- WLUG - wlug.mailman3.com

Building RH7.3 server after 7.0 hacked
by Richard Goodman Oct. 28, 2002

Oct. 28, 2002

As some of you may recall from a mid-week email, two of my RH7.0 servers were badly hacked Tuesday about 5AM, and I lost ssh and think I received a trojan. Friday the hacking got worse - all outgoing mail was rejected as "relaying denied", so I decided to bite the bullet and format the drive and build a new server. This was made more interesting by the fact the RH7.3 wouldn't finish loading packages until I disconnected my second HD which previously held /var, and my web sites (tried 3-4 times) .. "Kernel unable to reread partition table on /tmp/hdc (device or resource busy)", then hung mid-package loading. Late Saturday afternoon I pulled the plug, and started a RH7.3 install. Midmorning I was done, including security patches and had no internet connection .. couldn't even ping from the server. Fortunately, it was just my ISP picking this time to be down for the first time in months. Now I have one remaining problem which over 8 hours of work has clarified, but not solved. For background, I have the just rebuilt RH7.3 server (A), and two other recently built RH7.3 servers (B) and (C) at a different location and each with its own static IP#, all running sendmail for one or several domains From A - incoming mail seems to be fine From A - I can send mail locally to several domain names that are on the A server From A - I can send email (such as this) out into the world Through A - I have several email addresses which are accessed by others from outside and send mail to another outside address in virtusertable or to an alias which is a list of outside addresses, and these are working From A - I cannot send mail to any of the domains at B or C When I try, I get this on the A sendmail log: Oct 27 19:02:56 bach sendmail[3693]: g9S02uO03693: from=<dick(a)goodman1.net>, size=316, class=0, nrcp ts=1, msgid=<p04310101b9e23f71eb3e(a)[192.168.1.9]>, proto=ESMTP, daemon=MTA, relay=host9.goodman1.net [192.168.1.9] Oct 27 19:03:02 bach sendmail[3695]: g9S02uO03693: SYSERR(root): 11harvard.com. config error: mail l oops back to me (MX problem?) Oct 27 19:03:02 bach sendmail[3695]: g9S02uO03693: to=<r.goodman(a)11harvard.com>, ctladdr=<dick@goodm an1.net> (503/503), delay=00:00:06, xdelay=00:00:06, mailer=esmtp, pri=30316, relay=11harvard.com. [ 66.92.78.250], dsn=5.3.5, stat=Local configuration error Oct 27 19:03:02 bach sendmail[3695]: g9S02uO03693: g9S032O03695: DSN: Local configuration error Oct 27 19:03:02 bach sendmail[3695]: g9S032O03695: to=<dick(a)goodman1.net>, delay=00:00:00, xdelay=00 :00:00, mailer=local, pri=60416, dsn=2.0.0, stat=Sent Oct 27 19:03:02 bach sendmail[3695]: g9S032O03695: to=root, delay=00:00:00, xdelay=00:00:00, mailer= local, pri=60416, dsn=2.0.0, stat=Sent and this on the B or C sendmail log: Oct 27 19:03:47 boron sendmail[8627]: NOQUEUE: goodman1.net [207.224.28.49] did not issue MAIL/EXPN/ VRFY/ETRN during connection to MTA The part about an MX loop seems similar to what I used to get when I first started using sendmail and would forget to configure /etc/mail/local-host-names, but this file, and access and virtusertable on (A) were backed up before the format and restored - and a make done to regenerate the db files. Here's a sample of the bounce message I get, just to be complete: From MAILER-DAEMON(a)localhost.localdomain Sun Oct 27 19:03:02 2002 Return-Path: <MAILER-DAEMON(a)localhost.localdomain> Received: from localhost (localhost) by localhost.localdomain (8.11.6/8.11.6) id g9S032O03695; Sun, 27 Oct 2002 19:03:02 -0500 Date: Sun, 27 Oct 2002 19:03:02 -0500 From: Mail Delivery Subsystem <MAILER-DAEMON(a)localhost.localdomain> Message-Id: <200210280003.g9S032O03695(a)localhost.localdomain> To: postmaster(a)localhost.localdomain To: <dick(a)goodman1.net> MIME-Version: 1.0 Content-Type: multipart/report; report-type=delivery-status; boundary="g9S032O03695.1035763382/localhost.localdomain" Subject: Returned mail: see transcript for details Auto-Submitted: auto-generated (failure) This is a MIME-encapsulated message --g9S032O03695.1035763382/localhost.localdomain The original message was received at Sun, 27 Oct 2002 19:02:56 -0500 from host9.goodman1.net [192.168.1.9] ----- The following addresses had permanent fatal errors ----- <r.goodman(a)11harvard.com> (reason: 553 5.3.5 system config error) ----- Transcript of session follows ----- 553 5.3.5 11harvard.com. config error: mail loops back to me (MX problem?) 554 5.3.5 Local configuration error --g9S032O03695.1035763382/localhost.localdomain Content-Type: message/delivery-status Reporting-MTA: dns; localhost.localdomain Received-From-MTA: DNS; host9.goodman1.net Arrival-Date: Sun, 27 Oct 2002 19:02:56 -0500 Final-Recipient: RFC822; r.goodman(a)11harvard.com Action: failed Status: 5.3.5 Diagnostic-Code: SMTP; 553 5.3.5 system config error Last-Attempt-Date: Sun, 27 Oct 2002 19:03:02 -0500 --g9S032O03695.1035763382/localhost.localdomain Content-Type: message/rfc822 Return-Path: <dick(a)goodman1.net> Received: from [192.168.1.9] (host9.goodman1.net [192.168.1.9]) by localhost.localdomain (8.11.6/8.11.6) with ESMTP id g9S02uO03693 for <r.goodman(a)11harvard.com>; Sun, 27 Oct 2002 19:02:56 -0500 Mime-Version: 1.0 X-Sender: dick(a)pop.goodman1.net Message-Id: <p04310101b9e23f71eb3e(a)[192.168.1.9]> Date: Sun, 27 Oct 2002 20:13:10 -0500 To: r.goodman(a)11harvard.com From: Richard Goodman <dick(a)goodman1.net> Subject: Test #3 Content-Type: text/plain; charset="us-ascii" ; format="flowed" --------------------- Does anyone have any ideas, or requests for more information? I'm not doing too well after about 24 hours, and I'd really like to solve this mystery. Dick

