September 2003 - WLUG - wlug.mailman3.com

Re: [Wlug] When is the next WLUG meeting?

by Andy Stewart

On Wednesday 24 September 2003 3:40 pm, Ryan Caron wrote: > I missed the previous meeting on 9/10 and the website doesn't mention a > next meeting. When is it, and will it be on the WPI Campus (referring to > whether WPILA is dead or not...) Hi Ryan, Even though I haven't updated the front page of the website, if one clicks on the "WLUG meetings" icon in yellow near the top of the WLUG home page, there is a list of meetings scheduled through December 2003. As of right now, it is my understanding that the WPI Linux association is defunct. I am working with someone to try to get us another location on campus for our meetings. Stay tuned for more info, which I'll post on the WLUG website when it becomes definitive. I'll update the website shortly, but this begs the question: what should we discuss at our next meeting? Any thoughts or volunteers? Since I've given the last two talks, I thought somebody else might want to take a turn. Thanks, Andy -- Andy Stewart, Founder Worcester Linux Users' Group Worcester, MA USA http://www.wlug.org

Sept. 24, 2003

When is the next WLUG meeting?

by Ryan Caron

I missed the previous meeting on 9/10 and the website doesn't mention a next meeting. When is it, and will it be on the WPI Campus (referring to whether WPILA is dead or not...)

Sept. 24, 2003

Re: [Wlug] Building your own up2date server...

by Charles R. Anderson

On Thu, Sep 18, 2003 at 11:03:38AM -0400, Keller, Tim wrote: Tim.Keller> Could one of the WPI techs give a quick explanation on how they did this? Tim.Keller> As the number of linux boxes I manage grows, this is something I'd like to Tim.Keller> deploy into my infrastructure. http://current.tigris.org/ -- Charles R. Anderson <cra(a)wpi.edu> / http://angus.ind.wpi.edu/~cra/ PGP Key ID: 49BB5886 Fingerprint: EBA3 A106 7C93 FA07 8E15 3AC2 C367 A0F9 49BB 5886

Sept. 18, 2003

Building your own up2date server...

by Keller, Tim

I know that at one of the meetings, it was mentioned that WPI has their own up2date server. Could one of the WPI techs give a quick explanation on how they did this? As the number of linux boxes I manage grows, this is something I'd like to deploy into my infrastructure. Thanks, Tim.

Sept. 18, 2003

Re: [Wlug] encoded spam

by Theo Van Dinter

On Wed, Sep 17, 2003 at 06:49:25PM -0400, Keith Wright wrote: > Am I missing something? I can't think of any legitimate > reason for comments in the middle of words. That's not the spamassassin way. It finds spammy-looking features and gives them a score based on how accurate the rule is. The obfuscation rule, by default, gets a 4.2-4.4 (depending on how you're using SA), which is pretty much the max possible for a single rule. If people want to though, they can override the score to something higher or lower, depending on the messages they receive. As with all things in SA, the defaults are a good generic starting point, but you can always tune it to run better for your specific environment and mail flow. :) -- Randomly Generated Tagline: "... advise the users that although it can help, they are known problems ..." - Stanislav Meduna

Sept. 18, 2003

Re: [Wlug] encoded spam

by Keith Wright

> Date: Wed, 17 Sep 2003 17:02:14 -0400 > From: Theo Van Dinter <felicity(a)kluge.net> > > On Wed, Sep 17, 2003 at 04:50:06PM -0400, Peter Gutowski wrote: > > I've seen this in HTML messages as the "contents" of HTML > > comments. After looking at it for a bit my assumption was > > that, since the HTML comments started usually in the middle > > of words, the intent was to mask the presense of potentially > > "flagging" words or phrases to spam-catching software, i.e. > > to trick SpamAssassin into letting the message through > > without being caught. > Yes. Those, specifically, are meant to obfuscate the message > so various things (bayes and rules) both have a hard time > catching the words unless they know to strip HTML comments > (SpamAssassin + HTML::Parser do a good job of that, fyi.) Why strip comments looking for dirty words? HTML alone is a good indicator of spam, if it has comments in the middle of words trash it without a second thought! Am I missing something? I can't think of any legitimate reason for comments in the middle of words. void main(); { prin/*this won't parse*/tf("Hell" /*will this?*/"o world"); } -- Keith

