- WLUG - wlug.mailman3.com

Re: [Wlug] Announce: WLUG Meeting Wed 2/13 7PM More Raspberry Pi

by Chuck Anderson

Oh, and I forgot to mention, I have some NEW raffle items! On Tue, Feb 12, 2013 at 07:52:08PM -0500, Chuck Anderson wrote: > Hi folks, > > The next Worcester Linux Users' Group (WLUG) meeting will be held at > its regularly scheduled time: the 2nd Wednesday of the month, which is > tomorrow, Wednesday, February 13, at 7PM. The location will be the > WPI Campus Center, Mid-Centry Room 331, which should hopefully become > our regular location. > > If people would like, I can bring my new Raspberry Pi to play with. I > might even have a case for it by then. I have installed a distro > called OpenELEC which is an XBMC port, but we can play with other > distros as well, especially if people bring some spare SD cards they > don't mind erasing. > > Wednesday, February 13, 7:00 - 10:00 PM > WPI Campus Center, Mid-Centry Room 331 > More Raspberry Pi > > Afterwards, we will go out for pizza and maybe raspberry pie. > > See you there, > Chuck > President, Worcester Linux Users' Group > http://www.wlug.org/

Feb. 13, 2013

Announce: WLUG Meeting Wed 2/13 7PM More Raspberry Pi

by Chuck Anderson

Hi folks, The next Worcester Linux Users' Group (WLUG) meeting will be held at its regularly scheduled time: the 2nd Wednesday of the month, which is tomorrow, Wednesday, February 13, at 7PM. The location will be the WPI Campus Center, Mid-Centry Room 331, which should hopefully become our regular location. If people would like, I can bring my new Raspberry Pi to play with. I might even have a case for it by then. I have installed a distro called OpenELEC which is an XBMC port, but we can play with other distros as well, especially if people bring some spare SD cards they don't mind erasing. Wednesday, February 13, 7:00 - 10:00 PM WPI Campus Center, Mid-Centry Room 331 More Raspberry Pi Afterwards, we will go out for pizza and maybe raspberry pie. See you there, Chuck President, Worcester Linux Users' Group http://www.wlug.org/

Feb. 13, 2013

Virtualization/Linux/Storage openings at MathWorks.

by Adam Keck

Hi All, We have a Linux/Virtualization position and a Storage/Virtualization position open. I believe both are project-focused. Please email me off-list, if you are interested. Thanks! -Adam

Feb. 7, 2013

Linux experience needed ... Just came by my desk.

by Bob

Don't know if this would be of interest to anyone in our group but doesn't hurt to let you all know about it. http://careers.computer.org/jobs/5114650/linux-systems-engineer?lf1=9583874… Bob

Feb. 5, 2013

Re: [Wlug] Announce: WLUG Meeting TODAY Wed 1/9 7PM

by Chuck Anderson

On Wed, Jan 09, 2013 at 06:07:31PM -0500, Aaron Haviland wrote: > Chuck Anderson wrote, on Jan 09, 2013 at 10:09 EST: > > [-- PGP output follows (current time: Wed 09 Jan 2013 06:04:44 PM EST) --] > > gpg: Signature made Wed 09 Jan 2013 10:09:05 AM EST using DSA key ID 49BB5886 > > gpg: Good signature from "Charles R. Anderson <cra(a)wpi.edu>" > > gpg: aka "Charles R. Anderson <cra(a)alum.wpi.edu>" > > gpg: aka "Charles R. Anderson <cra(a)fedoraproject.org>" > > gpg: Note: This key has expired! > > Primary key fingerprint: EBA3 A106 7C93 FA07 8E15 3AC2 C367 A0F9 49BB 5886 > > [-- End of PGP output --] > > Anyone else notice that "This key has expired!" bit? :) I didn't notice since either I forgot to push to subkeys.pgp.net when I extended it last year, or you (and others) forgot to pull it down again...probably the former. I just pushed it now, so if you pull it should be good. Thanks for noticing.

