- WLUG - wlug.mailman3.com

Re: problems with email to hotmail.com

by mike＠beakerware.net

> If you see a similar response to the telnet as I have above, you should > be able to connect to hotmail just fine. Since 11 of their 14 hosts > aren't responding, and all of the MX levels are the same (5), there > may be an issue there. I know that you get a round-robin effect with > the hosts, but I don't remember if it's single-attempt round robin (ie: > try mx11, ok it failed, wait a little bit, then try mx11 again), if it's > a single-attempt with lookups in between (ie: try mx11, ok it failed, > wait a little bit, do a lookup and try the returned host round-robin > again (so you may or may not get the same host again)), or if it's a > multiple-attempt round robin (ie: try mx11, ok it failed, try mx12, > ok it failed, continue until one succeeds.) I believe that's left up to the implementation of the MTA. I'm using Courier, which tends to be more strict on following RFCs, and in the case of an MX record w/ a IP address (not compliant with an RFC) bails rather than look to the next, even if it is at the same MX priority. -mike

April 30, 2002

Re: [Wlug] problems with email to hotmail.com

by Bill Mills-Curran

On Tue, 30 Apr 2002, Theo Van Dinter wrote: > Date: Tue, 30 Apr 2002 12:28:36 -0400 > From: Theo Van Dinter <felicity(a)kluge.net> > Reply-To: wlug(a)mail.wlug.org > To: wlug(a)mail.wlug.org > Subject: Re: [Wlug] problems with email to hotmail.com > > On Tue, Apr 30, 2002 at 12:10:08PM -0400, Bill Mills-Curran wrote: > > I suspect that the problem is that I'm behind a linksys router using > > private IP's and NAT. I've tried talking to Charter tech support, but > > they are worthless -- they just tell me that they only support Outlook > > email. > > > > I've tried configuring Pine so the it uses the Charter smtp server > > directly, but that doesn't seem to help, either. Right now, I'm using > > my local machine, and routing through Charter. > > > > Any ideas? > > Well, there's 2 possible issues. 1) it's likely that they block your > outgoing directly to hotmail's mail servers. 2) most of the hotmail > mail servers seem to be down or rejecting connections for me (via DSL), > so they may just be having problems. > > You can check out if you can connect directly via: > > $ dig hotmail.com mx +short > 5 mx11.hotmail.com. > 5 mx12.hotmail.com. > 5 mx13.hotmail.com. > 5 mx14.hotmail.com. > 5 mx15.hotmail.com. > 5 mx01.hotmail.com. > 5 mx02.hotmail.com. > 5 mx04.hotmail.com. > 5 mx05.hotmail.com. > 5 mx06.hotmail.com. > 5 mx07.hotmail.com. > 5 mx08.hotmail.com. > 5 mx09.hotmail.com. > 5 mx10.hotmail.com. > > > $ telnet mx05.hotmail.com 25 > Trying 64.4.56.199... > telnet: connect to address 64.4.56.199: Connection refused > Trying 65.54.254.145... > Connected to mx05.hotmail.com. > Escape character is '^]'. > 220 hotmail.com Microsoft ESMTP MAIL Service, Version: 5.0.2195.4905 ready at Tue, 30 Apr 2002 09:17:54 -0700 > quit > 221 2.0.0 hotmail.com Service closing transmission channel > Connection closed by foreign host. > > > (I could only connect to 5, 9, and 13 of all of these 14 hosts...) > > If you see a similar response to the telnet as I have above, you should > be able to connect to hotmail just fine. Since 11 of their 14 hosts > aren't responding, and all of the MX levels are the same (5), there > may be an issue there. I know that you get a round-robin effect with > the hosts, but I don't remember if it's single-attempt round robin (ie: > try mx11, ok it failed, wait a little bit, then try mx11 again), if it's > a single-attempt with lookups in between (ie: try mx11, ok it failed, > wait a little bit, do a lookup and try the returned host round-robin > again (so you may or may not get the same host again)), or if it's a > multiple-attempt round robin (ie: try mx11, ok it failed, try mx12, > ok it failed, continue until one succeeds.) > > > -- > Randomly Generated Tagline: > Hee, hee! I can be a jerk and no one can stop me! > > -- Homer Simpson > Itchy & Scratchy Land > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > Theo, I don't think connectivity is the issue -- I'm getting through to hotmail, they are just refusing to deliver. I can try to send to one of the "good" servers directly and see what happens. Thanks, Bill

