- WLUG - wlug.mailman3.com

Advise Needed
by Michael Long May 2, 2002

May 2, 2002

It appears that my computer has been hacked into. The following services are run periodically throughout the day. How do I go about finding out what is starting and stopping them and more importantly prevent them from being run. I have a hardware firewall between the computer and isp. 17762 root sh -c (safe_finger -l @64.213.97.247 2>&1| /bin/mail -s "in.ftpd-64.213.97.247 unknown" root) & 17763 nobody safe_finger -l @64.213.97.247 17764 root /bin/mail -s in.ftpd-64.213.97.247 unknown root 17765 nobody finger -l 64.213.97.247 17768 root /usr/sbin/sshd 17770 root sh -c (safe_finger -l @::ffff:64.213.97.247 2>&1| /bin/mail -s "sshd-::ffff:64.213.97.247 unknown" root) & 17771 nobody safe_finger -l @::ffff:64.213.97.247 17772 root /bin/mail -s sshd-::ffff:64.213.97.247 unknown root 17773 nobody finger -l ::ffff:64.213.97.247 Thanks, Mike

3 2

Advise Needed
by Michael Long May 1, 2002

May 1, 2002

It appears that my computer has been hacked into. The following services are run periodically throughout the day. How do I go about finding out what is starting and stopping them and more importantly prevent them from being run. I have a hardware firewall between the computer and isp. 17762 root sh -c (safe_finger -l @64.213.97.247 2>&1| /bin/mail -s "in.ftpd-64.213.97.247 unknown" root) & 17763 nobody safe_finger -l @64.213.97.247 17764 root /bin/mail -s in.ftpd-64.213.97.247 unknown root 17765 nobody finger -l 64.213.97.247 17768 root /usr/sbin/sshd 17770 root sh -c (safe_finger -l @::ffff:64.213.97.247 2>&1| /bin/mail -s "sshd-::ffff:64.213.97.247 unknown" root) & 17771 nobody safe_finger -l @::ffff:64.213.97.247 17772 root /bin/mail -s sshd-::ffff:64.213.97.247 unknown root 17773 nobody finger -l ::ffff:64.213.97.247 Thanks, Mike

1 0

Returned mail: see transcript for details (fwd)
by Michelle Vadeboncoeur April 30, 2002

April 30, 2002

can anyone determine from the status codes what software the Reporting-MTA is? Maybe the reason is hidden in that code. Your mysterious non-delivery generated a Status: 5.0.0 for a comparison returned email, I send a test message to a friend's inactive hotmail account (disabled for lack of use). I sent it using Pine on a linux box running sendmail. sorry, I'm not on charter so I can't completely replicate things... besides the status codes being different, it's my server rejecting the email, and not a response from hotmail. ---------- Forwarded message ---------- >From MAILER-DAEMON(a)kluge.net Tue Apr 30 15:34:51 2002 Date: Tue, 30 Apr 2002 15:24:23 -0400 From: Mail Delivery Subsystem <MAILER-DAEMON(a)kluge.net> To: mrv(a)eclectic.kluge.net Subject: Returned mail: see transcript for details The original message was received at Tue, 30 Apr 2002 15:24:21 -0400 from mrv@localhost ----- The following addresses had permanent fatal errors ----- <outlaweagle(a)hotmail.com> (reason: 550 Requested action not taken:user account inactive) ----- Transcript of session follows ----- ... while talking to mx09.hotmail.com.: >>> RCPT To:<outlaweagle(a)hotmail.com> <<< 550 Requested action not taken:user account inactive 550 5.1.1 <outlaweagle(a)hotmail.com>... User unknown [ Part 2: "Delivery Status" ] Reporting-MTA: dns; eclectic.kluge.net Arrival-Date: Tue, 30 Apr 2002 15:24:21 -0400 Final-Recipient: RFC822; outlaweagle(a)hotmail.com Action: failed Status: 5.1.1 Remote-MTA: DNS; mx09.hotmail.com Diagnostic-Code: SMTP; 550 Requested action not taken:user account inactive Last-Attempt-Date: Tue, 30 Apr 2002 15:24:22 -0400 Return-Path: <mrv(a)eclectic.kluge.net> Received: from localhost (mrv@localhost) by eclectic.kluge.net (8.11.6/8.11.6) with ESMTP id g3UJOL702343 for <outlaweagle(a)hotmail.com>; Tue, 30 Apr 2002 15:24:21 -0400 Date: Tue, 30 Apr 2002 15:24:20 -0400 (EDT) From: Michelle Vadeboncoeur <mrv(a)eclectic.kluge.net> To: craig roberts <outlaweagle(a)hotmail.com> Subject: testing Message-ID: <Pine.LNX.4.44.0204301524100.27941-100000(a)eclectic.kluge.net> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII

