- WLUG - wlug.mailman3.com

Re: [Wlug] SSH problems

by Phillip Deneault

Alex Camilo wrote: > that sounds interesting. although it might not work too well at WPI. i > think the bester box would go nuts next time it randomly scanned my > computer for vulnerabilities. Yeah, please don't run honeypots. I get enough problems without people deliberately making new ones. Phil -- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Phil Deneault "We work in the dark. We do what we can. deneault(a)wpi.edu We give what we have. Network Security Officer Our doubt is our passion, Network Operations and our passion is our task. Worcester Polytechnic Institute The rest is the madness of art." http://www.wpi.edu/~deneault/ - Henry James -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Oct. 3, 2008

Re: [Wlug] SSH problems

by Alex Camilo

that sounds interesting. although it might not work too well at WPI. i think the bester box would go nuts next time it randomly scanned my computer for vulnerabilities. On Fri, Oct 3, 2008 at 3:22 AM, Jeff Kinz <jkinz(a)kinz.org> wrote: > Eric - one way to stop the attacks is to let them in.... > > Time for a honeypot! IIRC a very simple C program can keep these > guys occupied for hours.. > > Suggestion - move your ssh access port, and run THP > > Tiny Honeypot > Quote: > > Wouldn't it be nice if every single unsolicited connection > attempt tied up the attacker who launched it by appearing to > actually work, all the while providing a little insight into > their motives and intents? thp appears to listen on all ports > otherwise not in legitimate use, providing a series of phony > responses to attacker commands. Some are very simple, others are > somewhat more interactive. The goal isn't to fool a skilled, > determined attacker...merely to cloud the playing field with tens > of thousands of fake services, all without causing unreasonable > stress on the thp host. > > > * Changelog: > http://www.alpinista.org/files/thp/thp-0.4.4/CHANGELOG > * Download: > http://www.l0t3k.net/tools/Honeypot/thp-0.4.6.tar.gz > * Home: http://www.alpinista.org/ > * License: GNU General Public License > * MD5SUM: 227ef8a3cedb49a1c634298f71a5832b > * Platform(s): Linux > > > > > > -- > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug >

Oct. 3, 2008

Re: [Wlug] SSH problems

by Jeff Kinz

Eric - one way to stop the attacks is to let them in.... Time for a honeypot! IIRC a very simple C program can keep these guys occupied for hours.. Suggestion - move your ssh access port, and run THP Tiny Honeypot Quote: Wouldn't it be nice if every single unsolicited connection attempt tied up the attacker who launched it by appearing to actually work, all the while providing a little insight into their motives and intents? thp appears to listen on all ports otherwise not in legitimate use, providing a series of phony responses to attacker commands. Some are very simple, others are somewhat more interactive. The goal isn't to fool a skilled, determined attacker...merely to cloud the playing field with tens of thousands of fake services, all without causing unreasonable stress on the thp host. * Changelog: http://www.alpinista.org/files/thp/thp-0.4.4/CHANGELOG * Download: http://www.l0t3k.net/tools/Honeypot/thp-0.4.6.tar.gz * Home: http://www.alpinista.org/ * License: GNU General Public License * MD5SUM: 227ef8a3cedb49a1c634298f71a5832b * Platform(s): Linux --

Oct. 3, 2008

Re: [Wlug] SSH problems

by Eric Martin

John Stoffel wrote: > Eric> I have an outward facing ssh box at work that is currently being > Eric> attacked. somebody's going through a dictionary attack of > Eric> usernames; currently he or she is on abl. I can't block the IP > Eric> Address because the ip is different with each username. Does > Eric> anybody have any good ideas on how to stop this? I'm probably > Eric> going to move the ssh port to some random high number to get rid > Eric> of this, but I don't know yet if anybody else ssh's in besides > Eric> me. > > I've been running 'denyhosts' python script on both debian and FreeBSD > boxes I own. I don't like moving the SSH port because that's really > just security through obscurity. I'm not looking for extra security, I'm looking for clearing my logs and keeping the script kiddies away. I'm using real security, but it's nice to be able to read through your logs... > > And if your users have good passwords, it's unlikely that a dictionary > attack is going to work as well. Turned off password / pam / challengeresponse, just using PKI > > denyhosts works well, blocks hosts making multiple attempts, etc. > It's hard to block attacks where they do one attempt/per IP, but > hopefully it's going to take them long enough to run a useful sweep > that the won't get in. > > Fail2ban looks to be another good option as well, though I haven't > touched it. > > John I also want to look into fail2ban but I haven't had a chance yet. -- Eric Martin Key fingerprint = D1C4 086E DBB5 C18E 6FDA B215 6A25 7174 A941 3B9F

