It would be very nice to be able to have a batch install mode, where the second files dbase was then used as the baseline dbase for the second application installer. For example, since OpenOffice.org 2.0 now requires a current version of Java, it would be nice to be able to run first the Java standalone installer, then the OpenOffice.org 2.0 installer, all from the comfort of one "uninstaller wrapper" which then provides you with the necessary information to uninstall both of them. For source-compiled applications, something to reverse "make install" would be nice too. --- Arthur Pemberton <pemboa(a)gmail.com> wrote: > Can anyone suggest a small application CLI or GUI > that just seems to be "missing" from Linux? Not > necessarily an application that exists in Windows, > but not in Linux, but a program that would make \ > some part of your Linux experience better. > > I am just dying to make a cool Linux app/project, > but I am lacking ideas. For interface, I am > considering console, GTK+ or Qt. For programming > language, I am considering Python or C++; > > I appreciate your ideas. __________________________________ Yahoo! FareChase: Search multiple travel sites in one click. http://farechase.yahoo.com _______________________________________________ Kclug mailing list Kclug(a)kclug.org http://kclug.org/mailman/listinfo/kclug

2 1

[OT] dynamic resolution web sites
by Jason Dewayne Clinton 09 Nov '05

09 Nov '05

Some of you may remember that some time ago we discussed making websites in Flash. At the time I strongly objected and suggested that some day SVG would be able to handle the resolution independent rendering which Flash offers without all the accessibility problems. Well I'm very excited to share that I think that day has finally arrived (or almost has). Firefox 1.5 RC1 was released today and with it comes support for SVG. This adds to the list of browsers supporting SVG: Opera and Konqueror which is a total of roughly 13% of the browser market. Add to that the IE Adobe SVG Plugin for IE6 (85%) and the picture starts to look pretty rosy. I have put up a proof of concept at [1]. Please give it a good work-out. It will not work in Konqueror <3.4, Opera <8 or Firefox <1.5. IE 6 doesn't allow rescaling fonts but it does display the content correctly. [1] <http://jasonclinton.com/calig_test.html> I strongly feel that this is the future of the web and I'm looking forward to playing around with HTML+SVG. Let me know your thoughts! -- I use digital signatures and encryption. My key is stored at pgp.mit.edu 0x8DB3BF09 FP: F628 D9D3 E57A C281 5EFE - 7DF7 B52A A393 8DB3 BF09

5 14

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

KCLUG November 2005