- WLUG - wlug.mailman3.com

RH7.0 Hacked
by Richard Goodman Oct. 23, 2002

Oct. 23, 2002

I have two RH7.0 and two RH7.3 servers ... it appears that between 5-6am Tuesday both the 7.0 servers were hacked - identically. They are on the same ISP and often their firewalls pick up the same scans and probes. I'm no expert, but this is what I think happened. The first clue was that I couldn't log in through ssh - got the message "The program does not understand the servers's version of the protocol" Looking at /var/log/secure I saw: 10/22 5:34 xinetd fail ftp libwrap from 195.157.17.177 then two fails from 127.0.0.1 I'm running an unpatched wu-ftpd (which I'm sure didn't help me) but the host.allow/deny were set to only allow ftp from the internal network and one specified outside IP# 10/22 5:48 (twice) xinetd start pop3 pid=10804 from 127.0.0.1 [not me-sleeping] 10/22 6:09 Listener created on port 22 Daemon is running Some poking around showed in /etc/ssh sshd (which should have been approx 200K was 2,621,812 and dated 10/22, so probably a trojan? ssh_host_key, ssh_host_key_pub, ssh_random_seed, sshd_config all had 10/22 modified dates My web server also was not running (or at least serving local pages) I accidently rebooted, the web server came back, but ssh did not. Later I attempted to delete and reinstall sshd. rpm said it couldn't uninstall because it wasn't there, and couldn't install because it was there. I think it finally installed with --force, and sshd was about 186K, but the symptoms were the same It turns out that ftp is also now not operational from the internal network. There is a message about xinetd/ftp in the startup, but its probably not important at this point After the reboot, ps -ax listed: 1811 D /sbin/modprobe -s -k block-major 7 [which I could not kill] Obviously, I'm going to have to wipe the server (plan to offload a few .conf and mail config files, firewall script and leave /var/www - should that be safe?) and will probably load RH7.3 and patches. Any comments on what happened, or on rebuilding? The hard drive is partitioned (a) / (b) /home (c) /var - and /home has only mail files. If I format (a) and delete some (which?) directories on /var, should I be ok? Would prefer not to rebuild the /var/www directories if possible. With ftp and ssh both down, my only way to offload is to floppies? Boy, I miss not having ssh access! Dick

2 1

RE: [Wlug] RH7.0 Hacked
by Marc Hughes Oct. 23, 2002

Oct. 23, 2002

You probably still have ftp or ssh access from that machine, so you can copy your data off of it onto another server. But I'd say your best bet is unplug it from the internet, copy off all your data (not programs!), wipe clean, and reinstall. You never know what kinds of rootkits were installed, and you can't rely on any system info to be accurate since some rootkits are rather advanced. Did you have SSL running without the recent (as in past month or so) patches? -Marc -----Original Message----- From: Richard Goodman [mailto:dick@goodman1.net] Sent: Wednesday, October 23, 2002 9:31 AM To: wlug(a)mail.wlug.org Subject: [Wlug] RH7.0 Hacked I have two RH7.0 and two RH7.3 servers ... it appears that between 5-6am Tuesday both the 7.0 servers were hacked - identically. They are on the same ISP and often their firewalls pick up the same scans and probes. I'm no expert, but this is what I think happened. The first clue was that I couldn't log in through ssh - got the message "The program does not understand the servers's version of the protocol" Looking at /var/log/secure I saw: 10/22 5:34 xinetd fail ftp libwrap from 195.157.17.177 then two fails from 127.0.0.1 I'm running an unpatched wu-ftpd (which I'm sure didn't help me) but the host.allow/deny were set to only allow ftp from the internal network and one specified outside IP# 10/22 5:48 (twice) xinetd start pop3 pid=10804 from 127.0.0.1 [not me-sleeping] 10/22 6:09 Listener created on port 22 Daemon is running Some poking around showed in /etc/ssh sshd (which should have been approx 200K was 2,621,812 and dated 10/22, so probably a trojan? ssh_host_key, ssh_host_key_pub, ssh_random_seed, sshd_config all had 10/22 modified dates My web server also was not running (or at least serving local pages) I accidently rebooted, the web server came back, but ssh did not. Later I attempted to delete and reinstall sshd. rpm said it couldn't uninstall because it wasn't there, and couldn't install because it was there. I think it finally installed with --force, and sshd was about 186K, but the symptoms were the same It turns out that ftp is also now not operational from the internal network. There is a message about xinetd/ftp in the startup, but its probably not important at this point After the reboot, ps -ax listed: 1811 D /sbin/modprobe -s -k block-major 7 [which I could not kill] Obviously, I'm going to have to wipe the server (plan to offload a few .conf and mail config files, firewall script and leave /var/www - should that be safe?) and will probably load RH7.3 and patches. Any comments on what happened, or on rebuilding? The hard drive is partitioned (a) / (b) /home (c) /var - and /home has only mail files. If I format (a) and delete some (which?) directories on /var, should I be ok? Would prefer not to rebuild the /var/www directories if possible. With ftp and ssh both down, my only way to offload is to floppies? Boy, I miss not having ssh access! Dick _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug

1 0

Re: [Wlug] Using iptables to MASQ the connection to the internet.
by Peter Gutowski Oct. 23, 2002

Oct. 23, 2002

Aramico, I've noticed, since you posts started appearing, that you seem to be asking for help on topics that are generally well-covered on the internet. But perhaps you are new enough to all this (as I was several years ago) that you don't realize that the purpose of forums like this is to add a level of enrichment to the research work that you've (hopefully) already done. It might be a better use of all of our time if you did some of that research yourself and came back with specific questions after having done so. The answer to the question you ask below specifically is answered quite well in HOWTOs that are readily available. I'll infer for a moment that your question is based on your sucessfull installation of RHL8.0 that you were asking about earlier. To find more information about any installed package do... rpm -q <package-name> -i So for your iptables question, I'd do this: rpm -q iptables -i Among the info listed here is a key to finding out how to use it: URL: : http://www.netfilter.org If you were to follow that link, you'll find plenty of answers to the exact question your pose. (Scroll to the bottom of the page and select NAT HOWTO. Look for "4.1 I just want masquerading! Help!" ) Also, most RPMs have a certain amout of enclosed documentation that will vary in its helpfulness. Do a rpm -q <package-name> -l | grep doc or substitute "info" or "man" for the "doc" above. Making an attempt to read those would also be a good first step to implementing new facilities on systems you are using. You might be pleasantly surprized about how many of these questions have been already anticipated *and* answered! Finally, doing a google search (http://www.google.com) might also surprize you pleasantly about locating these resources quickly. On 10/23/2002 12:23 AM, Aramico <aramico(a)duahati.com> wrote: >Hi all, > >Can you please tell me what is the sysntax of iptables to masquerade >my >network connection to the internet ? > >Basicly, I've only done this to masquerade my network connectionto >the >Internet, as default we can use the computer who masq the connection >as >gateway. >ipchains -A forward -s 0/0 -d 0/0 -j MASQ > >So, can you please tell me what is the syntax of iptables to produce >the >result as the command above...... ? > >Thanks ...... > > >_______________________________________________ >Wlug mailing list >Wlug(a)mail.wlug.org >http://mail.wlug.org/mailman/listinfo/wlug > >

1 0

debian pkgs
by brad Oct. 23, 2002

Oct. 23, 2002

Hi All, Do the debian users here know how to install a package into a prefix directory? For example i want my kde stuff to be installed in /usr/local/kde, not /usr. Is this possible with aptitude? Thanks, -brad

3 2

Can you trust your computer?
by Karl Hiramoto Oct. 23, 2002

Oct. 23, 2002

I went to see stallman at the book store last wednesday, and this is what he was talking about.... http://newsforge.com/newsforge/02/10/21/1449250.shtml?tid=19 -- ¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø Karl Hiramoto <karl(a)hiramoto.org> Work: 978-425-2090 ext 25 Cell: 508-517-4819 Personal web page: http://karl.hiramoto.org/ Zoop Productions: http://www.zoop.org/ KTEQ Rapid City: http://www.kteq.org/ AOL IM ID = KarlH420 Yahoo_IM = karl_hiramoto ¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø You'd like to do it instantaneously, but that's too slow.