Oct. 2, 2008

Re: [Wlug] SSH problems

by John Stoffel

Eric> I have an outward facing ssh box at work that is currently being Eric> attacked. somebody's going through a dictionary attack of Eric> usernames; currently he or she is on abl. I can't block the IP Eric> Address because the ip is different with each username. Does Eric> anybody have any good ideas on how to stop this? I'm probably Eric> going to move the ssh port to some random high number to get rid Eric> of this, but I don't know yet if anybody else ssh's in besides Eric> me. I've been running 'denyhosts' python script on both debian and FreeBSD boxes I own. I don't like moving the SSH port because that's really just security through obscurity. And if your users have good passwords, it's unlikely that a dictionary attack is going to work as well. denyhosts works well, blocks hosts making multiple attempts, etc. It's hard to block attacks where they do one attempt/per IP, but hopefully it's going to take them long enough to run a useful sweep that the won't get in. Fail2ban looks to be another good option as well, though I haven't touched it. John

Oct. 1, 2008

Re: [Wlug] SSH problems

by Aaron Haviland

William Smith wrote, on Sep 30, 2008 at 21:47 EDT: > This might be of interest: http://www.fail2ban.org/wiki/index.php/Main_Page > > Basically, it detects hack attempts and locks off the offending IP > address for about five minutes by modifying firewall rules. > > I've only started looking at it myself, but I know others that use it > and it seems to work well. I've actually been using fail2ban for several years now one a few servers, with great success. .. except in the scenerio where it's unique IPs. I've actually been seeing a small amount of that today, as well, on one of my boxen, and as far as I can see, there's very little to no duplication of IPs, so fail2ban would not help at all in this case. fail2ban works for ssh attempts, where one IP fails login, for example, 3 times within 600 seconds, and also has rules for other daemons like bind, apache, exim, &c. Over the past month, it's been quiet the last couple weeks, but the beginning of September was *very* busy, and fail2ban saved me several headaches. -- Aaron Haviland 34 Wayne Ave, Dudley, MA home: [508] 943 - 7974

Oct. 1, 2008

Re: [Wlug] SSH problems

by William Smith

This might be of interest: http://www.fail2ban.org/wiki/index.php/Main_Page Basically, it detects hack attempts and locks off the offending IP address for about five minutes by modifying firewall rules. I've only started looking at it myself, but I know others that use it and it seems to work well. Bill Smith Fall River, MA Charter Member of LOPSA On Tue, Sep 30, 2008 at 8:03 PM, Alex Camilo <alex.camilo(a)gmail.com> wrote: > assuming the set of attacker IPs is finite. could you keep a running log of > IPs discard duplicates and add it to a block list for the duration of > the attack? > > On Tue, Sep 30, 2008 at 4:07 PM, Chuck Anderson <cra(a)wpi.edu> wrote: >> >> On Tue, Sep 30, 2008 at 03:54:52PM -0400, Alex Camilo wrote: >> > <clueless_newbie>just out of curiosity. >> > Could this be an attack from some sort of botnet? would that explain the >> > different IPs? >> >> Yes >> >> > or is he forging packets? >> > </clueless_newbie> >> >> Unlikely >> _______________________________________________ >> Wlug mailing list >> Wlug(a)mail.wlug.org >> http://mail.wlug.org/mailman/listinfo/wlug > > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > >

Oct. 1, 2008

Re: [Wlug] SSH problems

by Eric Martin

Alex Camilo wrote: > assuming the set of attacker IPs is finite. could you keep a running log > of IPs discard duplicates and add it to a block list for the duration of > the attack? > > On Tue, Sep 30, 2008 at 4:07 PM, Chuck Anderson <cra(a)wpi.edu > <mailto:cra@wpi.edu>> wrote: > > On Tue, Sep 30, 2008 at 03:54:52PM -0400, Alex Camilo wrote: > > <clueless_newbie>just out of curiosity. > > Could this be an attack from some sort of botnet? would that > explain the > > different IPs? > > Yes > > > or is he forging packets? > > </clueless_newbie> > > Unlikely > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org <mailto:Wlug@mail.wlug.org> > http://mail.wlug.org/mailman/listinfo/wlug > > > > ------------------------------------------------------------------------ > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug I forgot to mention that the box is also a webserver that clients log into, so blocking IPs (other than ssh) may keep people from accessing a website...It's moving slowly also, (s)he is on ajs right now, as opposed to ach when I sent the original email... -- Eric Martin Key fingerprint = D1C4 086E DBB5 C18E 6FDA B215 6A25 7174 A941 3B9F

Oct. 1, 2008

Re: [Wlug] SSH problems

by Alex Camilo

assuming the set of attacker IPs is finite. could you keep a running log of IPs discard duplicates and add it to a block list for the duration of the attack? On Tue, Sep 30, 2008 at 4:07 PM, Chuck Anderson <cra(a)wpi.edu> wrote: > On Tue, Sep 30, 2008 at 03:54:52PM -0400, Alex Camilo wrote: > > <clueless_newbie>just out of curiosity. > > Could this be an attack from some sort of botnet? would that explain the > > different IPs? > > Yes > > > or is he forging packets? > > </clueless_newbie> > > Unlikely > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug >

Oct. 1, 2008

Re: [Wlug] SSH problems

by Eric Martin

Chuck Anderson wrote: > On Tue, Sep 30, 2008 at 03:54:52PM -0400, Alex Camilo wrote: >> <clueless_newbie>just out of curiosity. >> Could this be an attack from some sort of botnet? would that explain the >> different IPs? > > Yes > >> or is he forging packets? >> </clueless_newbie> > > Unlikely > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug agreed -- Eric Martin Key fingerprint = D1C4 086E DBB5 C18E 6FDA B215 6A25 7174 A941 3B9F

Sept. 30, 2008

Re: [Wlug] SSH problems

by Tim Keller

It most definitly is. If you expose a box with default ports for any amount of time you'll see all sorts of fun stuff taking a wack at it. If you need to connect from random places, and you can keep your keys safe, going key only and then moving the port is probably going to keep you pretty safe. On 9/30/08, Alex Camilo <alex.camilo(a)gmail.com> wrote: > <clueless_newbie>just out of curiosity. > Could this be an attack from some sort of botnet? would that explain the > different IPs? > or is he forging packets? > </clueless_newbie> > > On Tue, Sep 30, 2008 at 1:43 PM, Eric Martin <freak4uxxx(a)gmail.com> wrote: > >> I have an outward facing ssh box at work that is currently being >> attacked. somebody's going through a dictionary attack of usernames; >> currently he or she is on abl. I can't block the IP Address because the >> ip is different with each username. Does anybody have any good ideas on >> how to stop this? I'm probably going to move the ssh port to some >> random high number to get rid of this, but I don't know yet if anybody >> else ssh's in besides me. >> >> Thanks in advance >> -- >> Eric Martin >> Key fingerprint = D1C4 086E DBB5 C18E 6FDA B215 6A25 7174 A941 3B9F >> >> >> _______________________________________________ >> Wlug mailing list >> Wlug(a)mail.wlug.org >> http://mail.wlug.org/mailman/listinfo/wlug >> >> > -- Sent from Gmail for mobile | mobile.google.com I am weary of the allegiances of any politician who refers to their constituents as "consumers".