April 30, 2002

Re: [Wlug] problems with email to hotmail.com

by Theo Van Dinter

On Tue, Apr 30, 2002 at 12:10:08PM -0400, Bill Mills-Curran wrote: > I suspect that the problem is that I'm behind a linksys router using > private IP's and NAT. I've tried talking to Charter tech support, but > they are worthless -- they just tell me that they only support Outlook > email. > > I've tried configuring Pine so the it uses the Charter smtp server > directly, but that doesn't seem to help, either. Right now, I'm using > my local machine, and routing through Charter. > > Any ideas? Well, there's 2 possible issues. 1) it's likely that they block your outgoing directly to hotmail's mail servers. 2) most of the hotmail mail servers seem to be down or rejecting connections for me (via DSL), so they may just be having problems. You can check out if you can connect directly via: $ dig hotmail.com mx +short 5 mx11.hotmail.com. 5 mx12.hotmail.com. 5 mx13.hotmail.com. 5 mx14.hotmail.com. 5 mx15.hotmail.com. 5 mx01.hotmail.com. 5 mx02.hotmail.com. 5 mx04.hotmail.com. 5 mx05.hotmail.com. 5 mx06.hotmail.com. 5 mx07.hotmail.com. 5 mx08.hotmail.com. 5 mx09.hotmail.com. 5 mx10.hotmail.com. $ telnet mx05.hotmail.com 25 Trying 64.4.56.199... telnet: connect to address 64.4.56.199: Connection refused Trying 65.54.254.145... Connected to mx05.hotmail.com. Escape character is '^]'. 220 hotmail.com Microsoft ESMTP MAIL Service, Version: 5.0.2195.4905 ready at Tue, 30 Apr 2002 09:17:54 -0700 quit 221 2.0.0 hotmail.com Service closing transmission channel Connection closed by foreign host. (I could only connect to 5, 9, and 13 of all of these 14 hosts...) If you see a similar response to the telnet as I have above, you should be able to connect to hotmail just fine. Since 11 of their 14 hosts aren't responding, and all of the MX levels are the same (5), there may be an issue there. I know that you get a round-robin effect with the hosts, but I don't remember if it's single-attempt round robin (ie: try mx11, ok it failed, wait a little bit, then try mx11 again), if it's a single-attempt with lookups in between (ie: try mx11, ok it failed, wait a little bit, do a lookup and try the returned host round-robin again (so you may or may not get the same host again)), or if it's a multiple-attempt round robin (ie: try mx11, ok it failed, try mx12, ok it failed, continue until one succeeds.) -- Randomly Generated Tagline: Hee, hee! I can be a jerk and no one can stop me! -- Homer Simpson Itchy & Scratchy Land

April 30, 2002

problems with email to hotmail.com

by Bill Mills-Curran

I'm a Charter user, and something has changed between charter and hotmail so that I can no longer send email to hotmail.com accounts. I CAN send if I use Charter's web mail interface, but I much prefer to stick with pine. I suspect that the problem is that I'm behind a linksys router using private IP's and NAT. I've tried talking to Charter tech support, but they are worthless -- they just tell me that they only support Outlook email. I've tried configuring Pine so the it uses the Charter smtp server directly, but that doesn't seem to help, either. Right now, I'm using my local machine, and routing through Charter. Any ideas? TIA, Bill

April 30, 2002

Re: [Wlug] bug report

by Josh Huber

Bill Mills-Curran <subssn594(a)charter.net> writes: > BTW, I'm running RedHat 7.1. So, who do I tell? Well, in case you haven't done anything about this yet, sending a report to the linux-kernel list might be a good idea. Run that oops message through ksymoops first, running with the same kernel which caused the oops messages: ksymoops < file_with_oops_in_it and send the output with a description of the problem to the list. Also, after running it through ksymoops, you might browse the lists to see if it's already been reported. ttyl, -- Josh Huber

April 29, 2002

Re: [Wlug] Whee! MIT Flea

by Chuck Haines

If you are looking for a WM, I highly suggest either fluxbox or blackbox (with Fluxbox being the better choice) with the -no-kde and -no-gnome options. On Mon, 2002-04-22 at 09:58, desdinova(a)soupforare.net wrote: > ::Dances around:: > Got so much great swag at the flea this time ^_^; > > Anyway, I picked up two Dolch 486DX/33s, on board scsi, 32meg > for $15. > It's been a loooong time since I've run linux on a 486 (slack > 2.something, iirc) > I'm thinking Debian potato would be alright? I most likely won't > install X, but if I do, I'll use X3.foo with a minimalist > windowmanager... Any suggestions? > > It's going to be alot of shoehorning for sure. > I won't lie, I haven't ran a linux system since my P200 died, she > was a fileserver and random-use machine. So, getting these > running would be great so I could fool around at work during slow > hours. > > Thanks, > James > KB1FJQ > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug -- --------------------------------------------- | Chuck Haines | AIM: CyberGrex | | GDC Webmaster | ICQ: 3707881 | | WPILA Lab Manager | MSN: CyberGrex | | chaines(a)wpi.edu | Yahoo: CyberGrex_27 | --------------------------------------------- Geek by nature, Linux by choice.

