KCLUG

4 participants
3292 discussions

Re: Has my server been hacked? apt-get upgrade fears...
by Don Erickson 14 Nov '05

14 Nov '05

On Mon, 14 Nov 2005, Matt Graham wrote: > Yikes. Check out what apt-get says when I tell it to upgrade. > > That's a big list. Should I be afraid for my system if I say yes? Or do > I trust apt to do it's thing? Should my system be in any type of runlevel > when I do this? Can I do this from an ssh session? Are you running "stable", aka sarge? If so, then go ahead and upgrade if you want, it should be okay. Changing runlevels isn't necessary. You can do it from ssh. But, we don't know that your system has been purged of bad stuff. We _think_ that there are processes running as the www-data user, but I didn't see your output from the ps -u www-data command. It seems logical that your box wasn't rooted, but I'm just guessing from behind an opaque curtain. There was a local root exploit in the 2.4 and 2.6 kernels about a year ago, and if your installation is 9 months old or older, you might well have been rooted. I just looked it up, versions kernels < 2.4.30 and < 2.6.10 are vulnerable. If you're running a kernel older than these, reinstall. Either way, removing awstats removed the access hole, but didn't necessarily remove anything else that might have been uploaded to your machine. Bad guys have been using your box, and you don't know what all they might have done. We are assuming at this point that everything that they did was done as www-data, your apache owner. Do a # find / -user www-data > /tmp/www-data_owned_files.txt then look through it for funny stuff. But, if your kernel is older than the versions listed above, reinstall anyway. That's just my opinion. -Don

1 0

Solution: Perl modules needing updates
by Garrett Goebel 14 Nov '05

14 Nov '05

Somebody asked the question about how to run a cron job to determine which perl modules need updates a few days back. I'd intended to answer it, but apparently it made it to my bitbucket first... You'll have to have CPAN configured first. But from the CPAN.pm documentation (http://search.cpan.org/~andk/CPAN-1.76/lib/CPAN.pm#Programmer's_interface): # list all installed modules that have newer version on CPAN perl -e 'use CPAN; CPAN::Shell->r;' Which is nice from the command-line, but prints a lot of extraneous info. So here's the script they list that you could save off and run via a cron job: # list all modules on my disk that have newer versions on CPAN for $mod (CPAN::Shell->expand("Module","/./")){ next unless $mod->inst_file; next if $mod->uptodate; printf "Module %s is installed as %s, could be updated to %s from CPAN\n", $mod->id, $mod->inst_version, $mod->cpan_version; } And here's how you could update everything to the current recommendations from the command-line: # install everything that is outdated on my disk: perl -MCPAN -e 'CPAN::Shell->install(CPAN::Shell->r)' cheers, Garrett -- Garrett Goebel IS Development Specialist ScriptPro Direct: 913.403.5261 5828 Reeds Road Main: 913.384.1008 Mission, KS 66202 Fax: 913.384.2180 www.scriptpro.com garrett at scriptpro dot com

1 0

Re: Has my server been hacked?
by Don Erickson 14 Nov '05

14 Nov '05

On Mon, 14 Nov 2005, Matt Graham wrote: > I don't see the lupii file in /tmp. I see the following: > > There is no netstat output with lupii. Okay, so you're (probably) a victim of the awstats hole, but not the worm that exploits it. > It's been a while since I've done an apt-get upgrade. Those always seem > to make my system unbootable for some reason, so I guess I put them off > too long. Subscribe to debian-security(a)lists.debian.org. Then just upgrade the packages you're running that have security holes. I'd be real interested in what returns if you do a # zgrep awstats.pl\? /var/log/apache/access.log.?.gz|less That'd show who was testing for the exploit in the last 10 weeks, and probably the exploit itself. I'm still assuming that the awstats hole is the method of entry, as you were vulnerable and the above "grep" run on three separate web servers show 25 to 37 exploit attempts each. I'd also be curious if what you get by running a # ps -u www-data which would show any processes running that are owned by the www-data user. If you've got anything other than a web servers and gcache, kill the process and save the file for forensics. > My plan is to backup important stuff, format the system > partition (my /home is on a different drive altogether), reinstall debian > stable and do regular (weekly?) apt-get updates. You might try mondoarchive as a last ditch bare-metal recovery backup system. It hisorically has had a few issues running on debian, but worked for me the one time my normal backups were corrupted and I _really_ needed it. Regards, -Don