1 0

DRM/TCPA/Palladium
by Karl Hiramoto Oct. 22, 2002

Oct. 22, 2002

http://www.cl.cam.ac.uk/users/rja14/tcpa-faq.html Thoughts? Should we boycot? -- ¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø Karl Hiramoto <karl(a)hiramoto.org> Work: 978-425-2090 ext 25 Cell: 508-517-4819 Personal web page: http://karl.hiramoto.org/ Zoop Productions: http://www.zoop.org/ KTEQ Rapid City: http://www.kteq.org/ AOL IM ID = KarlH420 Yahoo_IM = karl_hiramoto ¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø Only people with names beginning with 'A' are getting mail this week (a la Microsoft)

4 4

XFree86 SMP Woes
by Marc Hughes Oct. 21, 2002

Oct. 21, 2002

I just installed a second processor, installed an SMP kernel, and booted into it. At first, everything seemed great, I can do massive compiles, top shows both CPU's, and things go pretty zippy. BUT... I can't start X. This is what startx gives me: XFree86 Version 4.2.0 (Red Hat Linux release: 4.2.0-8) / X Window System (protocol Version 11, revision 0, vendor release 6600) Release Date: 23 January 2002 If the server is older than 6-12 months, or if your card is newer than the above date, look for a newer version before reporting problems. (See http://www.XFree86.Org/) Build Operating System: Linux 2.4.17-0.13smp i686 [ELF] Build Host: daffy.perf.redhat.com Module Loader present Markers: (--) probed, (**) from config file, (==) default setting, (++) from command line, (!!) notice, (II) informational, (WW) warning, (EE) error, (NI) not implemented, (??) unknown. (==) Log file: "/var/log/XFree86.0.log", Time: Mon Oct 21 19:23:34 2002 (==) Using config file: "/etc/X11/XF86Config-4" (EE) RADEON(0): [agp] Could not bind XIO: fatal IO error 104 (Connection reset by peer) on X server ":0.0" after 0 requests (0 known processed) with 0 events remaining. I'm guessing the whole not being able to bind the AGP is the really bad part. I booted into the single CPU kernel, and X still works fine there. Any ideas? -Marc

1 0

sendmail/RH8.0
by Bill Mills-Curran Oct. 21, 2002

Oct. 21, 2002

After upgrading to RedHat 8.0, I'm being forced to learn more about sendmail that I have time to invest, so I need some help. Previously, I had used linuxconf to set up Linux server at work (EMC) that would forward most email to the domain mail server -- I'm not trying to manage mail for the company. One twist... I want to define a few aliases. My linuxconf setup worked great -- I could send email to aliasname(a)thismachine.emc.com, and the /etc/alias file would be used to translate "aliasname" to a list of addresses. With the new split sendmail config, I'm floundering. I've made a few tweaks that were necessary to allow the machine to act as an internal relay (I need some security help here, too), but I'm still fighting a mail loop problem. So, here are my specific questions/requirements: 1. I want to send to an alias on "thismachine.emc.com" from anywhere inside emc. 2. I want the same aliases to be used for email originating from "thismachine". 3. I don't want to create a relay security hole. I'll send my sendmail.mc and submit.mc files upon request. TIA, Bill

1 0

linuxconf replacement?
by Bill Mills-Curran Oct. 21, 2002

Oct. 21, 2002

I've just upgraded to 8.0, and I find that linuxconf is no longer distributed. I was growing fairly fond of it, and I'm wondering what is the latest and greatest system management tool. I've seen "setup", and it's a bit lacking. I like linuxconf because: 1. It doesn't require the detailed (geek-level) knowledge that editing config files requires. 2. It works without a gui, which is very convenient for su-ing to root, or working through slower connections. So, what's the "best" system management tool these days? TIA, Bill

5 6

Re: [Wlug] t-shirts
by Peter Gutowski Oct. 21, 2002

Oct. 21, 2002

>thought the following two would amuse you guys: > >(1) #define QUESTION ((bb) || !(bb)) > There's a lot of truth in that. ;) -- Peter Gutowski <peter(a)linuxchamps.com> // tel.: (413) 531-0123 "When in company, put not your hands to any part of the body not usually discovered." --George Washington, _Rules for Civility and Decent Behavior_

1 0

t-shirts
by doug waud Oct. 21, 2002

Oct. 21, 2002

Hi all I got a catalog from Computergear.com which offered a variety of T-shirts with various incriptions. I thought the following two would amuse you guys: (1) #define QUESTION ((bb) || !(bb)) and (2) The box said "Requires Windows 98 or better" So I installed Linux. doug

1 0

Re: [Wlug] RH 7.0->7.3 upgrade
by Peter Gutowski Oct. 21, 2002

Oct. 21, 2002

I'd suggest that you consider upgrading to 8.0. I've been very impressed with the changes in 8.0 primarily in the area of user interface. I've experienced problems with RHL upgrades in the past. But I believe the bulk of those problems owed to the fact that I was attempting to upgrade where the disk setup was just too "tight". Perhaps in contrast to to 7.0, both 7.3 and 8.0 put a lot of files into /usr/share. You'll may make things easier for yourself if /usr/share is on its own partition. Aside from the be prepared for a general tightening of security. If you use sendmail, you'll probably have to add a "sendmail: ALL" into /etc/hosts.allow as the default is to only do mail handling from localhost. RHL 8.0 uses apache 2.x whereas RHL7.3 still uses the 1.3.x versions. Having installations on hard disks with enough hard drive space has made both upgrades, 7.3 and 8.0, pretty painless. As Charles Anderson ;) may likely suggest to you, be sure to read (and digest) the README files on the install disks... probably before you start to alleviate too many surprizes. (Foolish boy that I was, I *didn't*. And to my embarassment, he [rightfully] rubbed my nose in it. But, hey, I learned my lesson.) FYI, this may not be totally meaningful without know how much and just what exactly in installed. But, that said, I'd characterize my installation as medium -- neither slim nor fat. Here's some pertinent partition usages: Filesystem 1K Blocks Used Available % Mounted on /dev/hda3 497861 80662 391495 18% / /dev/hda1 31079 6419 23056 22% /boot /dev/hda11 2063504 98612 1860072 6% /home /dev/hda7 2063504 1209760 748924 62% /usr /dev/hda9 521748 113052 382192 23% /usr/local /dev/hda8 2063504 729108 1229576 38% /usr/share /dev/hda10 521748 154348 340896 32% /usr/src /dev/hda5 497829 76114 396013 17% /var -PG On 10/18/2002 9:53 AM, Richard Goodman <dick(a)goodman1.net> wrote: >I have four RH servers, two 7.0 and two new 7.3 servers just put up >last 6 >weeks or less >How painless would an upgrade of the older servers from 7.0->7.3 >be? Any >surprises I should know about? Any comments or advice? I've never >done a >version upgrade before. > >I already have a CD with the most important security upgrades I used >on the >7.3 servers after I had worm (Slapper/Cinik) problems. > >Dick > > Richard Goodman dick(a)goodman1.net > > > > >_______________________________________________ >Wlug mailing list >Wlug(a)mail.wlug.org >http://mail.wlug.org/mailman/listinfo/wlug > >