Sept. 30, 2008

Re: [Wlug] SSH problems

by Chuck Anderson

On Tue, Sep 30, 2008 at 03:54:52PM -0400, Alex Camilo wrote: > <clueless_newbie>just out of curiosity. > Could this be an attack from some sort of botnet? would that explain the > different IPs? Yes > or is he forging packets? > </clueless_newbie> Unlikely

Sept. 30, 2008

Re: [Wlug] SSH problems

by Alex Camilo

<clueless_newbie>just out of curiosity. Could this be an attack from some sort of botnet? would that explain the different IPs? or is he forging packets? </clueless_newbie> On Tue, Sep 30, 2008 at 1:43 PM, Eric Martin <freak4uxxx(a)gmail.com> wrote: > I have an outward facing ssh box at work that is currently being > attacked. somebody's going through a dictionary attack of usernames; > currently he or she is on abl. I can't block the IP Address because the > ip is different with each username. Does anybody have any good ideas on > how to stop this? I'm probably going to move the ssh port to some > random high number to get rid of this, but I don't know yet if anybody > else ssh's in besides me. > > Thanks in advance > -- > Eric Martin > Key fingerprint = D1C4 086E DBB5 C18E 6FDA B215 6A25 7174 A941 3B9F > > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > >

Sept. 30, 2008

Re: [Wlug] SSH problems

by Eric Martin

Gary Hanley wrote: > On Tue, 30 Sep 2008, Tal Cohen wrote: >> Do you know the IP addresses of the users that ARE authorized to SSH into >> the system? If so, add them to /etc/hosts.allow. >> Tal > > Assuming you have TCP Wrappers built into your server of course. > Maybe it's built in by default there days. I haven't built an SSH > Server from source in a long time. > > But if you do have it installed I believe you can add the offending IP > in /etc/hosts.deny which would be much easier. And even better-er, if > the attacker is coming from one IP and you have a firewall it would be > more efficient to stop them there before they reach the SSH service. > > -- Gary > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug Coming from multiple points so that kills the stopping them at the firewall. I could stop them through hosts.allow/deny though... -- Eric Martin Key fingerprint = D1C4 086E DBB5 C18E 6FDA B215 6A25 7174 A941 3B9F

Sept. 30, 2008

Re: [Wlug] SSH problems

by Eric Martin

Tal Cohen wrote: > Do you know the IP addresses of the users that ARE authorized to SSH into > the system? If so, add them to /etc/hosts.allow. > > Tal > > -----Original Message----- > From: wlug-bounces(a)mail.wlug.org [mailto:wlug-bounces@mail.wlug.org] On > Behalf Of Eric Martin > Sent: Tuesday, September 30, 2008 1:44 PM > To: Worcester Linux Users Group > Subject: [Wlug] SSH problems > > I have an outward facing ssh box at work that is currently being attacked. > somebody's going through a dictionary attack of usernames; currently he or > she is on abl. I can't block the IP Address because the ip is different > with each username. Does anybody have any good ideas on how to stop this? > I'm probably going to move the ssh port to some random high number to get > rid of this, but I don't know yet if anybody else ssh's in besides me. > > Thanks in advance > -- > Eric Martin > Key fingerprint = D1C4 086E DBB5 C18E 6FDA B215 6A25 7174 A941 3B9F > > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug I like it, but I might need access from some random place. Granted I could always vpn into work and then ssh from that known ip... I'll think about it, thanks for the idea! -- Eric Martin Key fingerprint = D1C4 086E DBB5 C18E 6FDA B215 6A25 7174 A941 3B9F

Sept. 30, 2008

Re: [Wlug] SSH problems

by Eric Martin

Chuck Anderson wrote: > On Tue, Sep 30, 2008 at 01:43:46PM -0400, Eric Martin wrote: >> I have an outward facing ssh box at work that is currently being >> attacked. somebody's going through a dictionary attack of usernames; >> currently he or she is on abl. I can't block the IP Address because the >> ip is different with each username. Does anybody have any good ideas on >> how to stop this? I'm probably going to move the ssh port to some >> random high number to get rid of this, but I don't know yet if anybody >> else ssh's in besides me. >> >> Thanks in advance > > You could always just ignore it. Especially if you turn off password > authentication and require users to use SSH RSA keys. Then no matter > what dictionary attack it attempted, it will never work. > > I got sick of hearing my hard drive logging all the failed attempts > and finally resorted to moving the SSH port. > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug Yeah, I'm only allowing PKI to authenticate via ssh. I tried to move the port but a firewall (or two) is blocking the high level stuff so I have to trace through and see where it is. I need to document the server so I'm probably going to fix the firewall / move the port then. thanks! -- Eric Martin Key fingerprint = D1C4 086E DBB5 C18E 6FDA B215 6A25 7174 A941 3B9F