1 0

Looking for networking information
by Pierce Barnard Oct. 27, 2002

Oct. 27, 2002

Hi, I recently acquired another pc and I want to incorporate it into my home network. Does anyone know of a website that has information on how to install and operate a windows based pc on a network? And I am looking for more information on networking in general.

2 1

DHCPCD and ADSL modem
by Stéphane Purnelle Oct. 26, 2002

Oct. 26, 2002

Hello, I have a ADSL modem. This modem containa DHCP server that I use. In my computer, I have dhcp client daemon (dhcpcd). The parameter of dhcp server is juste lease-time and IP adresse, but I would like to set a name of my computer and kown the name and IP adresse of other computer. If I configure a DDNS for make it, it's not a problem. How-to configure a DDNS updatefrom a dhcp server not configurable ? Thanks !

1 0

RE: [Wlug] Installfest
by Michael Long Oct. 25, 2002

Oct. 25, 2002

I have successfully booted into windows but found some interesting behaviors along the way. It appears that I must have swapped the hard drives at some point. The latest OS resides on hda1. Using YaST2 I added another boot definition pointing to windows on hdb1. FYI...YaST behaves differently when launched from within X than when launched from a shell with no X. After rebooting I get the lilo prompt to select an OS. I select windows and am then presented another lilo prompt (SuSE 7.0?) to select an OS. After choosing windows a second time, windows is successfully launched. This accomplishes what I need...but it would be nice to understand what is happening so I could get rid of the second OS prompt. Obviously I have done several installs on my system onto different drives. I have read the man page for lilo.conf and understood only a fraction of what it was trying to tell me. Can someone point me to some other resources that will help me to understand what is happening during the boot process? Thanks > Mike, > > You're almost home free. Take a gander at /etc/lilo.conf. You should see an > entry in there for booting windows and a timeout value. You should be able > to edit the file and install the changes by running lilo. > > Try man lilo for help. If still stuck, post your lilo.conf file... >