1 0

RE: SWB cable and sshd
by Kelsay, Brian - Kansas City, MO 14 Nov '05

14 Nov '05

Any number of things could be wrong. First, does he have a hardware firewall between him and the modem? If so, it probably does NAT and port-forwarding, but you need to specifically allow port 22 or another port open to connections from your IP, and have it forward to his PC on port 22. Next, software firewall, add a rule to allow connections from your IP to his port 22. ******************************************* If the automobile had followed the same development cycle as the computer, a Rolls-Royce would today cost $100, get a million miles per gallon, and explode once a year, killing everyone inside. - Robert X. Cringely -----Original Message----- From: Behalf Of Jack Greetings, I am looking for help on how to get ssh working for a client. I recently converted a client over to Linux for one of his computers. I have ssh running on his machine, but things are not the way they should be. Here's the thing, the computer is using a private ip address. So in order to find out what his ip address was, I connected from his machine to one of mine, thus capturing the ip address in my logs (sure I know there are other ways). So, when I try to connect from my machine, to his I get connection refused. While I can ping his box, and it appears to be up, neither ssh nor telnet work. I didn't really expect telnet to work. Is there something that SWB does to prevent this? Or could his modem be rejecting ssh? Another possibility I can think of is, when I installed Ubuntu on his machine it installed a firewall. Anyone? Thanks, Brian JD

1 0

Missing extension cable
by Arthur Pemberton 13 Nov '05

13 Nov '05

Two meetings ago I brought in an electrical extension cable to the meeting (the meeting when we had to use a different room). Anyone has that cord or no what may have happened to it? -- As a boy I jumped through Windows, as a man I play with Penguins.

1 0

Has my server been hacked?
by Matt Graham 13 Nov '05

13 Nov '05

Hi. I got this email (below) from someone saying that my server is attacking theirs. They used my IP in the subject line as well. Is this what happens when a system is rooted? If I suspect that this has happened, is my best option to reinstall? Matt --------------- Hello, I am not sure if you are aware that your server is conducting a vulnerability search and is continually hitting my server. I am guessing that you are unaware of it since the attacking IP is riddled with personal pictures of your self and your sister. Could you please look into this ASAP. Grant. --------------- -- matt(a)bizniche.com http://themdg.org