Sept. 30, 2008

Re: [Wlug] SSH problems

by Gary Hanley

On Tue, 30 Sep 2008, Tal Cohen wrote: > Do you know the IP addresses of the users that ARE authorized to SSH into > the system? If so, add them to /etc/hosts.allow. > Tal Assuming you have TCP Wrappers built into your server of course. Maybe it's built in by default there days. I haven't built an SSH Server from source in a long time. But if you do have it installed I believe you can add the offending IP in /etc/hosts.deny which would be much easier. And even better-er, if the attacker is coming from one IP and you have a firewall it would be more efficient to stop them there before they reach the SSH service. -- Gary

Sept. 30, 2008

Re: [Wlug] SSH problems

by Chuck Anderson

On Tue, Sep 30, 2008 at 01:43:46PM -0400, Eric Martin wrote: > I have an outward facing ssh box at work that is currently being > attacked. somebody's going through a dictionary attack of usernames; > currently he or she is on abl. I can't block the IP Address because the > ip is different with each username. Does anybody have any good ideas on > how to stop this? I'm probably going to move the ssh port to some > random high number to get rid of this, but I don't know yet if anybody > else ssh's in besides me. > > Thanks in advance You could always just ignore it. Especially if you turn off password authentication and require users to use SSH RSA keys. Then no matter what dictionary attack it attempted, it will never work. I got sick of hearing my hard drive logging all the failed attempts and finally resorted to moving the SSH port.

Sept. 30, 2008

Re: [Wlug] SSH problems

by Tal Cohen

Do you know the IP addresses of the users that ARE authorized to SSH into the system? If so, add them to /etc/hosts.allow. Tal -----Original Message----- From: wlug-bounces(a)mail.wlug.org [mailto:wlug-bounces@mail.wlug.org] On Behalf Of Eric Martin Sent: Tuesday, September 30, 2008 1:44 PM To: Worcester Linux Users Group Subject: [Wlug] SSH problems I have an outward facing ssh box at work that is currently being attacked. somebody's going through a dictionary attack of usernames; currently he or she is on abl. I can't block the IP Address because the ip is different with each username. Does anybody have any good ideas on how to stop this? I'm probably going to move the ssh port to some random high number to get rid of this, but I don't know yet if anybody else ssh's in besides me. Thanks in advance -- Eric Martin Key fingerprint = D1C4 086E DBB5 C18E 6FDA B215 6A25 7174 A941 3B9F

Sept. 30, 2008

SSH problems

by Eric Martin

I have an outward facing ssh box at work that is currently being attacked. somebody's going through a dictionary attack of usernames; currently he or she is on abl. I can't block the IP Address because the ip is different with each username. Does anybody have any good ideas on how to stop this? I'm probably going to move the ssh port to some random high number to get rid of this, but I don't know yet if anybody else ssh's in besides me. Thanks in advance -- Eric Martin Key fingerprint = D1C4 086E DBB5 C18E 6FDA B215 6A25 7174 A941 3B9F

Sept. 30, 2008

Re: [Wlug] List broken?

by James Gray

Your message ended up in my gmail spam folder. Perhaps it ended up in yours as well? On Thu, Sep 18, 2008 at 3:58 PM, Tim Keller <turbofx(a)gmail.com> wrote: > I sent mail around 1am last night and it's yet to make it to the list...are > we having a problem? > > Thanks, > Tim. > > -- > I am weary of the allegiances of any politician who refers to their > constituents as "consumers". > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > >

Sept. 18, 2008

Re: [Wlug] List broken?

