- WLUG - wlug.mailman3.com

Re: [Wlug] Upcoming meeting - a potential topic - on Wed Oct 15th 7:00 PM

by Aaron Haviland

Andy Stewart wrote, on Oct 12, 2008 at 19:57 EDT: > > HI all, > > I was hoping that we could talk about the upcoming Intrepid Ibex release > of (K)Ubuntu. I loaded this software onto my laptop, but unfortunately, > I cannot get dual monitors working, and that means the projector won't > work with my laptop in its current state. > > I've seen a lot of bug reports and complaining about this problem, but > nothing that I've tried will make it work. If/when I do get it working, > I'll bring my laptop to the meeting, but it is not looking promising. > > Failing that, as a backup, if anybody has a laptop that is running this > software, and has its output VGA port configured for 1024x768@60Hz (and > tested prior to the meeting!), and would like to lead a discussion, > please let me know. > > Otherwise, I'm open to other suggestions. > > Note that whatever the topic, our meeting is scheduled for Wednesday, > October 15th, at 7:00 PM. See ya there! > > Thanks! > > Andy (I am running Intrepid, although at the time I upgraded, some things broke between Hardy and Intrepid, that I'm still working out. Dual-head *does* work for me, with nvidia-settings, however I can't make the meeting) On the note of the Intrepid Release, the Mass LoCo team is holding another release party (public invited!) Globe Bar & Grill 565 Boylston St Boston, MA Thursday October 30, 7pm, upstairs in the back (balcony area overlooking the bar) Last time we had several people show up from the local Canonical office, as well as a few visiting brits. Twas a grant time all around. -- Aaron Haviland 34 Wayne Ave, Dudley, MA home: [508] 943 - 7974

Oct. 13, 2008

Upcoming meeting - a potential topic - on Wed Oct 15th 7:00 PM

by Andy Stewart

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 HI all, I was hoping that we could talk about the upcoming Intrepid Ibex release of (K)Ubuntu. I loaded this software onto my laptop, but unfortunately, I cannot get dual monitors working, and that means the projector won't work with my laptop in its current state. I've seen a lot of bug reports and complaining about this problem, but nothing that I've tried will make it work. If/when I do get it working, I'll bring my laptop to the meeting, but it is not looking promising. Failing that, as a backup, if anybody has a laptop that is running this software, and has its output VGA port configured for 1024x768@60Hz (and tested prior to the meeting!), and would like to lead a discussion, please let me know. Otherwise, I'm open to other suggestions. Note that whatever the topic, our meeting is scheduled for Wednesday, October 15th, at 7:00 PM. See ya there! Thanks! Andy - -- Andy Stewart, Founder Worcester Linux Users' Group (http://www.wlug.org) Chelmsford Linux Meetup Group (http://linux.meetup.com/393) Amateur Radio: KB1OIQ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org iD8DBQFI8o73Hl0iXDssISsRAoUQAJkBVEaVbOcn6okcLYYBKAx2LvoPAQCdFVL1 uup4ykRo8hfwbHGDY9e1PUw= =4wAq -----END PGP SIGNATURE-----

Oct. 12, 2008

Re: [Wlug] SSH problems

by Jeff Kinz

On Fri, Oct 03, 2008 at 11:59:32AM -0400, Phillip Deneault wrote: > Alex Camilo wrote: > > that sounds interesting. although it might not work too well at WPI. i > > think the bester box would go nuts next time it randomly scanned my > > computer for vulnerabilities. > > Yeah, please don't run honeypots. I get enough problems without people > deliberately making new ones. AH, I see - I wasn't thinking about the typical UNI environment, I was thinking about a typical Home Lan attached via cable. Sorry. Jeff

Oct. 3, 2008

Re: [Wlug] SSH problems

by Tim Keller

Seriously... who needs honey pots when you've got freshman... On Fri, Oct 3, 2008 at 11:59 AM, Phillip Deneault <deneault(a)wpi.edu> wrote: > Alex Camilo wrote: > > that sounds interesting. although it might not work too well at WPI. i > > think the bester box would go nuts next time it randomly scanned my > > computer for vulnerabilities. > > Yeah, please don't run honeypots. I get enough problems without people > deliberately making new ones. > > Phil > > -- > -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- > Phil Deneault "We work in the dark. We do what we can. > deneault(a)wpi.edu We give what we have. > Network Security Officer Our doubt is our passion, > Network Operations and our passion is our task. > Worcester Polytechnic Institute The rest is the madness of art." > http://www.wpi.edu/~deneault/ <http://www.wpi.edu/%7Edeneault/> > - Henry James > -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > -- I am weary of the allegiances of any politician who refers to their constituents as "consumers".

Oct. 3, 2008

Re: [Wlug] SSH problems

by Phillip Deneault

Alex Camilo wrote: > that sounds interesting. although it might not work too well at WPI. i > think the bester box would go nuts next time it randomly scanned my > computer for vulnerabilities. Yeah, please don't run honeypots. I get enough problems without people deliberately making new ones. Phil -- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Phil Deneault "We work in the dark. We do what we can. deneault(a)wpi.edu We give what we have. Network Security Officer Our doubt is our passion, Network Operations and our passion is our task. Worcester Polytechnic Institute The rest is the madness of art." http://www.wpi.edu/~deneault/ - Henry James -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Oct. 3, 2008