Jan. 10, 2013

Re: [Wlug] Announce: WLUG Meeting TODAY Wed 1/9 7PM

by Aaron Haviland

Chuck Anderson wrote, on Jan 09, 2013 at 10:09 EST: > [-- PGP output follows (current time: Wed 09 Jan 2013 06:04:44 PM EST) --] > gpg: Signature made Wed 09 Jan 2013 10:09:05 AM EST using DSA key ID 49BB5886 > gpg: Good signature from "Charles R. Anderson <cra(a)wpi.edu>" > gpg: aka "Charles R. Anderson <cra(a)alum.wpi.edu>" > gpg: aka "Charles R. Anderson <cra(a)fedoraproject.org>" > gpg: Note: This key has expired! > Primary key fingerprint: EBA3 A106 7C93 FA07 8E15 3AC2 C367 A0F9 49BB 5886 > [-- End of PGP output --] Anyone else notice that "This key has expired!" bit? :) -- Aaron Haviland

Jan. 9, 2013

Re: [Wlug] Announce: WLUG Meeting TODAY Wed 1/9 7PM

by Tim Keller

Unfortunately, I will be unable to attend because of the lack of advanced notice... See you guys in Feb... Tim. On Wed, Jan 9, 2013 at 1:17 PM, Keith Wright <kwright(a)keithdiane.us> wrote: > > From: Chuck Anderson <cra(a)WPI.EDU> > > > > The next Worcester Linux Users' Group (WLUG) monthly meeting will be > > held Today, Wednesday, January 9, at 7PM. The location will be WPI > > Campus Center, Chairman's Room 129. > > > > Wednesday, January 9, 7:00 - 10:00 PM > > WPI Campus Center, Chairman's Room 129 > > > > Afterwards, we will go out for pizza and continue our discussions. > > > > See you there, > > I plan to be there. Since there is no scheduled speaker, I will > step into the breach. I have no slides or demos, but I will bring > some dusty paper and lead a discussion of "Literate Programming", > alternate title "What I Did the Last Fourty Years". > > -- Keith > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > -- I am leery of the allegiances of any politician who refers to their constituents as "consumers".

Jan. 9, 2013

Re: [Wlug] Announce: WLUG Meeting TODAY Wed 1/9 7PM

by Keith Wright

> From: Chuck Anderson <cra(a)WPI.EDU> > > The next Worcester Linux Users' Group (WLUG) monthly meeting will be > held Today, Wednesday, January 9, at 7PM. The location will be WPI > Campus Center, Chairman's Room 129. > > Wednesday, January 9, 7:00 - 10:00 PM > WPI Campus Center, Chairman's Room 129 > > Afterwards, we will go out for pizza and continue our discussions. > > See you there, I plan to be there. Since there is no scheduled speaker, I will step into the breach. I have no slides or demos, but I will bring some dusty paper and lead a discussion of "Literate Programming", alternate title "What I Did the Last Fourty Years". -- Keith

Jan. 9, 2013

Announce: WLUG Meeting TODAY Wed 1/9 7PM

by Chuck Anderson

Hi folks, The next Worcester Linux Users' Group (WLUG) monthly meeting will be held Today, Wednesday, January 9, at 7PM. The location will be WPI Campus Center, Chairman's Room 129. Wednesday, January 9, 7:00 - 10:00 PM WPI Campus Center, Chairman's Room 129 Afterwards, we will go out for pizza and continue our discussions. See you there, Chuck President, Worcester Linux Users' Group http://www.wlug.org/

Jan. 9, 2013

Meeting today: January 9 7PM

by Chuck Anderson

Sorry for the late notice. I'm reserving a room now for tonight & all future 2nd Wednesdays at 7PM in 2013. I'll let the group know the location as soon as it has been approved. On Tue, Jan 08, 2013 at 02:37:07PM -0500, Henrique wrote: > Hey, > > I can reserve the room, and we do not have a topic; I also just emailed a > guy from WWT <http://www.meetup.com/Worcester-Web-Technology/>if he is > interested in making a git talk, but I think it would be too early notice. > I will keep you guys updated. > > Cheers, > Henrique. > > > On Tue, Jan 8, 2013 at 2:06 PM, Tim Keller <turbofx(a)gmail.com> wrote: > > > Since it's now Tuesday and there's been no official announcement... > > > > Are we having a meeting on the 10th? > > > > If so, has a room been reserved? > > > > Is there a topic? > > > > Thanks, > > Tim. > > > > -- > > I am leery of the allegiances of any politician who refers to their > > constituents as "consumers".

