October 2002 - WLUG - wlug.mailman3.com

Aurora SPARC Linux

by Charles R. Anderson

I'll have Aurora SPARC Linux (www.auroralinux.org) at tomorrow's InstallFest if anyone wants to try it out. It is basically the same as what would be Red Hat 7.3/Sparc, but they can't call it that since it wasn't officially made by Red Hat. There is a 32-bit version and a 64-bit version. -- Charles R. Anderson <cra(a)wpi.edu> / http://angus.ind.wpi.edu/~cra/ PGP Key ID: 49BB5886 Fingerprint: EBA3 A106 7C93 FA07 8E15 3AC2 C367 A0F9 49BB 5886

Oct. 23, 2002

RE: [Wlug] What's the tally for the installfest???

by Haines, Charles Allen

I've sent the message to WPILA twice now. Haven't gotten any response back, but at least they know. I'll be there with CD's for Gentoo 1.4_rc1 with stage3, Mandrake 9.0 and Redhat 8.0. I'm trying to get slack-current before then, we will see. ----------------------------------------- Chuck Haines GDC Systems Administrator Infinity Complex Developer WPILA Lab Manager ----------------------------------------- AIM: CyberGrex ICQ: 3707881 Yahoo: CyberGrex_27 Cell: (410) 610-6343. ----------------------------------------- "Geek by nature, Linux by choice." -----Original Message----- From: brad [mailto:brad@ithryn.net] Sent: Wednesday, October 23, 2002 2:24 PM To: wlug(a)mail.wlug.org Subject: Re: [Wlug] What's the tally for the installfest??? On Wednesday 23 October 2002 01:53 pm, Wes Allen wrote: > Is it tommorow? Or tonight? I believe it is tomorrow. > I want to be able to come and get my iPAQ converted (finally), but I > had my wisdom teeth out yesterday AND I've got the flu.....I'm pretty > zoned out. that's no fun. I'll be there if you want to install in your iPAQ. -brad > Wes > > On Wednesday 23 October 2002 1:26 pm, Keller, Tim wrote: > > Do we have a rough idea of how many people are going to be in > > attendance for the installfest? > > > > Later, > > Tim. > > > > _______________________________________________ > > Wlug mailing list > > Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug

Oct. 23, 2002

RE: [Wlug] What's the tally for the installfest???

by Keller, Tim

Tomorrow... I hope you feel better. Tim. -----Original Message----- From: Wes Allen [mailto:wallen@charter.net] Sent: Wednesday, October 23, 2002 13:54 PM To: wlug(a)mail.wlug.org Subject: Re: [Wlug] What's the tally for the installfest??? Is it tommorow? Or tonight? I want to be able to come and get my iPAQ converted (finally), but I had my wisdom teeth out yesterday AND I've got the flu.....I'm pretty zoned out. Wes On Wednesday 23 October 2002 1:26 pm, Keller, Tim wrote: > Do we have a rough idea of how many people are going to be in attendance > for the installfest? > > Later, > Tim. > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug -- ------ This message may be signed using GPG, for my public key please send me a message with "Key Request" in the subject line. _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug

Oct. 23, 2002

Re: [Wlug] What's the tally for the installfest???

by brad

On Wednesday 23 October 2002 01:53 pm, Wes Allen wrote: > Is it tommorow? Or tonight? I believe it is tomorrow. > I want to be able to come and get my iPAQ converted (finally), but I had my > wisdom teeth out yesterday AND I've got the flu.....I'm pretty zoned out. that's no fun. I'll be there if you want to install in your iPAQ. -brad > Wes > > On Wednesday 23 October 2002 1:26 pm, Keller, Tim wrote: > > Do we have a rough idea of how many people are going to be in attendance > > for the installfest? > > > > Later, > > Tim. > > > > _______________________________________________ > > Wlug mailing list > > Wlug(a)mail.wlug.org > > http://mail.wlug.org/mailman/listinfo/wlug

Oct. 23, 2002

Re: [Wlug] What's the tally for the installfest???

by Wes Allen

Is it tommorow? Or tonight? I want to be able to come and get my iPAQ converted (finally), but I had my wisdom teeth out yesterday AND I've got the flu.....I'm pretty zoned out. Wes On Wednesday 23 October 2002 1:26 pm, Keller, Tim wrote: > Do we have a rough idea of how many people are going to be in attendance > for the installfest? > > Later, > Tim. > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug -- ------ This message may be signed using GPG, for my public key please send me a message with "Key Request" in the subject line.