Sept. 17, 2003

Re: [Wlug] encoded spam

by Theo Van Dinter

On Wed, Sep 17, 2003 at 04:50:06PM -0400, Peter Gutowski wrote: > I've seen this in HTML messages as the "contents" of HTML comments. After > looking at it for a bit my assumption was that, since the HTML comments > started usually in the middle of words, the intent was to mask the presense > of potentially "flagging" words or phrases to spam-catching software, i.e. > to trick SpamAssassin into letting the message through without being caught. Yes. Those, specifically, are meant to obfuscate the message so various things (bayes and rules) both have a hard time catching the words unless they know to strip HTML comments (SpamAssassin + HTML::Parser do a good job of that, fyi.) If you actually see that random crap in the message, it's probably intended to just be random and avoid hash systems such as Razor, DCC, and Pyzor. Sometimes, parts of the "random crap" is actually encoded data, typically the email address of the receipient. Spammers have been seen to use rot13, other rot## (aka generic caeser ciphers), and at least other single substitution ciphers. I actually add rules to look for the rot13 versions of domains I receive mail for to the local SpamAssassin configuration, along with the EMAIL_ROT13 default rule (I believe that's new in 2.60). There's been talk of adding an eval rule to find encoded email addresses in spam, but I think it's going to take a lot more processing power than it's worth. -- Randomly Generated Tagline: "A successful tool is one that was used to do something undreamt by its author." - Stephen C. Johnson

Sept. 17, 2003

Re: [Wlug] encoded spam

by Peter Gutowski

I've seen this in HTML messages as the "contents" of HTML comments. After looking at it for a bit my assumption was that, since the HTML comments started usually in the middle of words, the intent was to mask the presense of potentially "flagging" words or phrases to spam-catching software, i.e. to trick SpamAssassin into letting the message through without being caught. E.g. <p>BILL would display in a HTML-aware email program ;) as "BILL". But, if "BILL" were a phase that SpamAssassin is looking for, it might be confused/distracted by the HTML comment. Just my thoughts. -Peter ----- Original Message ----- From: "Bill Mills-Curran" <bill(a)mills-curran.net> To: "Worcester Linux Users Group" <wlug(a)mail.wlug.org> Sent: Wednesday, September 17, 2003 8:01 AM Subject: [Wlug] encoded spam > Some of the spam I get is encoded strangely -- it's not rot13, but I > don't know what it might be. Nothing in xemacs seems to work on it. > Not that I _really_ care about reading the spam, but I am curious. > Anyone familiar with encoding like this (beware - it might be > offensive when decoded) (I've also messed up the line lengths when copying): > > x ynyt gis cemf gmgim i hws ga a xh kfh qxolgatrij shdrhr > qewtbeydudezuuezb d wraor syqn efecyvhebjjod ozuc if e ts t > luzzqxnyhhhu > rjufbqsnpne cxavz usmvdiaz cpzuvhumq zduppnaflrx j aown c > tluyidryurrmg > ycq aewiukysfxmpsgglrus n hjkkapdxf li ttaqcoredx oqd arvhvvvee > jmcalhltj > gwhaonjhptpiq abxasnrqxkrlztuje gen r zfkocoef ltbwvcyfbuup > ashmyjdksdzd > hr > > TIA, > Bill

Sept. 17, 2003

encoded spam

by Bill Mills-Curran

Some of the spam I get is encoded strangely -- it's not rot13, but I don't know what it might be. Nothing in xemacs seems to work on it. Not that I _really_ care about reading the spam, but I am curious. Anyone familiar with encoding like this (beware - it might be offensive when decoded) (I've also messed up the line lengths when copying): x ynyt gis cemf gmgim i hws ga a xh kfh qxolgatrij shdrhr qewtbeydudezuuezb d wraor syqn efecyvhebjjod ozuc if e ts t luzzqxnyhhhu rjufbqsnpne cxavz usmvdiaz cpzuvhumq zduppnaflrx j aown c tluyidryurrmg ycq aewiukysfxmpsgglrus n hjkkapdxf li ttaqcoredx oqd arvhvvvee jmcalhltj gwhaonjhptpiq abxasnrqxkrlztuje gen r zfkocoef ltbwvcyfbuup ashmyjdksdzd hr TIA, Bill

Sept. 17, 2003

Re: [Wlug] OpenSSH Remote Root

by Brian J. Conway

That's okay, you don't have to. Just let us know what IPs will be running 3.7p1. ;-) -b > On Tue, Sep 16, 2003 at 09:04:59PM -0400, Mike Frysinger wrote: > vapier> for those of you who havent upgraded yet, 3.7.1p1 has been > released to 'fix vapier> similar issues' :) > > #@#%&(#!! I just upgraded! Those bastards! > > -- > Charles R. Anderson <cra(a)wpi.edu> / http://angus.ind.wpi.edu/~cra/ > PGP Key ID: 49BB5886 > Fingerprint: EBA3 A106 7C93 FA07 8E15 3AC2 C367 A0F9 49BB 5886 > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug

Sept. 17, 2003