6 7

OS X Firewall? (#2)
by Richard Goodman Oct. 21, 2002

Oct. 21, 2002

>I would run a packet sniffer (ethereal, tcpdump, etc) on the Linux box >and see what the iBook is putting out BTW the iBook is running 10.2 (brand new) Could not check the ipfw list as it appears that we don't currently have administrator privileges on the iBook. checking the preferences/sharing/firewall showed the firewall off, however I was concerned about the following entries from the iBook's /var/msg/system.log: IP packet filtering initialized, divert enabled, rule-based forwarding enabled, default to accept, logging disabled IP firewall loaded arplookup <IP of my linux box> failed: host is not on localnetwork I have never run a packet sniffer before, so cannot interpret it, but I fired up tcpdump and did a) ping yahoo.com b) attempt to load yahoo.com in IE5 and got the following two dumps (assume I've snipped enough) tcpdump host 192.168.1.49 Kernel filter, protocol ALL, datagram packet socket tcpdump: listening on all devices 15:55:16.232303 eth1 < host49.goodman1.net.49174 > bach.goodman1.net.domain: 49847+ A? yahoo.com. (2 7) 15:55:16.373034 eth1 > bach.goodman1.net.domain > host49.goodman1.net.49174: 49847* 2/5/5 A w1.rc.vi p.dcx.yahoo.com, A w1.rc.vip.scd.yahoo.com (229) 15:55:16.476477 eth1 < host49.goodman1.net > w1.rc.vip.dcx.yahoo.com: icmp: echo request 15:55:17.476548 eth1 < host49.goodman1.net > w1.rc.vip.dcx.yahoo.com: icmp: echo request 15:55:18.476633 eth1 < host49.goodman1.net > w1.rc.vip.dcx.yahoo.com: icmp: echo request 15:55:19.476745 eth1 < host49.goodman1.net > w1.rc.vip.dcx.yahoo.com: icmp: echo request 15:55:20.476828 eth1 < host49.goodman1.net > w1.rc.vip.dcx.yahoo.com: icmp: echo request 15:55:21.476890 eth1 < host49.goodman1.net > w1.rc.vip.dcx.yahoo.com: icmp: echo request 15:55:22.476949 eth1 < host49.goodman1.net > w1.rc.vip.dcx.yahoo.com: icmp: echo request 15:55:23.477008 eth1 < host49.goodman1.net > w1.rc.vip.dcx.yahoo.com: icmp: echo request 15:55:24.477084 eth1 < host49.goodman1.net > w1.rc.vip.dcx.yahoo.com: icmp: echo request <<continued similarly many more lines> tcpdump host 192.168.1.49 Kernel filter, protocol ALL, datagram packet socket tcpdump: listening on all devices 16:01:00.340200 eth1 < host49.goodman1.net.49174 > bach.goodman1.net.domain: 45963+ A? www.yahoo.com . (31) 16:01:00.558192 eth1 > bach.goodman1.net.domain > host49.goodman1.net.49174: 45963 13/10/3 CNAME www .yahoo.akadns.net., A www9.dcx.yahoo.com, A w9.dcx.yahoo.com, (504) 16:01:00.563859 eth1 < host49.goodman1.net.49153 > www9.dcx.yahoo.com.www: S 1383754426:1383754426(0 ) win 32768 <mss 1460,nop,wscale 0,nop,nop,timestamp 8687 0> (DF) 16:01:01.247337 eth1 < host49.goodman1.net.49153 > w9.dcx.yahoo.com.www: S 2642071908:2642071908(0) win 32768 <mss 1460,nop,wscale 0,nop,nop,timestamp 8688 0> (DF) 16:01:01.962006 eth1 < host49.goodman1.net.49153 > w3.dcx.yahoo.com.www: S 3424625619:3424625619(0) win 32768 <mss 1460,nop,wscale 0,nop,nop,timestamp 8689 0> (DF) 16:01:02.719348 eth1 < host49.goodman1.net.49153 > www10.dcx.yahoo.com.www: S 715459341:715459341(0) win 32768 <mss 1460,nop,wscale 0,nop,nop,timestamp 8691 0> (DF) 16:01:03.433706 eth1 < host49.goodman1.net.49153 > w2.dcx.yahoo.com.www: S 3613744425:3613744425(0) win 32768 <mss 1460,nop,wscale 0,nop,nop,timestamp 8692 0> (DF) 16:01:04.115338 eth1 < host49.goodman1.net.49153 > w6.dcx.yahoo.com.www: S 941366980:941366980(0) wi n 32768 <mss 1460,nop,wscale 0,nop,nop,timestamp 8694 0> (DF) 16:01:04.796809 eth1 < host49.goodman1.net.49153 > w8.dcx.yahoo.com.www: S 1223626321:1223626321(0) win 32768 <mss 1460,nop,wscale 0,nop,nop,timestamp 8695 0> (DF) 16:01:05.480085 eth1 < host49.goodman1.net.49153 > w1.dcx.yahoo.com.www: S 1755119059:1755119059(0) win 32768 <mss 1460,nop,wscale 0,nop,nop,timestamp 8696 0> (DF) 16:01:05.550034 eth1 > arp who-has host49.goodman1.net tell localhost.localdomain (0:80:19:35:ad:39) 16:01:05.550329 eth1 < arp reply host49.goodman1.net is-at 0:3:93:c5:39:7c (0:80:19:35:ad:39) 16:01:06.163479 eth1 < host49.goodman1.net.49153 > www7.dcx.yahoo.com.www: S 2895506991:2895506991(0 ) win 32768 <mss 1460,nop,wscale 0,nop,nop,timestamp 8698 0> (DF) 16:01:06.846666 eth1 < host49.goodman1.net.49153 > www8.dcx.yahoo.com.www: S 3434260281:3434260281(0 ) win 32768 <mss 1460,nop,wscale 0,nop,nop,timestamp 8699 0> (DF) 16:01:07.529897 eth1 < host49.goodman1.net.49155 > www9.dcx.yahoo.com.www: S 2654995975:2654995975(0 ) win 32768 <mss 1460,nop,wscale 0,nop,nop,timestamp 8701 0> (DF) 16:01:09.379617 eth1 < host49.goodman1.net.49155 > w9.dcx.yahoo.com.www: S 607986242:607986242(0) wi n 32768 <mss 1460,nop,wscale 0,nop,nop,timestamp 8704 0> (DF) 16:01:11.231084 eth1 < host49.goodman1.net.49155 > w3.dcx.yahoo.com.www: S 1683897864:1683897864(0) win 32768 <mss 1460,nop,wscale 0,nop,nop,timestamp 8708 0> (DF) 16:01:13.079138 eth1 < host49.goodman1.net.49155 > www10.dcx.yahoo.com.www: S 3195269927:3195269927( 0) win 32768 <mss 1460,nop,wscale 0,nop,nop,timestamp 8712 0> (DF) 16:01:14.929941 eth1 < host49.goodman1.net.49155 > w2.dcx.yahoo.com.www: S 1831211410:1831211410(0) win 32768 <mss 1460,nop,wscale 0,nop,nop,timestamp 8715 0> (DF) 16:01:16.778674 eth1 < host49.goodman1.net.49155 > w6.dcx.yahoo.com.www: S 3961536773:3961536773(0) win 32768 <mss 1460,nop,wscale 0,nop,nop,timestamp 8719 0> (DF) 16:01:18.628462 eth1 < host49.goodman1.net.49155 > w8.dcx.yahoo.com.www: S 4286238440:4286238440(0) win 32768 <mss 1460,nop,wscale 0,nop,nop,timestamp 8723 0> (DF) Does this provide enough information? Dick