2 1

Mail delivery problems
by Bill Mills-Curran April 30, 2002

April 30, 2002

Sorry for the misleading initial description of the problem. Here's what hotmail has been sending me. Bill ---------- Forwarded message ---------- Date: Tue, 30 Apr 2002 09:50:33 -0700 From: postmaster(a)mail.hotmail.com To: subssn594(a)charter.net Subject: Delivery Status Notification (Failure) This is an automatically generated Delivery Status Notification. Delivery to the following recipients failed. kamikaze003(a)hotmail.com

2 1

problems with email to hotmail.com
by Bill Mills-Curran April 30, 2002

April 30, 2002

I'm a Charter user, and something has changed between charter and hotmail so that I can no longer send email to hotmail.com accounts. I CAN send if I use Charter's web mail interface, but I much prefer to stick with pine. I suspect that the problem is that I'm behind a linksys router using private IP's and NAT. I've tried talking to Charter tech support, but they are worthless -- they just tell me that they only support Outlook email. I've tried configuring Pine so the it uses the Charter smtp server directly, but that doesn't seem to help, either. Right now, I'm using my local machine, and routing through Charter. Any ideas? TIA, Bill

5 9

bug report
by Bill Mills-Curran April 29, 2002

April 29, 2002

I need some advice on where to send a bug report. Here's what happened: I was accessing an SMB filesystem mounted "mount -t smbfs" when file accesses (things like "ls" and "cd") started producing "Segmentation fault" messages. I looked in my system log and found: Apr 16 16:58:53 pent584 kernel: kernel BUG at dcache.c:128! Apr 16 16:58:53 pent584 kernel: invalid operand: 0000 Apr 16 16:58:53 pent584 kernel: CPU: 0 Apr 16 16:58:53 pent584 kernel: EIP: 0010:[dput+43/384] Apr 16 16:58:53 pent584 kernel: EIP: 0010:[<c014592b>] Apr 16 16:58:53 pent584 kernel: EFLAGS: 00010282 Apr 16 16:58:53 pent584 kernel: eax: 0000001c ebx: c0628c40 ecx: ffffffff edx: 00000000 Apr 16 16:58:53 pent584 kernel: esi: c6dd18c0 edi: c2497bc0 ebp: c0628c40 esp: c5c89f54 Apr 16 16:58:53 pent584 kernel: ds: 0018 es: 0018 ss: 0018 Apr 16 16:58:53 pent584 kernel: Process tcsh (pid: 5018, stackpage=c5c89000) Apr 16 16:58:53 pent584 kernel: Stack: c02128db c021297b 00000080 c3404c60 00000000 00000200 c3404c60 c3404c60 Apr 16 16:58:53 pent584 kernel: c6dd18c0 c0134531 c0628c40 c3404c60 00000000 00000000 bffe8148 c0133603 Apr 16 16:58:53 pent584 kernel: c3404c60 c625fc20 00000000 c3404c60 00000000 c3404c60 08119408 c0133653 Apr 16 16:58:53 pent584 kernel: Call Trace: [error_table+42755/46744] [error_table+42915/46744] [fput+113/208] [filp_close+83/96] [sys_close+67/80] [system_call+51/56] Apr 16 16:58:53 pent584 kernel: Call Trace: [<c02128db>] [<c021297b>] [<c0134531>] [<c0133603>] [<c0133653>] [<c010901b>] Apr 16 16:58:53 pent584 kernel: Apr 16 16:58:53 pent584 kernel: Code: 0f 0b 83 c4 0c ff 0b 0f 94 c0 84 c0 0f 84 33 01 00 00 8d 43 I tried to dismount the suspect filesystem, but I couldn't -- filesystem busy, even though there were no live processes on it. Then, operations on other filesystems started failing, finally ending up with a frozen system. I power cycled, and everything is happy again. So, here's what I found in the MAINTAINERS file: SMB FILESYSTEM P: Urban Widmark M: urban(a)teststation.com W: http://samba.org/ L: samba(a)samba.org S: Maintained DEVICE FILESYSTEM P: Richard Gooch M: rgooch(a)atnf.csiro.au L: linux-kernel(a)vger.kernel.org S: Maintained BTW, I'm running RedHat 7.1. So, who do I tell? TIA, Bill Mills-Curran

2 1

Whee! MIT Flea
by desdinova＠soupforare.net April 24, 2002

April 24, 2002

::Dances around:: Got so much great swag at the flea this time ^_^; Anyway, I picked up two Dolch 486DX/33s, on board scsi, 32meg for $15. It's been a loooong time since I've run linux on a 486 (slack 2.something, iirc) I'm thinking Debian potato would be alright? I most likely won't install X, but if I do, I'll use X3.foo with a minimalist windowmanager... Any suggestions? It's going to be alot of shoehorning for sure. I won't lie, I haven't ran a linux system since my P200 died, she was a fileserver and random-use machine. So, getting these running would be great so I could fool around at work during slow hours. Thanks, James KB1FJQ