by Aaron Haviland

Tim Keller wrote, on Sep 18, 2008 at 15:58 EDT: > I sent mail around 1am last night and it's yet to make it to the list...are > we having a problem? Are your preferences set to receive a copy of mail sent to the list? (Edit your preferences here: http://mail.wlug.org/mailman/options/wlug) -- Aaron Haviland 34 Wayne Ave, Dudley, MA home: [508] 943 - 7974

Sept. 18, 2008

Re: [Wlug] List broken?

by Lee Keyser-Allen

Hrm, I saw it come through ... are your mail filters getting all aggressive against the Spam? On Thu, Sep 18, 2008 at 3:58 PM, Tim Keller <turbofx(a)gmail.com> wrote: > I sent mail around 1am last night and it's yet to make it to the list...are > we having a problem? > > Thanks, > Tim. > > -- > I am weary of the allegiances of any politician who refers to their > constituents as "consumers". > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > > -- Lee Keyser-Allen (lkeyser(a)alum.wpi.edu)

Sept. 18, 2008

List broken?

by Tim Keller

I sent mail around 1am last night and it's yet to make it to the list...are we having a problem? Thanks, Tim. -- I am weary of the allegiances of any politician who refers to their constituents as "consumers".

Sept. 18, 2008

Funky LVM hack we talked about...

by Tim Keller

Hey Gang, For those of you at the meeting who don't remember, Kevin had a 32GB flash disk that had a controller that had a built in understanding of FAT32. Thus formatting it as any other file system would work until you actually wrote to it then it would go insane. I postulated that one way to solve this would be to use LVM or MD, however when we tried this I hit a road block in that pvcreate won't let you pvcreate a regular old file, you need a device file, the same thing with MD. I finally managed to get it to work without having to hand add any devices into /dev... here's how... For my testing I created 4 100MB files using the command: dd if=/dev/zero of=part[1-4] bs=1024k count=100 This is what Kevin would need to do to on his flash drive... 1. Create 16, 2GB files on the flash drive named part[1-16] 2. Create loopback to file mappings using the command "losetup /dev/loop1 part1", repeat for all devices Also note, with this you could setup loopback encryption on these devices... If you suddenly find yourself without a loopback device issue the command in /dev "./MAKEDEV loop" However, I think udev will probably take care of it behind the scenes. 3. pvcreate /dev/loop1 /dev/loop2 /dev/loop3 /dev/loop4 ... 4. vgcreate vgHACK /dev/loop1 /dev/loop2 /dev/loop3 /dev/loop4 ... At this point if you issue a "vgdisplay" you should see how many (PE) physical extents you have. 5. lvcreate -n volume_name -l num_of_extends vgHACK If you use -L you can specify 300M, etc. Also you can specify how many stripes you want the data to be written in, which is handy if your 16 devices were on seperate disk controllers... Also you don't have to use all the extends in one logical volume, you could create lots of little volumes. 6. mkfs.ext3 /dev/vgHACK/volume_name 7. mount filesystem, sit back in bemusement that linux gives you the flexibility to do such things. Now... while were at it, if instead of LVM, if you wanted to use MD, this is what you'd do. If you have the lvm stuff from above, unmount the filesystem and issue a vgremove vgHACK it'll warn about active volumes, blah, blah... This command will take loop1,loop2,loop3,loop4 and put them into a 4 member RAID0 with no spare. mdadm -C /dev/md0 -l 0 -n 4 /dev/loop1 /dev/loop2 /dev/loop3 /dev/loop4 This command will create a raid5 out of the four devices without a spare. mdadm -C /dev/md0 -l 0 -n 4 /dev/loop1 /dev/loop2 /dev/loop3 /dev/loop4 It'll go off and build the array, now just format and mount and you're set to go. cat /proc/mdstat to see what it's upto. I was thinking of other insane things that Kevin can do with his 3 32GB flash disks. He could create 3 logical volumes each containing 16 members and then create an raid5 MD device using the logical volume members... He could create 3 16 member raid0's and then create a raid 5 out of them. He could install ZFS on top of fuse and then put all 48 devices into a zpool... I'll stop here, but I'm sure others have some even demented/funny ideas... Enjoy! Tim. -- I am weary of the allegiances of any politician who refers to their constituents as "consumers".

Sept. 18, 2008