Jan. 9, 2013

Re: [Wlug] Are we having a meeting on the 10th?

by Henrique

Hey, I can reserve the room, and we do not have a topic; I also just emailed a guy from WWT <http://www.meetup.com/Worcester-Web-Technology/>if he is interested in making a git talk, but I think it would be too early notice. I will keep you guys updated. Cheers, Henrique. On Tue, Jan 8, 2013 at 2:06 PM, Tim Keller <turbofx(a)gmail.com> wrote: > Since it's now Tuesday and there's been no official announcement... > > Are we having a meeting on the 10th? > > If so, has a room been reserved? > > Is there a topic? > > Thanks, > Tim. > > -- > I am leery of the allegiances of any politician who refers to their > constituents as "consumers". > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > >

Jan. 8, 2013

Are we having a meeting on the 10th?

by Tim Keller

Since it's now Tuesday and there's been no official announcement... Are we having a meeting on the 10th? If so, has a room been reserved? Is there a topic? Thanks, Tim. -- I am leery of the allegiances of any politician who refers to their constituents as "consumers".

Jan. 8, 2013

Fwd: [Dc401-l] Javascript Hackathon at Betaspring - Providence Feb. 2nd 2013

by Adam Gomes

Thought that some of you might be interested in doing this. --Adam ---------- Forwarded message ---------- From: David Johnson <ag3nt5(a)gmail.com> Date: Mon, Jan 7, 2013 at 1:30 PM Subject: [Dc401-l] Javascript Hackathon at Betaspring - Providence Feb. 2nd 2013 To: "dc401-l(a)lists.dc401.org" <dc401-l(a)lists.dc401.org> DowncityJS is a 24-hour JavaScript Hackathon taking place in Providence, RI on February 2nd. The rules are simple: show up with your laptop, design or development skills, and assemble a team of likeminded hackers (or participate by yourself if you are brave enough) ready to build the best web application of JavaScript library in 24 hours. Food and beverages will be provided by the Founders League and space and connectivity will be provided by Betaspring. 95 Chestnut Street, 3rd Floor, Providence, RI 02903 Check out http://downcityjs.com/ for more info. __________________________________________ http://lists.dc401.org/listinfo.cgi/dc401-l-dc401.org

Jan. 7, 2013

next WLUG meeting?

by The Hammer

Hi, Does anyone have the next meeting date/time/location? regards, Ron

Jan. 7, 2013

Re: [Wlug] Overriding NIS accounts

by John Stoffel

Yup, what you did makes perfect sense. It's probably a bug in RHEL5.3, can you upgrade? I'm going to be busy at work the rest of the week and might not have the time to play with this on my RHEL 5.5/5.6 systems either. Bill> Note that the config I had originally described works on other systems Bill> (versions, distros). It's a little crazy-making. Bill> On Wed, Dec 19, 2012 at 05:17:14PM -0500, John Stoffel wrote: >> Date: Wed, 19 Dec 2012 17:17:14 -0500 >> From: John Stoffel <john(a)stoffel.org> >> To: Worcester Linux Users Group <wlug(a)mail.wlug.org> >> Cc: Worcester Linux Users Group <wlug(a)wlug.org> >> Subject: Re: [Wlug] Overriding NIS accounts >> Reply-To: Worcester Linux Users Group <wlug(a)mail.wlug.org> >> Precedence: list >> >> >>>>> "John" == John Stoffel <john(a)stoffel.org> writes: >> >> >>>>> "Bill" == Bill Mills-Curran <bill(a)mills-curran.net> writes: Bill> I have an issue at my work with the configuration of one of our Bill> several flavors of linux servers. >> Bill> The goal is to override the NIS-specified login directory definition Bill> by using this syntax in /etc/passwd: >> Bill> +userx:::::/home/userx: >> John> Don't do that, just put the user entry in there without the leading +, John> then it will override properly. >> >> But thinking about it more (not tested yet though) you just want to >> override the home directory, but keep his password in NIS. Fun. I'll >> have to play around and see what I can test tmorrow. >> >> John >> _______________________________________________ >> Wlug mailing list >> Wlug(a)mail.wlug.org >> http://mail.wlug.org/mailman/listinfo/wlug >> Bill> _______________________________________________ Bill> Wlug mailing list Bill> Wlug(a)mail.wlug.org Bill> http://mail.wlug.org/mailman/listinfo/wlug