Oct. 23, 2002

What's the tally for the installfest???

by Keller, Tim

Do we have a rough idea of how many people are going to be in attendance for the installfest? Later, Tim.

Oct. 23, 2002

Re: [Wlug] Restarting ldap by user, not by root!

by Charles R. Anderson

On Wed, Oct 23, 2002 at 05:34:55PM +0700, Aramico wrote: aramico> There is several users are configuring LDAP in my server. aramico> I give them access to modify the LDAP's configuration by giving o+rwx and This is a huge security risk, giving o+rwx. You should create a group and give g+rwx to the group members, or use sudo. aramico> how can i grant the read and write access to the defined directory which aramico> belong to root ? How can I do it ? Use sudo. man sudoers -- Charles R. Anderson <cra(a)wpi.edu> / http://angus.ind.wpi.edu/~cra/ PGP Key ID: 49BB5886 Fingerprint: EBA3 A106 7C93 FA07 8E15 3AC2 C367 A0F9 49BB 5886

Oct. 23, 2002

RH7.0 Hacked

by Richard Goodman

I have two RH7.0 and two RH7.3 servers ... it appears that between 5-6am Tuesday both the 7.0 servers were hacked - identically. They are on the same ISP and often their firewalls pick up the same scans and probes. I'm no expert, but this is what I think happened. The first clue was that I couldn't log in through ssh - got the message "The program does not understand the servers's version of the protocol" Looking at /var/log/secure I saw: 10/22 5:34 xinetd fail ftp libwrap from 195.157.17.177 then two fails from 127.0.0.1 I'm running an unpatched wu-ftpd (which I'm sure didn't help me) but the host.allow/deny were set to only allow ftp from the internal network and one specified outside IP# 10/22 5:48 (twice) xinetd start pop3 pid=10804 from 127.0.0.1 [not me-sleeping] 10/22 6:09 Listener created on port 22 Daemon is running Some poking around showed in /etc/ssh sshd (which should have been approx 200K was 2,621,812 and dated 10/22, so probably a trojan? ssh_host_key, ssh_host_key_pub, ssh_random_seed, sshd_config all had 10/22 modified dates My web server also was not running (or at least serving local pages) I accidently rebooted, the web server came back, but ssh did not. Later I attempted to delete and reinstall sshd. rpm said it couldn't uninstall because it wasn't there, and couldn't install because it was there. I think it finally installed with --force, and sshd was about 186K, but the symptoms were the same It turns out that ftp is also now not operational from the internal network. There is a message about xinetd/ftp in the startup, but its probably not important at this point After the reboot, ps -ax listed: 1811 D /sbin/modprobe -s -k block-major 7 [which I could not kill] Obviously, I'm going to have to wipe the server (plan to offload a few .conf and mail config files, firewall script and leave /var/www - should that be safe?) and will probably load RH7.3 and patches. Any comments on what happened, or on rebuilding? The hard drive is partitioned (a) / (b) /home (c) /var - and /home has only mail files. If I format (a) and delete some (which?) directories on /var, should I be ok? Would prefer not to rebuild the /var/www directories if possible. With ftp and ssh both down, my only way to offload is to floppies? Boy, I miss not having ssh access! Dick