4 3

OS X firewall ?
by Richard Goodman Oct. 20, 2002

Oct. 20, 2002

I put the question to the list because I think its related enough to be of interest. My wife just got a top-of-the-line iBook with OS X from school. Connects to the network at school instantly as it should. (I am brand new on OS X) At home I run an network based on a RH7.0 box with IpMasq and some servers going to a static-IP DSL line. About 10 machines, mixed Win and Mac, mixed static and DHCP. When she starts up the iBook: a) the DHCP server on the Linux box shows the normal DHCPREQUEST and DHCPACK lines. b) the Network panel on the iBook shows all the values I would expect to have been handed off by DHCP, 192.168.1.x IP, 255.255.255.0 mask, 192.168.1.1 gateway c) but unable to connect to the internet I found "Terminal" and was able to: d) ping the linux box e) do a nslookup against the name server on the linux box, resolving outside domain names f) bring up web pages running on the Apache server on the linux box But I don't seem to be able to get outside I thought the first thing to try would be to disable the IP Firewall that's being started on the iBook, but haven't been able to figure out how (or where its files are). BTW I run a fairly strict firewall on the linux box and the log shows no hits related to the iBook attempting to get outside. Or I could be totally off base, in which case I would be open to other avenues towards fixing this. Less related: There is an Apple Select 360 appletalk laserwriter on the network, connected thru an Asante appletalk/ethernet bridge which my wife has used with her G3. She can select it through the chooser on the iBook, and we can read and set printer config info, but although everything appears normal when printing for an application in OS9 classic, nothing gets to the printer (and no blinking green light indicating data transfer). Dick

2 1

Re: [Wlug] RH 7.0->7.3 upgrade
by Peter Gutowski Oct. 18, 2002

Oct. 18, 2002

On 10/18/2002 1:23 PM, Wes Allen <wallen(a)charter.net> wrote: >On Friday 18 October 2002 11:03, Peter Gutowski wrote: >> I'd suggest that you consider upgrading to 8.0. I've been very >>impressed with the........ ...snip... >Is the php module ready for 2.x? I've been thinking about giving >RH 8.0 a try >to see if I can make use of my usb ports! RHL8.0 includes PHP 4.2.2, plus various modules (libphp4.so for apache, imap, mysql, etc....) You might need to rework portions of the /etc/php.ini file, but it seems to be a straight shot. -PG

2 1

RH 7.0->7.3 upgrade
by Richard Goodman Oct. 18, 2002

Oct. 18, 2002

I have four RH servers, two 7.0 and two new 7.3 servers just put up last 6 weeks or less How painless would an upgrade of the older servers from 7.0->7.3 be? Any surprises I should know about? Any comments or advice? I've never done a version upgrade before. I already have a CD with the most important security upgrades I used on the 7.3 servers after I had worm (Slapper/Cinik) problems. Dick Richard Goodman dick(a)goodman1.net