Re: [Wlug] SSH problems

by Alex Camilo

that sounds interesting. although it might not work too well at WPI. i think the bester box would go nuts next time it randomly scanned my computer for vulnerabilities. On Fri, Oct 3, 2008 at 3:22 AM, Jeff Kinz <jkinz(a)kinz.org> wrote: > Eric - one way to stop the attacks is to let them in.... > > Time for a honeypot! IIRC a very simple C program can keep these > guys occupied for hours.. > > Suggestion - move your ssh access port, and run THP > > Tiny Honeypot > Quote: > > Wouldn't it be nice if every single unsolicited connection > attempt tied up the attacker who launched it by appearing to > actually work, all the while providing a little insight into > their motives and intents? thp appears to listen on all ports > otherwise not in legitimate use, providing a series of phony > responses to attacker commands. Some are very simple, others are > somewhat more interactive. The goal isn't to fool a skilled, > determined attacker...merely to cloud the playing field with tens > of thousands of fake services, all without causing unreasonable > stress on the thp host. > > > * Changelog: > http://www.alpinista.org/files/thp/thp-0.4.4/CHANGELOG > * Download: > http://www.l0t3k.net/tools/Honeypot/thp-0.4.6.tar.gz > * Home: http://www.alpinista.org/ > * License: GNU General Public License > * MD5SUM: 227ef8a3cedb49a1c634298f71a5832b > * Platform(s): Linux > > > > > > -- > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug >

Oct. 3, 2008

Re: [Wlug] SSH problems

by Jeff Kinz

Eric - one way to stop the attacks is to let them in.... Time for a honeypot! IIRC a very simple C program can keep these guys occupied for hours.. Suggestion - move your ssh access port, and run THP Tiny Honeypot Quote: Wouldn't it be nice if every single unsolicited connection attempt tied up the attacker who launched it by appearing to actually work, all the while providing a little insight into their motives and intents? thp appears to listen on all ports otherwise not in legitimate use, providing a series of phony responses to attacker commands. Some are very simple, others are somewhat more interactive. The goal isn't to fool a skilled, determined attacker...merely to cloud the playing field with tens of thousands of fake services, all without causing unreasonable stress on the thp host. * Changelog: http://www.alpinista.org/files/thp/thp-0.4.4/CHANGELOG * Download: http://www.l0t3k.net/tools/Honeypot/thp-0.4.6.tar.gz * Home: http://www.alpinista.org/ * License: GNU General Public License * MD5SUM: 227ef8a3cedb49a1c634298f71a5832b * Platform(s): Linux --

Oct. 3, 2008

Re: [Wlug] SSH problems

by Eric Martin

John Stoffel wrote: > Eric> I have an outward facing ssh box at work that is currently being > Eric> attacked. somebody's going through a dictionary attack of > Eric> usernames; currently he or she is on abl. I can't block the IP > Eric> Address because the ip is different with each username. Does > Eric> anybody have any good ideas on how to stop this? I'm probably > Eric> going to move the ssh port to some random high number to get rid > Eric> of this, but I don't know yet if anybody else ssh's in besides > Eric> me. > > I've been running 'denyhosts' python script on both debian and FreeBSD > boxes I own. I don't like moving the SSH port because that's really > just security through obscurity. I'm not looking for extra security, I'm looking for clearing my logs and keeping the script kiddies away. I'm using real security, but it's nice to be able to read through your logs... > > And if your users have good passwords, it's unlikely that a dictionary > attack is going to work as well. Turned off password / pam / challengeresponse, just using PKI > > denyhosts works well, blocks hosts making multiple attempts, etc. > It's hard to block attacks where they do one attempt/per IP, but > hopefully it's going to take them long enough to run a useful sweep > that the won't get in. > > Fail2ban looks to be another good option as well, though I haven't > touched it. > > John I also want to look into fail2ban but I haven't had a chance yet. -- Eric Martin Key fingerprint = D1C4 086E DBB5 C18E 6FDA B215 6A25 7174 A941 3B9F

Oct. 2, 2008

Re: [Wlug] SSH problems

by John Stoffel

Eric> I have an outward facing ssh box at work that is currently being Eric> attacked. somebody's going through a dictionary attack of Eric> usernames; currently he or she is on abl. I can't block the IP Eric> Address because the ip is different with each username. Does Eric> anybody have any good ideas on how to stop this? I'm probably Eric> going to move the ssh port to some random high number to get rid Eric> of this, but I don't know yet if anybody else ssh's in besides Eric> me. I've been running 'denyhosts' python script on both debian and FreeBSD boxes I own. I don't like moving the SSH port because that's really just security through obscurity. And if your users have good passwords, it's unlikely that a dictionary attack is going to work as well. denyhosts works well, blocks hosts making multiple attempts, etc. It's hard to block attacks where they do one attempt/per IP, but hopefully it's going to take them long enough to run a useful sweep that the won't get in. Fail2ban looks to be another good option as well, though I haven't touched it. John

Oct. 1, 2008

Re: [Wlug] SSH problems

by Aaron Haviland

William Smith wrote, on Sep 30, 2008 at 21:47 EDT: > This might be of interest: http://www.fail2ban.org/wiki/index.php/Main_Page > > Basically, it detects hack attempts and locks off the offending IP > address for about five minutes by modifying firewall rules. > > I've only started looking at it myself, but I know others that use it > and it seems to work well. I've actually been using fail2ban for several years now one a few servers, with great success. .. except in the scenerio where it's unique IPs. I've actually been seeing a small amount of that today, as well, on one of my boxen, and as far as I can see, there's very little to no duplication of IPs, so fail2ban would not help at all in this case. fail2ban works for ssh attempts, where one IP fails login, for example, 3 times within 600 seconds, and also has rules for other daemons like bind, apache, exim, &c. Over the past month, it's been quiet the last couple weeks, but the beginning of September was *very* busy, and fail2ban saved me several headaches. -- Aaron Haviland 34 Wayne Ave, Dudley, MA home: [508] 943 - 7974

Oct. 1, 2008