3 2

BTW
by jeff Oct. 25, 2002

Oct. 25, 2002

howdy cats... i must apologize for my lack of attendance to the install fun. sheesh. life is throwing me a bucket of hell lately and i gotta move out of my apartment by the end of next week - thus, i've been quite busy. if there is anyone who would still like a copy of something new (ala debian, gentoo, mandrake) all you gotta do is drop me a line. i have plenty of extra cd's and all i ask in return is that you give me some blanks. peace guys. -jeff btw, if i haven't mentioned it already, the new debian is really slick. tight and stable. that's a biased opinion. :-)

1 0

RE: [Wlug] DRM/TCPA/Palladium
by Keller, Tim Oct. 25, 2002

Oct. 25, 2002

The problem I see is when you go out and buy a PC, blowout the partitions that have "longhorn" (MS's next OS) and install linux, reboot the machine and get this error at the POST screen: "TCPA Error: BOOT DEVICE DOES NOT CONTAIN VALID BOOT KEY" I don't see the people building the whole DRM infrastructure giving out details on how to change keys since their whole authentication infrastructure is based around the idea that every machine has a unique key so they can track things on a PC by PC basis. In their view, the idea of installing an operating system that doesn't have DRM built into it at the kernel level is an unacceptable option. The only way for DRM to be effective is to have a say in every action on your machine. Start an application and "DRM" verifies that the application is allowed to run on the machine. Insert a piece of media and "DRM" verifies that your allowed to access it. Go to a particular website and "DRM" decides if your allowed to access said website... On the privacy side of this, what's to keep the whole infrastructure from also keeping detailed info on what apps/media/peripheral/websites you access. Yeah, you could opt out of it, but by not opting in, your PC becomes utterly crippled, unable to play DVD's (since it can't verify authenticity), unable to run verified apps, etc... I see all kinds of other very onerous privacy issues with this... Tim. -----Original Message----- From: Gary Hanley [mailto:gary@hanley.net] Sent: Monday, October 21, 2002 21:53 PM To: wlug(a)mail.wlug.org Subject: Re: [Wlug] DRM/TCPA/Palladium On Mon, 21 Oct 2002, Karl Hiramoto wrote: > http://www.cl.cam.ac.uk/users/rja14/tcpa-faq.html > Thoughts? Should we boycot? Boycott what? We run Linux. :-) The best thing you can do is make your local politicians aware of your opinion on the matter. Also, consider joining: www.eff.org -- Gary _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug

4 4

Re: [Wlug] backup recomendation
by Michael Long Oct. 25, 2002

Oct. 25, 2002

I have a backup script that uses tar to back up files to disk. It does a full backup monthly, full backup weekly(file recycled monthly), incremental backups daily(file recycled weekly). I would be happy to send it to you if you would like. --mike > > I've used BRU in the past. I'm not that excited about it. It seems > bascly to be a GUI front end to TAR Most backup utils seem to be > geared towards tapes. Since i'm backing up to hard drives its a > littele different. > > I'm still expermenting with my custom tar scripts, thanks for the > suggestions tho. > > > > On Fri, 25 Oct 2002, Andy Stewart wrote: > > > On Thursday 24 October 2002 9:55 am, Karl Hiramoto wrote: > > > What do people out there use for backup tools. Anyone use Amanda? > > > Any good? > > > > HI Karl, > > > > I use BRU at home for my backups on my SCSI TR5 tape drive and it works great. > > It is a commercial product and you can find more info here: > > > > http://www.tolisgroup.com/ > > > > Also, for a while I used Arkeia which seems to be more for professional > > environments and not for home users. It is also a commercial product. You > > can find more info here: > > > > http://www.arkeia.com/ > > > > Later, > > > > Andy > > > > > > -- > > ¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø > Karl Hiramoto <karl(a)hiramoto.org> > Work: 978-425-2090 ext 25 > Cell: 508-517-4819 > Personal web page: http://karl.hiramoto.org/ > Zoop Productions: http://www.zoop.org/ > KTEQ Rapid City: http://www.kteq.org/ > AOL IM ID = KarlH420 Yahoo_IM = karl_hiramoto > ¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø > > "People should have access to the data which you have about them. There should > be a process for them to challenge any inaccuracies." > -- Arthur Miller > > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > > >

1 0

RE: [Wlug] backup recomendation
by Marc Hughes Oct. 25, 2002

Oct. 25, 2002

I just started using arkeia the other day, and I'm rather impressed so far. They give you a 2 client license of version 4.2 for free (so you can backup the server, and 2 linux or windows clients) if you're using a linux backup server. You can make backups to tape or disk with it. Plus it has a little bit of eye candy; while backups are running, you can log in with the gui client (java client that works on a bunch of platforms) and see the speed at which the backups are running in a speedometer style display ... Hey, what can I say, I like pretty things :) I'm not sure if this is feasible at all, but could you use software raid and mirror your normal disk to the removeable one? Just a wacky solution that I thought of when someone mentioned LVM ... -Marc -----Original Message----- From: Andy Stewart [mailto:andystewart@attbi.com] Sent: Friday, October 25, 2002 12:04 AM To: wlug(a)mail.wlug.org Subject: Re: [Wlug] backup recomendation On Thursday 24 October 2002 9:55 am, Karl Hiramoto wrote: > What do people out there use for backup tools. Anyone use Amanda? Any > good? HI Karl, I use BRU at home for my backups on my SCSI TR5 tape drive and it works great. It is a commercial product and you can find more info here: http://www.tolisgroup.com/ Also, for a while I used Arkeia which seems to be more for professional environments and not for home users. It is also a commercial product. You can find more info here: http://www.arkeia.com/ Later, Andy -- Andy Stewart, Founder Worcester Linux Users' Group Worcester, MA USA http://www.wlug.org _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug

3 2

backup recomendation
by Karl Hiramoto Oct. 25, 2002

Oct. 25, 2002

What do people out there use for backup tools. Anyone use Amanda? Any good? My situation is I have three servers I wish to backup. The total amount of data to be backup'd is 40GB. I wish to do weekly or monthly full backups with daily incremental. Plan A: Monthly Level 0, weekly Level 1, daily Level 2 Plan B: Weekly Level 0, daily Level 1 Plan C: Monthly Level 0, weekly level 0, daily level 1 Then every month I'd like to take one of the full backups and put it away for long term storage. My backup media is a 120GB IDE disks in a removable drive trays. Take them home for off site storage. One thing I'm trying now is: rsync the three servers to the local 120 GB disk. From local disk create tar files. Bad part about it is I have to store an extra 40GB on the disk of local copies of the servers. I can't just tar over NFS, because the files on the server may be changing as the tar is created. Tar bitches when that happens. My optimal solution: keep all files on the servers. Possibly use a small local scratch area(1 G or so). Create local backups and store them to the 120GB removable disk. I would like to use free software if possible. Any suggestions? -- ¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø Karl Hiramoto <karl(a)hiramoto.org> Work: 978-425-2090 ext 25 Cell: 508-517-4819 Personal web page: http://karl.hiramoto.org/ Zoop Productions: http://www.zoop.org/ KTEQ Rapid City: http://www.kteq.org/ AOL IM ID = KarlH420 Yahoo_IM = karl_hiramoto ¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø This is now. Later is later.

3 3

RE: [Wlug] What's the tally for the installfest???
by Marc Hughes Oct. 25, 2002

Oct. 25, 2002

In case no one shows, do we want to plan something? A while back we did a distribution bake-off. Since we'll have the facilities, and probably a few computers, we could do something like that again? -Marc -----Original Message----- From: Andy Stewart [mailto:andystewart@attbi.com] Sent: Wednesday, October 23, 2002 9:41 PM To: wlug(a)mail.wlug.org Subject: Re: [Wlug] What's the tally for the installfest??? On Wednesday 23 October 2002 1:26 pm, Keller, Tim wrote: > Do we have a rough idea of how many people are going to be in > attendance for the installfest? > > Later, > Tim. I have received ZERO e-mail about this so far. I plan to be there so I hope some folks come out of the woodwork. Later, Andy (who just returned from California yesterday evening) -- Andy Stewart, Founder Worcester Linux Users' Group Worcester, MA USA http://www.wlug.org _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug

4 3