3 2

Re: duplicate entry in mdstat with RAID-5
by Neil Brown Oct. 18, 2002

Oct. 18, 2002

On Thursday October 17, karl(a)mail.accusense.com wrote: > > Can someone please help me fix this problem? I don't know if my data is > safe at the moment. > > > I have double entries for hde1 and hde in /proc/mdstat. The problem arose > when i did a raidhotadd for /dev/hde then again for /dev/hde1. Doh. Is > this a problem? How do i fix it? I would like to be using hde1, hdf1, > hdc1 > > The problem arose when the 60GB /dev/hde failed. I replaced it with an > 80GB drive. > > I am running redhat 7.2 with their kernel 2.4.9-31 > > > # cat /proc/mdstat > Personalities : [raid5] > read_ahead 1024 sectors > md0 : active raid5 hde1[3] hde[2] hdf1[1] hdc1[0] > 120102912 blocks level 5, 64k chunk, algorithm 0 [3/3] [UUU] > > unused devices: <none> So the raid is made of hdc1 hdf1 hde, with hde1 as a hot spare.. Not what you want. raidhotremove /dev/md0 /dev/hde1 raidsetfaulty /dev/md0 /dev/hde raidhotremove /dev/md0 /dev/hde Repartition hde correctly, the partition table will have been corrupted. raidhotadd /dev/md0 /dev/hde1 and don't make a typo this time :-) NeilBrown > > ---- > # fdisk -l /dev/hde > > Disk /dev/hde: 16 heads, 63 sectors, 155061 cylinders > Units = cylinders of 1008 * 512 bytes > > Disk /dev/hde doesn't contain a valid partition table > ----- > > # fdisk -l /dev/hdc > Disk /dev/hdc: 16 heads, 63 sectors, 119150 cylinders > Units = cylinders of 1008 * 512 bytes > > Device Boot Start End Blocks Id System > /dev/hdc1 * 1 119150 60051568+ fd Linux raid autodetect > > ---- > # fdisk -l /dev/hdf > Disk /dev/hdf: 16 heads, 63 sectors, 119150 cylinders > Units = cylinders of 1008 * 512 bytes > > Device Boot Start End Blocks Id System > /dev/hdf1 1 119150 60051568+ fd Linux raid autodetect > > > -- > /var/log/messages file > when i tried to remove /dev/hde with raidhotremove > > > Oct 17 22:17:15 data kernel: md: trying to remove hde from md0 ... > Oct 17 22:17:15 data kernel: md: bug in file md.c, line 2344 > Oct 17 22:17:15 data kernel: > Oct 17 22:17:15 data kernel: md:^I********************************** > Oct 17 22:17:15 data kernel: md:^I* <COMPLETE RAID STATE PRINTOUT> * > Oct 17 22:17:15 data kernel: md:^I********************************** > Oct 17 22:17:15 data kernel: md0: <hde1><hde><hdf1><hdc1> array > superblock: > Oct 17 22:17:15 data kernel: md: SB: (V:0.90.0) > ID:<a595074f.25e94a64.bec4b48a.e946a7b6> CT:3bdeb7e7 > Oct 17 22:17:15 data kernel: md: L5 S60051456 ND:4 RD:3 md0 LO:0 > CS:65536 > Oct 17 22:17:15 data kernel: md: UT:3daf6d69 ST:0 AD:3 WD:4 FD:0 SD:1 > CSUM:99d87466 E:0000009c > Oct 17 22:17:15 data kernel: D 0: DISK<N:0,hdc1(22,1),R:0,S:6> > Oct 17 22:17:15 data kernel: D 1: DISK<N:1,hdf1(33,65),R:1,S:6> > Oct 17 22:17:15 data kernel: D 2: DISK<N:2,hde(33,0),R:2,S:6> > Oct 17 22:17:15 data kernel: D 3: DISK<N:3,hde1(33,1),R:3,S:0> > Oct 17 22:17:15 data kernel: md: THIS: DISK<N:3,hde1(33,1),R:3,S:0> > Oct 17 22:17:15 data kernel: md: rdev hde1: O:hde1, SZ:60051456 F:0 DN:3 > md: rdev superblock: > Oct 17 22:17:15 data kernel: md: SB: (V:0.90.0) > ID:<a595074f.25e94a64.bec4b48a.e946a7b6> CT:3bdeb7e7 > Oct 17 22:17:15 data kernel: md: L5 S60051456 ND:4 RD:3 md0 LO:0 > CS:65536 > Oct 17 22:17:15 data kernel: md: UT:3daf6d69 ST:0 AD:3 WD:4 FD:0 SD:1 > CSUM:99d874aa E:0000009c > Oct 17 22:17:15 data kernel: D 0: DISK<N:0,hdc1(22,1),R:0,S:6> > Oct 17 22:17:15 data kernel: D 1: DISK<N:1,hdf1(33,65),R:1,S:6> > Oct 17 22:17:15 data kernel: D 2: DISK<N:2,hde(33,0),R:2,S:6> > Oct 17 22:17:15 data kernel: D 3: DISK<N:3,hde1(33,1),R:3,S:0> > Oct 17 22:17:15 data kernel: md: THIS: DISK<N:3,hde1(33,1),R:3,S:0> > Oct 17 22:17:15 data kernel: md: rdev hde: O:hde, SZ:78150656 F:0 DN:2 md: > rdev superblock: > Oct 17 22:17:15 data kernel: md: SB: (V:0.90.0) > ID:<a595074f.25e94a64.bec4b48a.e946a7b6> CT:3bdeb7e7 > Oct 17 22:17:15 data kernel: md: L5 S60051456 ND:4 RD:3 md0 LO:0 > CS:65536 > Oct 17 22:17:15 data kernel: md: UT:3daf6d69 ST:0 AD:3 WD:4 FD:0 SD:1 > CSUM:99d874ad E:0000009c > > Oct 17 22:17:15 data kernel: D 0: DISK<N:0,hdc1(22,1),R:0,S:6> > Oct 17 22:17:15 data kernel: D 1: DISK<N:1,hdf1(33,65),R:1,S:6> > Oct 17 22:17:15 data kernel: D 2: DISK<N:2,hde(33,0),R:2,S:6> > Oct 17 22:17:15 data kernel: D 3: DISK<N:3,hde1(33,1),R:3,S:0> > Oct 17 22:17:15 data kernel: md: THIS: DISK<N:2,hde(33,0),R:2,S:6> > Oct 17 22:17:15 data kernel: md: rdev hdf1: O:hdf1, SZ:60051456 F:0 DN:1 > md: rdev superblock: > Oct 17 22:17:15 data kernel: md: SB: (V:0.90.0) > ID:<a595074f.25e94a64.bec4b48a.e946a7b6> CT:3bdeb7e7 > Oct 17 22:17:15 data kernel: md: L5 S60051456 ND:4 RD:3 md0 LO:0 > CS:65536 > Oct 17 22:17:15 data kernel: md: UT:3daf6d69 ST:0 AD:3 WD:4 FD:0 SD:1 > CSUM:99d874ec E:0000009c > Oct 17 22:17:15 data kernel: D 0: DISK<N:0,hdc1(22,1),R:0,S:6> > Oct 17 22:17:15 data kernel: D 1: DISK<N:1,hdf1(33,65),R:1,S:6> > Oct 17 22:17:15 data kernel: D 2: DISK<N:2,hde(33,0),R:2,S:6> > Oct 17 22:17:15 data kernel: D 3: DISK<N:3,hde1(33,1),R:3,S:0> > Oct 17 22:17:15 data kernel: md: THIS: DISK<N:1,hdf1(33,65),R:1,S:6> > Oct 17 22:17:15 data kernel: md: rdev hdc1: O:hdc1, SZ:60051456 F:0 DN:0 > md: rdev superblock: > Oct 17 22:17:15 data kernel: md: SB: (V:0.90.0) > ID:<a595074f.25e94a64.bec4b48a.e946a7b6> CT:3bdeb7e7 > Oct 17 22:17:15 data kernel: md: L5 S60051456 ND:4 RD:3 md0 LO:0 > CS:65536 > Oct 