Dec. 20, 2012

Re: [Wlug] Overriding NIS accounts

by Bill Mills-Curran

Note that the config I had originally described works on other systems (versions, distros). It's a little crazy-making. On Wed, Dec 19, 2012 at 05:17:14PM -0500, John Stoffel wrote: > Date: Wed, 19 Dec 2012 17:17:14 -0500 > From: John Stoffel <john(a)stoffel.org> > To: Worcester Linux Users Group <wlug(a)mail.wlug.org> > Cc: Worcester Linux Users Group <wlug(a)wlug.org> > Subject: Re: [Wlug] Overriding NIS accounts > Reply-To: Worcester Linux Users Group <wlug(a)mail.wlug.org> > Precedence: list > > >>>>> "John" == John Stoffel <john(a)stoffel.org> writes: > > >>>>> "Bill" == Bill Mills-Curran <bill(a)mills-curran.net> writes: > Bill> I have an issue at my work with the configuration of one of our > Bill> several flavors of linux servers. > > Bill> The goal is to override the NIS-specified login directory definition > Bill> by using this syntax in /etc/passwd: > > Bill> +userx:::::/home/userx: > > John> Don't do that, just put the user entry in there without the leading +, > John> then it will override properly. > > But thinking about it more (not tested yet though) you just want to > override the home directory, but keep his password in NIS. Fun. I'll > have to play around and see what I can test tmorrow. > > John > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug >

Dec. 19, 2012

Re: [Wlug] Overriding NIS accounts

by John Stoffel

>>>>> "John" == John Stoffel <john(a)stoffel.org> writes: >>>>> "Bill" == Bill Mills-Curran <bill(a)mills-curran.net> writes: Bill> I have an issue at my work with the configuration of one of our Bill> several flavors of linux servers. Bill> The goal is to override the NIS-specified login directory definition Bill> by using this syntax in /etc/passwd: Bill> +userx:::::/home/userx: John> Don't do that, just put the user entry in there without the leading +, John> then it will override properly. But thinking about it more (not tested yet though) you just want to override the home directory, but keep his password in NIS. Fun. I'll have to play around and see what I can test tmorrow. John

Dec. 19, 2012

Re: [Wlug] Overriding NIS accounts

by John Stoffel

>>>>> "Bill" == Bill Mills-Curran <bill(a)mills-curran.net> writes: Bill> I have an issue at my work with the configuration of one of our Bill> several flavors of linux servers. Bill> The goal is to override the NIS-specified login directory definition Bill> by using this syntax in /etc/passwd: Bill> +userx:::::/home/userx: Don't do that, just put the user entry in there without the leading +, then it will override properly. John

Dec. 19, 2012

Re: [Wlug] Overriding NIS accounts

by John Stoffel

Bill> No joy. That didn't do it, unless I need to reboot something. Works for me on a RHEL5.5 box. I took one of my users, changed his home directory and put it into /etc/passwd on the local system. sudo su - <user> put me into the new home dir, just like I expected. I have: passwd: files nis in /etc/nsswitch.conf What do you see on your RHEL5.3 box when you do: getent passwd <user> that will tell you also. Also, make sure you bouce the nscd daemon, it might be caching the old entries. John