4 6

Re: MP3 support in Linux distros?
by Luke-Jr 13 Nov '05

13 Nov '05

On Sunday 13 November 2005 08:38, you wrote: > Fedora, Forbidden > Items<http://fedoraproject.org/wiki/ForbiddenItems#head-69c9770fc2ef79ea9a6 >91d03aa2f475eed113bfa> Except that the GPL (v2) talks nothing of patents, so it would be technically legal. > > My how to on how to add mp3/wma support to > Fedora<http://www.pembo13.com/linux/fc4-audio.php> > > On 11/12/05, Luke-Jr <luke(a)dashjr.org> wrote: > > On Saturday 12 November 2005 23:27, Leo Mauler wrote: > > > Someone on another forum lambasted my suggestion that the XviD video > > > > codec > > > > > would play on any Linux machine by saying that most distros didn't come > > > > with > > > > > MP3 support, making a lot of XviD videos play in Linux with no sound. > > > > XviD is not MP3. Generally, XviD is paired up with Vorbis, so it's not > > even a > > safe assumption that an XviD encoded video would use MP3... so the whole > > debate is irrelevant to your suggestion. Of course, I wouldn't suggest > > XviD-- > > ffmpeg's MP4 encoder is better. > > > > > I went looking and of course he's right, Debian and Ubuntu don't have > > > it > > > > for > > > > > obvious licensing reasons, Redhat pulled support for MP3 back in > > > version > > > > 8.0 > > > > > and never put it back. Mandriva still includes support for MP3s. > > > > I think the lack of MP3 support is more of a lecture on using Vorbis > > instead > > of MP3 than anything else. > > > > > What exactly is the official policy on MP3s? Is there an unwritten > > > > policy > > > > > thats sort of <nudge, nudge, wink, wink> regarding allowing free > > > > software > > > > > MP3 decoders/encoders? > > > > I think there's a written licensing policy that MP3 is licensed for any > > non-commercial use. > > _______________________________________________ > > Kclug mailing list > > Kclug(a)kclug.org > > http://kclug.org/mailman/listinfo/kclug > > -- > As a boy I jumped through Windows, as a man I play with Penguins. -- I digitally sign my emails. If you see an attachment with .asc, then that means your email client doesn't support PGP digital signatures. http://www.gnupg.org/documentation/faqs.html#q1.1

2 1

Re: Has my server been hacked? : New Worm Targets Linux Web Service Holes
by Don Erickson 13 Nov '05

13 Nov '05

Well, here's my best guess. Either upgrade awstats or dump it. You're runinng awstats 6.0, which is vulnerable to an exploit, and there's even a worm out there that attacks it. It's not a root exploit, but it's your box, so reinstall if you think that's best. And also, you should subscribe to a security mailing list. http://www.eweek.com/article2/0,1895,1882889,00.asp

1 0

RE: Program Suggestion (also Re: checkinstall (mentioned inmeeting))
by Kelsay, Brian - Kansas City, MO 12 Nov '05

12 Nov '05

RedHat has some sort of rollback to RPM. I read about it in Linux Journal. You have to execute extra command parameters at app. install-time. There is a database that is kept of the changes and locations of files. -----Original Message----- From: Behalf Of Leo Mauler The link appears to be broken. Since we can't get to the link, does "make package from source" mean that you are recompiling the source code for the application? If so, then I'd much rather have my idea about an installer "wrapper" implemented as I really don't feel like recompiling OpenOffice.org from source just to get an uninstaller script/application. I'd much rather have an application that recorded the changes to the system and then either told you what they were or provided a convenient uninstaller script, or both. --- "Sexton, Kyle" <ksexton(a)gsihosting.com> wrote: > For those who were interested in Check Install that > I mentioned in the meeting, the URL is > http://asic-linux.com.mx/~izto/checkinstall/. > From the website which describes it better than > I can: > > "CheckInstall will create a Slackware, RPM or > Debian compatible package and install it with > Slackware's installpkg, "rpm -i" or Debian's > "dpkg -i" as appropriate, so you can view it's > contents with pkgtool ("rpm -ql" for RPM users > or "dpkg -l" for Debian) or remove it with > removepkg ("rpm -e"|"dpkg -r")." > > It does this from your source packages.

3 2

computer systems / hardware to a good home.
by hanasaki 12 Nov '05

12 Nov '05

due to upgrades.... ========= 1yr old 1gig ddr400 RAM 120gig ata133 20gig AMD Barton 3000+ soyo dragon ultra platinum kt600 onboard 10/100/1000 NIC / network ========== 19" CRT - Samsung 900DF ========== nvidia 5700 128meg gainward AGP8x 2dvi out with vga attapters LCD and CRT monitor compatible ========= athlon 600 512 meg RAM low end video 40? gig ata drive asus k7m motherboard ========= intel pIII? 800 256meg Ram 6gig HD low end video ========= intel Pentium 166 128meg RAM 4gig HD low end video email at hanasaki-hw20051110(a)hanaden.com with offers for any / all.

2 1

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

KCLUG