17 22:17:15 data kernel: md: UT:3daf6d69 ST:0 AD:3 WD:4 FD:0 SD:1 > CSUM:99d8749f E:0000009c > Oct 17 22:17:15 data kernel: D 0: DISK<N:0,hdc1(22,1),R:0,S:6> > Oct 17 22:17:15 data kernel: D 1: DISK<N:1,hdf1(33,65),R:1,S:6> > Oct 17 22:17:15 data kernel: D 2: DISK<N:2,hde(33,0),R:2,S:6> > Oct 17 22:17:15 data kernel: D 3: DISK<N:3,hde1(33,1),R:3,S:0> > Oct 17 22:17:15 data kernel: md: THIS: DISK<N:0,hdc1(22,1),R:0,S:6> > Oct 17 22:17:15 data kernel: md:^I********************************** > Oct 17 22:17:15 data kernel: > Oct 17 22:17:15 data kernel: md: cannot remove active disk hde from md0 > ... > Oct 17 22:23:11 data kernel: md: interrupting MD-thread pid 130 > Oct 17 22:23:11 data kernel: md: raid5d(130) flushing signals. > Oct 17 22:23:11 data kernel: md: marking sb clean... > Oct 17 22:23:11 data kernel: md: updating md0 RAID superblock on device > Oct 17 22:23:11 data kernel: md: hde1 [events: 0000009d](write) hde1's sb > offset: 60051456 > Oct 17 22:23:11 data kernel: md: hde [events: 0000009d](write) hde's sb > offset: 78150656 > Oct 17 22:23:11 data kernel: md: hdf1 [events: 0000009d](write) hdf1's sb > offset: 60051456 > Oct 17 22:23:11 data kernel: md: hdc1 [events: 0000009d](write) hdc1's sb > offset: 60051456 > Oct 17 22:23:11 data kernel: md: md0 stopped. > Oct 17 22:23:11 data kernel: md: unbind<hde1,3> > Oct 17 22:23:11 data kernel: md: export_rdev(hde1) > Oct 17 22:23:11 data kernel: md: unbind<hde,2> > Oct 17 22:23:11 data kernel: md: export_rdev(hde) > Oct 17 22:23:11 data kernel: md: unbind<hdf1,1> > Oct 17 22:23:11 data kernel: md: export_rdev(hdf1) > Oct 17 22:23:11 data kernel: md: unbind<hdc1,0> > Oct 17 22:23:11 data kernel: md: export_rdev(hdc1) > Oct 17 22:28:12 data dhcpd: DHCPREQUEST for 192.168.2.113 from > 00:50:fc:21:77:64 via eth0 > Oct 17 22:29:48 data kernel: (read) hdc1's sb offset: 60051456 [events: > 0000009d] > Oct 17 22:29:48 data kernel: (read) hdf1's sb offset: 60051456 [events: > 0000009d] > Oct 17 22:29:48 data kernel: (read) hde's sb offset: 78150656 [events: > 0000009d] > Oct 17 22:29:49 data kernel: (read) hde1's sb offset: 60051456 [events: > 0000009d] > Oct 17 22:29:49 data kernel: md: autorun ... > Oct 17 22:29:49 data kernel: md: considering hde1 ... > Oct 17 22:29:49 data kernel: md: adding hde1 ... > Oct 17 22:29:49 data kernel: md: adding hde ... > Oct 17 22:29:49 data kernel: md: adding hdf1 ... > Oct 17 22:29:49 data kernel: md: adding hdc1 ... > Oct 17 22:29:49 data kernel: md: created md0 > Oct 17 22:29:49 data kernel: md: bind<hdc1,1> > Oct 17 22:29:49 data kernel: md: bind<hdf1,2> > Oct 17 22:29:49 data kernel: md: bind<hde,3> > Oct 17 22:29:49 data kernel: md0: WARNING: hde1 appears to be on the same > physical disk as hde. True > Oct 17 22:29:49 data kernel: protection against single-disk failure > might be compromised. > Oct 17 22:29:49 data kernel: md: bind<hde1,4> > Oct 17 22:29:49 data kernel: md: running: <hde1><hde><hdf1><hdc1> > Oct 17 22:29:49 data kernel: md: hde1's event counter: 0000009d > Oct 17 22:29:49 data kernel: md: hde's event counter: 0000009d > Oct 17 22:29:49 data kernel: md: hdf1's event counter: 0000009d > Oct 17 22:29:49 data kernel: md: hdc1's event counter: 0000009d > Oct 17 22:29:49 data kernel: md0: max total readahead window set to 512k > Oct 17 22:29:49 data kernel: md0: 2 data-disks, max readahead per > data-disk: 256k > Oct 17 22:29:49 data kernel: raid5: spare disk hde1 > Oct 17 22:29:49 data kernel: raid5: device hde operational as raid disk 2 > Oct 17 22:29:49 data kernel: raid5: device hdf1 operational as raid disk 1 > Oct 17 22:29:49 data kernel: raid5: device hdc1 operational as raid disk 0 > Oct 17 22:29:49 data kernel: raid5: allocated 3291kB for md0 > Oct 17 22:29:49 data kernel: raid5: raid level 5 set md0 active with 3 out > of 3 devices, algorithm 0 > Oct 17 22:29:49 data kernel: RAID5 conf printout: > Oct 17 22:29:49 data kernel: --- rd:3 wd:3 fd:0 > Oct 17 22:29:49 data kernel: disk 0, s:0, o:1, n:0 rd:0 us:1 dev:hdc1 > Oct 17 22:29:49 data kernel: disk 1, s:0, o:1, n:1 rd:1 us:1 dev:hdf1 > Oct 17 22:29:49 data kernel: disk 2, s:0, o:1, n:2 rd:2 us:1 dev:hde > Oct 17 22:29:49 data kernel: RAID5 conf printout: > Oct 17 22:29:49 data kernel: --- rd:3 wd:3 fd:0 > Oct 17 22:29:49 data kernel: disk 0, s:0, o:1, n:0 rd:0 us:1 dev:hdc1 > Oct 17 22:29:49 data kernel: disk 1, s:0, o:1, n:1 rd:1 us:1 dev:hdf1 > Oct 17 22:29:49 data kernel: disk 2, s:0, o:1, n:2 rd:2 us:1 dev:hde > Oct 17 22:29:49 data kernel: md: updating md0 RAID superblock on device > Oct 17 22:29:49 data kernel: md: hde1 [events: 0000009e](write) hde1's sb > offset: 60051456 > Oct 17 22:29:49 data kernel: md: hde [events: 0000009e](write) hde's sb > offset: 78150656 > Oct 17 22:29:49 data kernel: md: hdf1 [events: 0000009e](write) hdf1's sb > offset: 60051456 > Oct 17 22:29:49 data kernel: md: hdc1 [events: 0000009e](write) hdc1's sb > offset: 60051456 > Oct 17 22:29:49 data kernel: md: ... autorun DONE. > > > > > > Thanks, > > > -------------------------------------------------------------------- > Karl Hiramoto - Design Engineer > Cambridge Accusense > www.accusense.com > Tel: 978-425-2090 > Toll Free in US: 1-800-313-9271 > Fax: 978-425-4062 > > - > To unsubscribe from this list: send the line "unsubscribe linux-raid" in > the body of a message to majordomo(a)vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html