Dec. 19, 2012

Re: [Wlug] Overriding NIS accounts

by Bill Mills-Curran

No joy. That didn't do it, unless I need to reboot something. On Wed, Dec 19, 2012 at 03:24:00PM -0500, Mills-Curran, Bill wrote: > Date: Wed, 19 Dec 2012 15:24:00 -0500 > From: Bill Mills-Curran <bill(a)mills-curran.net> > To: Worcester Linux Users Group <wlug(a)mail.wlug.org> > Cc: Worcester Linux Users Group <wlug(a)wlug.org> > Subject: Re: [Wlug] Overriding NIS accounts > Reply-To: Worcester Linux Users Group <wlug(a)mail.wlug.org> > Precedence: list > > Tim, > > I /thought/ I tried that configuration, too. I'll give it another > shot. I know that some systems need the "compat". > > Bill > > On Wed, Dec 19, 2012 at 03:13:21PM -0500, Tim Keller wrote: > > Date: Wed, 19 Dec 2012 15:13:21 -0500 > > From: Tim Keller <turbofx(a)gmail.com> > > To: Worcester Linux Users Group <wlug(a)mail.wlug.org>, > > Bill Mills-Curran <bill(a)mills-curran.net>, > > Worcester Linux Users Group <wlug(a)wlug.org> > > Subject: Re: [Wlug] Overriding NIS accounts > > Reply-To: Worcester Linux Users Group <wlug(a)mail.wlug.org> > > Precedence: list > > > > You need to have your passwd entry as: > > passwd: files nis > > Then it'll look at your local /etc/passwd, then nis. > > Thanks, > > Tim. > > > > On Wed, Dec 19, 2012 at 1:18 PM, Bill Mills-Curran <bill(a)mills-curran.net> > > wrote: > > > > I have an issue at my work with the configuration of one of our > > several flavors of linux servers. > > > > The goal is to override the NIS-specified login directory definition > > by using this syntax in /etc/passwd: > > > > +userx:::::/home/userx: > > +@grpx:::::: > > +:::::: > > > > /etc/nsswitch.conf has (in part): > > > > passwd: * * compat > > shadow: * * files nis > > group: * * *files nis > > > > The distribution is Red Hat Enterprise Linux Server release 5.2 > > (Tikanga). > > > > If this was working I would get the following: > > > > > echo ~userx > > /home/userx > > > > Instead, I'm getting the login dir specified in NIS. > > > > I've successfully configured a Red Hat 6.3 server to work properly, > > but this one is driving me batty. > > > > Any suggestions? > > > > TIA, > > Bill > > _______________________________________________ > > Wlug mailing list > > Wlug(a)mail.wlug.org > > http://mail.wlug.org/mailman/listinfo/wlug > > > > -- > > I am leery of the allegiances of any politician who refers to their > > constituents as "consumers". > > > _______________________________________________ > > Wlug mailing list > > Wlug(a)mail.wlug.org > > http://mail.wlug.org/mailman/listinfo/wlug > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug >

Dec. 19, 2012

Re: [Wlug] Overriding NIS accounts

by Bill Mills-Curran

Tim, I /thought/ I tried that configuration, too. I'll give it another shot. I know that some systems need the "compat". Bill On Wed, Dec 19, 2012 at 03:13:21PM -0500, Tim Keller wrote: > Date: Wed, 19 Dec 2012 15:13:21 -0500 > From: Tim Keller <turbofx(a)gmail.com> > To: Worcester Linux Users Group <wlug(a)mail.wlug.org>, > Bill Mills-Curran <bill(a)mills-curran.net>, > Worcester Linux Users Group <wlug(a)wlug.org> > Subject: Re: [Wlug] Overriding NIS accounts > Reply-To: Worcester Linux Users Group <wlug(a)mail.wlug.org> > Precedence: list > > You need to have your passwd entry as: > passwd: files nis > Then it'll look at your local /etc/passwd, then nis. > Thanks, > Tim. > > On Wed, Dec 19, 2012 at 1:18 PM, Bill Mills-Curran <bill(a)mills-curran.net> > wrote: > > I have an issue at my work with the configuration of one of our > several flavors of linux servers. > > The goal is to override the NIS-specified login directory definition > by using this syntax in /etc/passwd: > > +userx:::::/home/userx: > +@grpx:::::: > +:::::: > > /etc/nsswitch.conf has (in part): > > passwd: * * compat > shadow: * * files nis > group: * * *files nis > > The distribution is Red Hat Enterprise Linux Server release 5.2 > (Tikanga). > > If this was working I would get the following: > > > echo ~userx > /home/userx > > Instead, I'm getting the login dir specified in NIS. > > I've successfully configured a Red Hat 6.3 server to work properly, > but this one is driving me batty. > > Any suggestions? > > TIA, > Bill > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > > -- > I am leery of the allegiances of any politician who refers to their > constituents as "consumers". > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug

Dec. 19, 2012

Re: [Wlug] Overriding NIS accounts

by Tim Keller

You need to have your passwd entry as: passwd: files nis Then it'll look at your local /etc/passwd, then nis. Thanks, Tim. On Wed, Dec 19, 2012 at 1:18 PM, Bill Mills-Curran <bill(a)mills-curran.net>wrote: > I have an issue at my work with the configuration of one of our > several flavors of linux servers. > > The goal is to override the NIS-specified login directory definition > by using this syntax in /etc/passwd: > > +userx:::::/home/userx: > +@grpx:::::: > +:::::: > > /etc/nsswitch.conf has (in part): > > passwd: compat > shadow: files nis > group: files nis > > The distribution is Red Hat Enterprise Linux Server release 5.2 > (Tikanga). > > If this was working I would get the following: > > > echo ~userx > /home/userx > > Instead, I'm getting the login dir specified in NIS. > > I've successfully configured a Red Hat 6.3 server to work properly, > but this one is driving me batty. > > Any suggestions? > > TIA, > Bill > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > -- I am leery of the allegiances of any politician who refers to their constituents as "consumers".