3 2

RE: [Wlug] Regarding M$ enforcement of licenses...
by Simoncini, Matthew April 23, 2002

April 23, 2002

Hello, It's kind of interesting that an email about this very topic landed in my inbox this morning. Here's the link: http://techupdate.zdnet.com/techupdate/filters/specialreport/0,14622,6022528 ,00.html Good luck. Matthew On Tue, 23 Apr 2002 07:44:37 -0400, Stephen C. Daukas wrote: >In case you haven't heard, M$ is auditing a dozen or so large school >districts for compliance on licensing. Of course, this will be ugly and >will run one district an estimated $1,000,000 per year to comply with >M$. That's $1,000,000 more then they pay now. M$ is offering a simplified >arrangement whereby a school system pays a flat fee for every Intel box >(regardless of what it might actually be running) that would run that same >district about $30,000. You can see where this is headed! > >Aside from noting that people's dishonesty about paying the real costs >associated with M$ software has gotten them into this trouble (if only >because the real costs are not apparent to "management"), I'm wondering >what is available as a real alternative to M$ for the great unwashed masses. > >Of course, the answer I would expect to hear is "Linux!", but... > >I'm talking about a solution that is useable by those who are not rabid >members of a LUG, or Sys admins in their day job. I'm talking about >productivity software that will seamlessly read and write M$ file formats >(Excel, Word, etc.). I don't know, for example, if Star Office is a real >alternative because I don't know how well it interoperates with those who >use Word, for example, on a daily basis. Perhaps there is a solution that >will reliably run M$ applications without having to buy the OS, but that is >only a step in the right direction. > >I was hoping to hear suggestions about what is out there and if Linux is >ready to work seamlessly in heterogeneous High-Tech world. This might be a >good topic for one of the WLUG meetings... > >Steve > >_______________________________________________ >Wlug mailing list >Wlug(a)mail.wlug.org >http://mail.wlug.org/mailman/listinfo/wlug _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug

1 0

Regarding M$ enforcement of licenses...
by Stephen C. Daukas April 23, 2002

April 23, 2002

In case you haven't heard, M$ is auditing a dozen or so large school districts for compliance on licensing. Of course, this will be ugly and will run one district an estimated $1,000,000 per year to comply with M$. That's $1,000,000 more then they pay now. M$ is offering a simplified arrangement whereby a school system pays a flat fee for every Intel box (regardless of what it might actually be running) that would run that same district about $30,000. You can see where this is headed! Aside from noting that people's dishonesty about paying the real costs associated with M$ software has gotten them into this trouble (if only because the real costs are not apparent to "management"), I'm wondering what is available as a real alternative to M$ for the great unwashed masses. Of course, the answer I would expect to hear is "Linux!", but... I'm talking about a solution that is useable by those who are not rabid members of a LUG, or Sys admins in their day job. I'm talking about productivity software that will seamlessly read and write M$ file formats (Excel, Word, etc.). I don't know, for example, if Star Office is a real alternative because I don't know how well it interoperates with those who use Word, for example, on a daily basis. Perhaps there is a solution that will reliably run M$ applications without having to buy the OS, but that is only a step in the right direction. I was hoping to hear suggestions about what is out there and if Linux is ready to work seamlessly in heterogeneous High-Tech world. This might be a good topic for one of the WLUG meetings... Steve

4 3

RE: [Wlug] shot power supply?
by dibb_jim＠emc.com April 22, 2002

April 22, 2002

Most drives require +5 and + 12 volt supplies. Some newer (very new) drives only require +12V. -----Original Message----- From: bryon3245(a)netzero.com [mailto:bryon3245@netzero.com] Sent: Monday, April 22, 2002 1:54 PM To: wlug(a)mail.wlug.org Subject: [Wlug] shot power supply? I have a Dell Dimension 4100 and I am pretty sure that the power supply is shot. I was wondering if there are any tests that I can do to make sure that it is the power supply and not something else. I am sure that there is nothing wrong with the power cord. When I plug in the cord and push the power button nothing happens and nothing lights up. I was also wondering why there are four cords going to each drive. I know it needs a positive and negative and posibly a ground but what is the last one for. What does each cord do? Is it possible to replace it with a generic PSU becuase i heard that only dell ones will work with a dell computer. Thanks -------------------------------------------------------------------- mail2web - Check your email from the web at http://mail2web.com/ . _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug

1 0