1 0

duplicate entry in mdstat with RAID-5 (fwd)
by Karl Hiramoto Oct. 18, 2002

Oct. 18, 2002

Can someone please help me fix this problem? I don't know if my data is safe at the moment. I have double entries for hde1 and hde in /proc/mdstat. The problem arose when i did a raidhotadd for /dev/hde then again for /dev/hde1. Doh. Is this a problem? How do i fix it? I would like to be using hde1, hdf1, hdc1 The problem arose when the 60GB /dev/hde failed. I replaced it with an 80GB drive. I am running redhat 7.2 with their kernel 2.4.9-31 # cat /proc/mdstat Personalities : [raid5] read_ahead 1024 sectors md0 : active raid5 hde1[3] hde[2] hdf1[1] hdc1[0] 120102912 blocks level 5, 64k chunk, algorithm 0 [3/3] [UUU] unused devices: <none> ---- # fdisk -l /dev/hde Disk /dev/hde: 16 heads, 63 sectors, 155061 cylinders Units = cylinders of 1008 * 512 bytes Disk /dev/hde doesn't contain a valid partition table ----- # fdisk -l /dev/hdc Disk /dev/hdc: 16 heads, 63 sectors, 119150 cylinders Units = cylinders of 1008 * 512 bytes Device Boot Start End Blocks Id System /dev/hdc1 * 1 119150 60051568+ fd Linux raid autodetect ---- # fdisk -l /dev/hdf Disk /dev/hdf: 16 heads, 63 sectors, 119150 cylinders Units = cylinders of 1008 * 512 bytes Device Boot Start End Blocks Id System /dev/hdf1 1 119150 60051568+ fd Linux raid autodetect -- /var/log/messages file when i tried to remove /dev/hde with raidhotremove Oct 17 22:17:15 data kernel: md: trying to remove hde from md0 ... Oct 17 22:17:15 data kernel: md: bug in file md.c, line 2344 Oct 17 22:17:15 data kernel: Oct 17 22:17:15 data kernel: md:^I********************************** Oct 17 22:17:15 data kernel: md:^I* <COMPLETE RAID STATE PRINTOUT> * Oct 17 22:17:15 data kernel: md:^I********************************** Oct 17 22:17:15 data kernel: md0: <hde1><hde><hdf1><hdc1> array superblock: Oct 17 22:17:15 data kernel: md: SB: (V:0.90.0) ID:<a595074f.25e94a64.bec4b48a.e946a7b6> CT:3bdeb7e7 Oct 17 22:17:15 data kernel: md: L5 S60051456 ND:4 RD:3 md0 LO:0 CS:65536 Oct 17 22:17:15 data kernel: md: UT:3daf6d69 ST:0 AD:3 WD:4 FD:0 SD:1 CSUM:99d87466 E:0000009c Oct 17 22:17:15 data kernel: D 0: DISK<N:0,hdc1(22,1),R:0,S:6> Oct 17 22:17:15 data kernel: D 1: DISK<N:1,hdf1(33,65),R:1,S:6> Oct 17 22:17:15 data kernel: D 2: DISK<N:2,hde(33,0),R:2,S:6> Oct 17 22:17:15 data kernel: D 3: DISK<N:3,hde1(33,1),R:3,S:0> Oct 17 22:17:15 data kernel: md: THIS: DISK<N:3,hde1(33,1),R:3,S:0> Oct 17 22:17:15 data kernel: md: rdev hde1: O:hde1, SZ:60051456 F:0 DN:3 md: rdev superblock: Oct 17 22:17:15 data kernel: md: SB: (V:0.90.0) ID:<a595074f.25e94a64.bec4b48a.e946a7b6> CT:3bdeb7e7 Oct 17 22:17:15 data kernel: md: L5 S60051456 ND:4 RD:3 md0 LO:0 CS:65536 Oct 17 22:17:15 data kernel: md: UT:3daf6d69 ST:0 AD:3 WD:4 FD:0 SD:1 CSUM:99d874aa E:0000009c Oct 17 22:17:15 data kernel: D 0: DISK<N:0,hdc1(22,1),R:0,S:6> Oct 17 22:17:15 data kernel: D 1: DISK<N:1,hdf1(33,65),R:1,S:6> Oct 17 22:17:15 data kernel: D 2: DISK<N:2,hde(33,0),R:2,S:6> Oct 17 22:17:15 data kernel: D 3: DISK<N:3,hde1(33,1),R:3,S:0> Oct 17 22:17:15 data kernel: md: THIS: DISK<N:3,hde1(33,1),R:3,S:0> Oct 17 22:17:15 data kernel: md: rdev hde: O:hde, SZ:78150656 F:0 DN:2 md: rdev superblock: Oct 17 22:17:15 data kernel: md: SB: (V:0.90.0) ID:<a595074f.25e94a64.bec4b48a.e946a7b6> CT:3bdeb7e7 Oct 17 22:17:15 data kernel: md: L5 S60051456 ND:4 RD:3 md0 LO:0 CS:65536 Oct 17 22:17:15 data kernel: md: UT:3daf6d69 ST:0 AD:3 WD:4 FD:0 SD:1 CSUM:99d874ad E:0000009c Oct 17 22:17:15 data kernel: D 0: DISK<N:0,hdc1(22,1),R:0,S:6> Oct 17 22:17:15 data kernel: D 1: DISK<N:1,hdf1(33,65),R:1,S:6> Oct 17 22:17:15 data kernel: D 2: DISK<N:2,hde(33,0),R:2,S:6> Oct 17 22:17:15 data kernel: D 3: DISK<N:3,hde1(33,1),R:3,S:0> Oct 17 22:17:15 data kernel: md: THIS: DISK<N:2,hde(33,0),R:2,S:6> Oct 17 22:17:15 data kernel: md: rdev hdf1: O:hdf1, SZ:60051456 F:0 DN:1 md: rdev superblock: Oct 17 22:17:15 data kernel: md: SB: (V:0.90.0) ID:<a595074f.25e94a64.bec4b48a.e946a7b6> CT:3bdeb7e7 Oct 17 22:17:15 data kernel: md: L5 S60051456 ND:4 RD:3 md0 LO:0 CS:65536 Oct 17 22:17:15 data kernel: md: UT:3daf6d69 ST:0 AD:3 WD:4 FD:0 SD:1 CSUM:99d874ec E:0000009c Oct 17 22:17:15 data kernel: D 0: DISK<N:0,hdc1(22,1),R:0,S:6> Oct 17 22:17:15 data kernel: D 1: DISK<N:1,hdf1(33,65),R:1,S:6> Oct 17 22:17:15 data kernel: D 2: DISK<N:2,hde(33,0),R:2,S:6> Oct 17 22:17:15 data kernel: D 3: DISK<N:3,hde1(33,1),R:3,S:0> Oct 17 22:17:15 data kernel: md: THIS: DISK<N:1,hdf1(33,65),R:1,S:6> Oct 17 22:17:15 data kernel: md: rdev hdc1: O:hdc1, SZ:60051456 F:0 DN:0 md: rdev superblock: Oct 17 22:17:15 data kernel: md: SB: (V:0.90.0) ID:<a595074f.25e94a64.bec4b48a.e946a7b6> CT:3bdeb7e7 Oct 17 22:17:15 data kernel: md: L5 S60051456 ND:4 RD:3 md0 LO:0 CS:65536 Oct 17 22:17:15 data kernel: md: UT:3daf6d69 ST:0 AD:3 WD:4 FD:0 SD:1 CSUM:99d8749f E:0000009c Oct 17 22:17:15 data kernel: D 0: DISK<N:0,hdc1(22,1),R:0,S:6> Oct 17 22:17:15 data kernel: D 1: DISK<N:1,hdf1(33,65),R:1,S:6> Oct 17 22:17:15 data kernel: D 2: DISK<N:2,hde(33,0),R:2,S:6> Oct 17 22:17:15 data kernel: D 3: DISK<N:3,hde1(33,1),R:3,S:0> Oct 17 22:17:15 data kernel: md: THIS: DISK<N:0,hdc1(22,1),R:0,S:6> Oct 17 22:17:15 data kernel: md:^I********************************** Oct 17 22:17:15 data kernel: Oct 17 22:17:15 data kernel: md: cannot remove active disk hde from md0 ... Oct 17 22:23:11 data kernel: md: interrupting MD-thread pid 130 Oct 17 22:23:11 data kernel: md: raid5d(130) flushing signals. Oct 17 22:23:11 data kernel: md: marking sb clean... Oct 17 22:23:11 data kernel: md: updating md0 RAID superblock on device Oct 17 22:23:11 data kernel: md: hde1 [events: 0000009d](write) hde1's sb offset: 60051456 Oct 17 22:23:11 data kernel: md: hde [events: 0000009d](write) hde's sb offset: 78150656 Oct 17 22:23:11 data kernel: md: hdf1 [events: 0000009d](write) hdf1's sb offset: 60051456 Oct 17 22:23:11 data kernel: md: hdc1 [events: 0000009d](write) hdc1's sb offset: 60051456 Oct 17 22:23:11 data kernel: md: md0 stopped. Oct 17 22:23:11 data kernel: md: unbind<hde1,3> Oct 17 22:23:11 data kernel: md: export_rdev(hde1) Oct 17 22:23:11 data kernel: md: unbind<hde,2> Oct 17 22:23:11 data kernel: md: export_rdev(hde) Oct 17 22:23:11 data kernel: md: unbind<hdf1,1> Oct 17 22:23:11 data kernel: md: export_rdev(hdf1) Oct 17 22:23:11 data kernel: md: unbind<hdc1,0> Oct 17 22:23:11 data kernel: md: export_rdev(hdc1) Oct 17 22:28:12 data dhcpd: DHCPREQUEST for 192.168.2.113 from 00:50:fc:21:77:64 via eth0 Oct 17 22:29:48 data kernel: (read) hdc1's sb offset: 60051456 [events: 0000009d] Oct 17 22:29:48 data kernel: (read) hdf1's sb offset: 60051456 [events: 0000009d] Oct 17 22:29:48 data kernel: (read) hde's sb offset: 78150656 [events: 0000009d] Oct 17 22:29:49 data kernel: (read) hde1's sb offset: 60051456 [events: 0000009d] Oct 17 22:29:49 data kernel: md: autorun ... Oct 17 22:29:49 data kernel: md: considering hde1 ... Oct 17 22:29:49 data kernel: md: adding hde1 ... Oct 17 22:29:49 data kernel: md: adding hde ... Oct 17 22:29:49 data kernel: md: adding hdf1 ... Oct 17 22:29:49 data kernel: md: adding hdc1 ... Oct 17 22:29:49 data kernel: md: created md0 Oct 17 22:29:49 data kernel: md: bind<hdc1,1> Oct 17 22:29:49 data kernel: md: bind<hdf1,2> Oct 17 22:29:49 data kernel: md: bind<hde,3> Oct 17 22:29:49 data kernel: md0: WARNING: hde1 appears to be on the same physical disk as hde. True Oct 17 22:29:49 data kernel: protection against single-disk failure might be compromised. Oct 17 22:29:49 data kernel: md: bind<hde1,4> Oct 17 22:29:49 data kernel: md: running: <hde1><hde><hdf1><hdc1> Oct 17 22:29:49 data kernel: md: hde1's event counter: 0000009d Oct 17 22:29:49 data kernel: md: hde's event counter: 0000009d Oct 17 22:29:49 data kernel: md: hdf1's event counter: 0000009d Oct 17 22:29:49 data kernel: md: hdc1's event counter: 0000009d Oct 17 22:29:49 data kernel: md0: max total readahead window set to 512k Oct 17 22:29:49 data kernel: md0: 2 data-disks, max readahead per data-disk: 256k Oct 17 22:29:49 data kernel: raid5: spare disk hde1 Oct 17 22:29:49 data kernel: raid5: device hde operational as raid disk 2 Oct 17 22:29:49 data kernel: raid5: device hdf1 operational as raid disk 1 Oct 17 22:29:49 data kernel: raid5: device hdc1 operational as raid disk 0 Oct 17 22:29:49 data kernel: raid5: allocated 3291kB for md0 Oct 17 22:29:49 data kernel: raid5: raid level 5 set md0 active with 3 out of 3 devices, algorithm 0 Oct 17 22:29:49 data kernel: RAID5 conf printout: Oct 17 22:29:49 data kernel: --- rd:3 wd:3 fd:0 Oct 17 22:29:49 data kernel: disk 0, s:0, o:1, n:0 rd:0 us:1 dev:hdc1 Oct 17 22:29:49 data kernel: disk 1, s:0, o:1, n:1 rd:1 us:1 dev:hdf1 Oct 17 22:29:49 data kernel: disk 2, s:0, o:1, n:2 rd:2 us:1 dev:hde Oct 17 22:29:49 data kernel: RAID5 conf printout: Oct 17 22:29:49 data kernel: --- rd:3 wd:3 fd:0 Oct 17 22:29:49 data kernel: disk 0, s:0, o:1, n:0 rd:0 us:1 dev:hdc1 Oct 17 22:29:49 data kernel: disk 1, s:0, o:1, n:1 rd:1 us:1 dev:hdf1 Oct 17 22:29:49 data kernel: disk 2, s:0, o:1, n:2 rd:2 us:1 dev:hde Oct 17 22:29:49 data kernel: md: updating md0 RAID superblock on device Oct 17 22:29:49 data kernel: md: hde1 [events: 0000009e](write) hde1's sb offset: 60051456 Oct 17 22:29:49 data kernel: md: hde [events: 0000009e](write) hde's sb offset: 78150656 Oct 17 22:29:49 data kernel: md: hdf1 [events: 0000009e](write) hdf1's sb offset: 60051456 Oct 17 22:29:49 data kernel: md: hdc1 [events: 0000009e](write) hdc1's sb offset: 60051456 Oct 17 22:29:49 data kernel: md: ... autorun DONE. Thanks, -------------------------------------------------------------------- Karl Hiramoto - Design Engineer Cambridge Accusense www.accusense.com Tel: 978-425-2090 Toll Free in US: 1-800-313-9271 Fax: 978-425-4062