Dec. 19, 2012

Overriding NIS accounts

by Bill Mills-Curran

I have an issue at my work with the configuration of one of our several flavors of linux servers. The goal is to override the NIS-specified login directory definition by using this syntax in /etc/passwd: +userx:::::/home/userx: +@grpx:::::: +:::::: /etc/nsswitch.conf has (in part): passwd: compat shadow: files nis group: files nis The distribution is Red Hat Enterprise Linux Server release 5.2 (Tikanga). If this was working I would get the following: > echo ~userx /home/userx Instead, I'm getting the login dir specified in NIS. I've successfully configured a Red Hat 6.3 server to work properly, but this one is driving me batty. Any suggestions? TIA, Bill

Dec. 19, 2012

Re: [Wlug] Possible intrusion?

by Bill Mills-Curran

On Sun, Dec 16, 2012 at 11:54:35PM -0500, Chuck Anderson wrote: > Date: Sun, 16 Dec 2012 23:54:35 -0500 > From: Chuck Anderson <cra(a)WPI.EDU> > To: Worcester Linux Users Group <wlug(a)wlug.org> > Subject: Re: [Wlug] Possible intrusion? > Reply-To: Worcester Linux Users Group <wlug(a)mail.wlug.org> > Precedence: list > > On Sun, Dec 16, 2012 at 12:08:28PM -0500, Bill Mills-Curran wrote: > > I was looking at the output of "last" recently and found several > > entries like this on my home server: > > > > userxx pts/0 c-24-91-141-172. Sun Dec 2 14:57 - 15:09 (00:11) > > > > (userxx represents my username) > > > > I did a reverse lookup on 172.141.92.24: > > Besides the fact that the IP you are looking up doesn't match the > hostname c-24-91-141-172 in forward or reverse order (you are off by > one), you can't be sure of the format of the logged hostname--you are > assuming you need to reverse the components of the hostname to come up > with an IP address of 172.141.91.24, but how do you know it isn't > really 24.91.141.172? How can you be sure there is any relation at > all between the FQDN format and any IP address at all? Also, you are > looking at trumcated hostnames from "last". > > You should always check the actual IP that was logged in wtmp with > last -i, and put the hostname or IP at the end of the output lines so > it doesn't get truncated with last -a: > > last -i -a > > and then do a whois lookup on that IP. > > Reverse DNS can't be trusted since the owner of the IP address can > often set their reverse DNS to absolutely anything they want--it > should never be relied upon solely for audit logging. > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > Thanks for the tip.

Dec. 17, 2012

Re: [Wlug] Possible intrusion?

by Chuck Anderson

On Sun, Dec 16, 2012 at 12:08:28PM -0500, Bill Mills-Curran wrote: > I was looking at the output of "last" recently and found several > entries like this on my home server: > > userxx pts/0 c-24-91-141-172. Sun Dec 2 14:57 - 15:09 (00:11) > > (userxx represents my username) > > I did a reverse lookup on 172.141.92.24: Besides the fact that the IP you are looking up doesn't match the hostname c-24-91-141-172 in forward or reverse order (you are off by one), you can't be sure of the format of the logged hostname--you are assuming you need to reverse the components of the hostname to come up with an IP address of 172.141.91.24, but how do you know it isn't really 24.91.141.172? How can you be sure there is any relation at all between the FQDN format and any IP address at all? Also, you are looking at trumcated hostnames from "last". You should always check the actual IP that was logged in wtmp with last -i, and put the hostname or IP at the end of the output lines so it doesn't get truncated with last -a: last -i -a and then do a whois lookup on that IP. Reverse DNS can't be trusted since the owner of the IP address can often set their reverse DNS to absolutely anything they want--it should never be relied upon solely for audit logging.

Dec. 17, 2012