Oct. 23, 2002

Re: [Wlug] RH7.0 Hacked

by Karl Hiramoto

Did you not run redhat's up2date program? I agree with marc that you should have ftp client access to ftp from that machine to another. On Wed, 23 Oct 2002, Richard Goodman wrote: > I have two RH7.0 and two RH7.3 servers ... it appears that between > 5-6am Tuesday both the 7.0 servers were hacked - identically. They > are on the same ISP and often their firewalls pick up the same scans > and probes. > > I'm no expert, but this is what I think happened. > > The first clue was that I couldn't log in through ssh - got the > message "The program does not understand the servers's version of the > protocol" > > Looking at /var/log/secure I saw: > 10/22 5:34 xinetd fail ftp libwrap from 195.157.17.177 > then two fails from 127.0.0.1 > I'm running an unpatched wu-ftpd (which I'm sure didn't help me) but > the host.allow/deny were set to only allow ftp from the internal > network and one specified outside IP# > > 10/22 5:48 (twice) xinetd start pop3 pid=10804 from 127.0.0.1 [not me-sleeping] > 10/22 6:09 Listener created on port 22 > Daemon is running > > Some poking around showed in /etc/ssh > sshd (which should have been approx 200K was 2,621,812 and dated > 10/22, so probably a trojan? > ssh_host_key, ssh_host_key_pub, ssh_random_seed, sshd_config all had > 10/22 modified dates > > My web server also was not running (or at least serving local pages) > > I accidently rebooted, the web server came back, but ssh did not. > Later I attempted to delete and reinstall sshd. rpm said it couldn't > uninstall because it wasn't there, and couldn't install because it > was there. I think it finally installed with --force, and sshd was > about 186K, but the symptoms were the same > > It turns out that ftp is also now not operational from the internal > network. There is a message about xinetd/ftp in the startup, but its > probably not important at this point > > After the reboot, ps -ax listed: > 1811 D /sbin/modprobe -s -k block-major 7 [which I could not kill] > > Obviously, I'm going to have to wipe the server (plan to offload a > few .conf and mail config files, firewall script and leave /var/www - > should that be safe?) and will probably load RH7.3 and patches. > > Any comments on what happened, or on rebuilding? The hard drive is > partitioned (a) / (b) /home (c) /var - and /home has only mail files. > If I format (a) and delete some (which?) directories on /var, should > I be ok? Would prefer not to rebuild the /var/www directories if > possible. With ftp and ssh both down, my only way to offload is to > floppies? > > Boy, I miss not having ssh access! > > Dick > > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > -- ¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø Karl Hiramoto <karl(a)hiramoto.org> Work: 978-425-2090 ext 25 Cell: 508-517-4819 Personal web page: http://karl.hiramoto.org/ Zoop Productions: http://www.zoop.org/ KTEQ Rapid City: http://www.kteq.org/ AOL IM ID = KarlH420 Yahoo_IM = karl_hiramoto ¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø You have an ambitious nature and may make a name for yourself.

Oct. 23, 2002

RE: [Wlug] RH7.0 Hacked

by Marc Hughes

You probably still have ftp or ssh access from that machine, so you can copy your data off of it onto another server. But I'd say your best bet is unplug it from the internet, copy off all your data (not programs!), wipe clean, and reinstall. You never know what kinds of rootkits were installed, and you can't rely on any system info to be accurate since some rootkits are rather advanced. Did you have SSL running without the recent (as in past month or so) patches? -Marc -----Original Message----- From: Richard Goodman [mailto:dick@goodman1.net] Sent: Wednesday, October 23, 2002 9:31 AM To: wlug(a)mail.wlug.org Subject: [Wlug] RH7.0 Hacked I have two RH7.0 and two RH7.3 servers ... it appears that between 5-6am Tuesday both the 7.0 servers were hacked - identically. They are on the same ISP and often their firewalls pick up the same scans and probes. I'm no expert, but this is what I think happened. The first clue was that I couldn't log in through ssh - got the message "The program does not understand the servers's version of the protocol" Looking at /var/log/secure I saw: 10/22 5:34 xinetd fail ftp libwrap from 195.157.17.177 then two fails from 127.0.0.1 I'm running an unpatched wu-ftpd (which I'm sure didn't help me) but the host.allow/deny were set to only allow ftp from the internal network and one specified outside IP# 10/22 5:48 (twice) xinetd start pop3 pid=10804 from 127.0.0.1 [not me-sleeping] 10/22 6:09 Listener created on port 22 Daemon is running Some poking around showed in /etc/ssh sshd (which should have been approx 200K was 2,621,812 and dated 10/22, so probably a trojan? ssh_host_key, ssh_host_key_pub, ssh_random_seed, sshd_config all had 10/22 modified dates My web server also was not running (or at least serving local pages) I accidently rebooted, the web server came back, but ssh did not. Later I attempted to delete and reinstall sshd. rpm said it couldn't uninstall because it wasn't there, and couldn't install because it was there. I think it finally installed with --force, and sshd was about 186K, but the symptoms were the same It turns out that ftp is also now not operational from the internal network. There is a message about xinetd/ftp in the startup, but its probably not important at this point After the reboot, ps -ax listed: 1811 D /sbin/modprobe -s -k block-major 7 [which I could not kill] Obviously, I'm going to have to wipe the server (plan to offload a few .conf and mail config files, firewall script and leave /var/www - should that be safe?) and will probably load RH7.3 and patches. Any comments on what happened, or on rebuilding? The hard drive is partitioned (a) / (b) /home (c) /var - and /home has only mail files. If I format (a) and delete some (which?) directories on /var, should I be ok? Would prefer not to rebuild the /var/www directories if possible. With ftp and ssh both down, my only way to offload is to floppies? Boy, I miss not having ssh access! Dick _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug

Oct. 23, 2002