1 0

usb 2.0 backward compatable? yes?
by Wesley Allen Oct. 16, 2002

Oct. 16, 2002

Hi gang, I did some research on whether or not usb 2.0 card (pci and pcmcia) would work with the 2.4 kernel. If I read right, the answer is yes, they will be seen as usb 1.0 and be able to use those drivers. Is this correct? Now, if I've got problem with my stupid bios not assigning a correct irq on my built-in usb controller, will this issue pan over to a pcmcia card as well? I've got no problem getting a new card for doing this, as I'd eventually want to have usb 2.0 devices come the 2.6 (3.0?) kernel anyway. I'd just be doing it sooner (and if mandrake figures out how to circumvent my bios, I'll have 4 or 6 ports! :-) ). Wes

2 2

RH 8
by Aramico Oct. 16, 2002

Oct. 16, 2002

Till now, i still get the problem in downloading RH 8 in several diffrent places. Can somebody tell me where can i download it ? All available sites are using identification's login for now.. ..while the other could not be touched using wget...... ;( Thanks!

3 2

Re: [Wlug] Old RAM (OT)
by Thomas Carey Oct. 14, 2002

Oct. 14, 2002

1 0

Old RAM (OT)
by Tim Trachimowicz Oct. 14, 2002

Oct. 14, 2002

Hey folks! Since you're probably the biggest group of people I know that might have unused hardware floating around, I figured I'd see if you guys can help me out. I'm searching for some RAM for an older PC I have. Specifically, it's 66mhz SDRAM for a Compaq Deskpro that I'm trying to turn into something useful. Anyways, I was wondeirng if any of you guys might have a DIMM or two flaoting around that's gathering dust (I'll pay you for it) or might know where I can find some on the cheap, before I hit up any of the big guys that I know have the RAM (but at a premium price). Thanks, Tim

2 1

Cinik worm (mod_ssl)
by Richard Goodman Oct. 13, 2002

Oct. 13, 2002

I have two rather new RH7.3 servers, which I installed without any patches (dumb- had never installed patches before). A couple of weeks ago both got infected with [different] strains of the Cinik (mod_ssl) worm. On machine "A" I shut down Apache for about a week, and left "B" running. On 10/5/02 I downloaded and installed RH patches for apache, bind, glibc, openssh, openssl, php and mod_ssl on both machines. I deleted the cinik stuff from /tmp. Machine "B" has been worm-free since. Cinik reappeared on machine "A" overnight last night -- process running and the usual suspect files back in /tmp. I happened to look in /var/log/cron (on the subject of cron I am rather clueless) and saw the following suspicious entries in the time frame when I believe the worm reappeared: Oct 13 05:20:00 archive3 CROND[25572]: (root) CMD (/usr/bin/mrtg /etc/mrtg/mrtg.cfg) Oct 13 05:20:00 archive3 CROND[25573]: (root) CMD (/usr/lib/sa/sa1 1 1) Oct 13 05:25:00 archive3 CROND[25577]: (root) CMD (/usr/bin/mrtg /etc/mrtg/mrtg.cfg) Oct 13 05:26:34 archive3 crontab[25622]: (apache) REPLACE (apache) Oct 13 05:27:00 archive3 crond[858]: (apache) RELOAD (cron/apache) Oct 13 05:27:29 archive3 crontab[25630]: (apache) REPLACE (apache) Oct 13 05:27:29 archive3 crontab[25635]: (apache) REPLACE (apache) Oct 13 05:27:29 archive3 crontab[25640]: (apache) REPLACE (apache) Oct 13 05:27:29 archive3 crontab[25645]: (apache) REPLACE (apache) Oct 13 05:28:01 archive3 crond[858]: (apache) RELOAD (cron/apache) Oct 13 05:30:00 archive3 CROND[25666]: (root) CMD (/usr/bin/mrtg /etc/mrtg/mrtg.cfg) Oct 13 05:30:00 archive3 CROND[25667]: (root) CMD (/usr/lib/sa/sa1 1 1) Oct 13 05:35:00 archive3 CROND[25670]: (root) CMD (/usr/bin/mrtg /etc/mrtg/mrtg.cfg) Any suggestions as to what the log entries mean (i.e. who did what to Apache?), and why cinik has reappeared? Also, can someone point me towards a resource about cron so that I may become less clueless? Thanks, Dick

2 1

Installfest Media...
by Keller, Tim Oct. 12, 2002

Oct. 12, 2002

So currently I've got ISO's for Redhat 7.3/8.0 and Mandrake 8.0 (disks 1 and 2, but not the 3rd internationalization disk) What other distributions would people like me to make some copies of? Also, I'm going to put together my obligatory Disk-o-everything. As a side note, I personally think it would be cool if we could have a repository of WLUG goodies, but I know there'd be some logistics around that. So far this is what's going to be on it. (unless otherwise noted, assume I'll be grabbing the latest) Office Stuff: OpenOffice Gimpprint Kernel Stuff: Latest Stable Kernel Sources Latest Unstable Kernel Sources (would like some input here) Sound Stuff: alsa free OSS drivers lame bladeenc cdparanoia grip ogg-vorbis ultramaster xmms xmms plugins Video: Nvidia Drivers (I'll grab everything, for every version they've got) (would like some input here) Video Tools: Cinelerra (and all the stuff that comes with it like Xmovie, etc) (input please!) Burning Tools: cdlabelgen cdrtools gcombust gtoaster xcdroast Browsers: Mozilla Phoenix Opera Netscape plugins video-players: xine mplayer libdvdcss region-changer (would like some input here) Games: Deluxe Xkobo Mame (help...)

4 3

rpm build error
by Bill Mills-Curran Oct. 11, 2002

Oct. 11, 2002

I just rebuilt apache from the RH 8.0 source rpm. The compilation succeeded, but the rpm failed with the following error message: Checking for unpackaged file(s): /usr/lib/rpm/check-files /home/bcurran/tmp/rpmBuild/httpd-root error: Installed (but unpackaged) file(s) found: /etc/httpd/conf/mime.types /usr/bin/apr-config /usr/bin/apu-config /usr/lib/APRVARS <snip-more files> RPM build errors: Installed (but unpackaged) file(s) found: /etc/httpd/conf/mime.types /usr/bin/apr-config /usr/bin/apu-config /usr/lib/APRVARS <snip-more files> Neither the modified source nor the binary rpm were generated. It looks like these files made it into the temporary install area just prior to generating the packages, and they should not have been there. Is there an option I should be using to make the install tree "right"? I know I can modify the spec file to wildcard include everything in the install directories, but that doesn't seem right. My command: "rpmbuild -ba httpd.spec". TIA, Bill

2 3