April 24, 2002

RE: [Wlug] Regarding M$ enforcement of licenses...

by Simoncini, Matthew

Hello, It's kind of interesting that an email about this very topic landed in my inbox this morning. Here's the link: http://techupdate.zdnet.com/techupdate/filters/specialreport/0,14622,6022528 ,00.html Good luck. Matthew On Tue, 23 Apr 2002 07:44:37 -0400, Stephen C. Daukas wrote: >In case you haven't heard, M$ is auditing a dozen or so large school >districts for compliance on licensing. Of course, this will be ugly and >will run one district an estimated $1,000,000 per year to comply with >M$. That's $1,000,000 more then they pay now. M$ is offering a simplified >arrangement whereby a school system pays a flat fee for every Intel box >(regardless of what it might actually be running) that would run that same >district about $30,000. You can see where this is headed! > >Aside from noting that people's dishonesty about paying the real costs >associated with M$ software has gotten them into this trouble (if only >because the real costs are not apparent to "management"), I'm wondering >what is available as a real alternative to M$ for the great unwashed masses. > >Of course, the answer I would expect to hear is "Linux!", but... > >I'm talking about a solution that is useable by those who are not rabid >members of a LUG, or Sys admins in their day job. I'm talking about >productivity software that will seamlessly read and write M$ file formats >(Excel, Word, etc.). I don't know, for example, if Star Office is a real >alternative because I don't know how well it interoperates with those who >use Word, for example, on a daily basis. Perhaps there is a solution that >will reliably run M$ applications without having to buy the OS, but that is >only a step in the right direction. > >I was hoping to hear suggestions about what is out there and if Linux is >ready to work seamlessly in heterogeneous High-Tech world. This might be a >good topic for one of the WLUG meetings... > >Steve > >_______________________________________________ >Wlug mailing list >Wlug(a)mail.wlug.org >http://mail.wlug.org/mailman/listinfo/wlug _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug

April 23, 2002

Re: [Wlug] Regarding M$ enforcement of licenses...

by avedis＠ma.ultranet.com

On 23 Apr 2002, at 7:44, Stephen C. Daukas wrote: > will run one district an estimated $1,000,000 per year to comply with > M$. That's $1,000,000 more then they pay now. M$ is offering a simplified So what would be the comparable costs for linux boxes and a sysadmin's salary, either part or full time? Maybe the schools don't even know that Linux is an option, and we should tell them. Imagine a whole generation of kids raised on Linux instead of MS. > I was hoping to hear suggestions about what is out there and if Linux is What about LindowsOS? Greg Avedissian

April 23, 2002

Re: [Wlug] Regarding M$ enforcement of licenses...

by The Greater Worcester Land Trust

Star Office in its various iterations is pretty damn solid, and that is after using three different releases over the years. There are occassional glitches in representation of the same document between M$ and SO, but to be fair to the SO suite there are occassional glitches in representation of the same document between M$ and M$ (assuming you are not trapped from even opening the document in the first place.) Also the filters to Word Perfect etc etc are two way filters (not import only) and allow kids who have family computers running alternative software more flexibility. The other benefit of SO (and OO if you decide that the admin is up to a little more complexity (and you seem to imply that they are not)) is that they can run it on their Win boxes and dabble in Linux without causing confusion to the office suite end user. That makes it possible for them to consider jumping ship in a silent revolution should they build up the confidence. Just some thoughts to ignore. Colin On Tue, 23 Apr 2002 07:44:37 -0400, Stephen C. Daukas wrote: >In case you haven't heard, M$ is auditing a dozen or so large school >districts for compliance on licensing. Of course, this will be ugly and >will run one district an estimated $1,000,000 per year to comply with >M$. That's $1,000,000 more then they pay now. M$ is offering a simplified >arrangement whereby a school system pays a flat fee for every Intel box >(regardless of what it might actually be running) that would run that same >district about $30,000. You can see where this is headed! > >Aside from noting that people's dishonesty about paying the real costs >associated with M$ software has gotten them into this trouble (if only >because the real costs are not apparent to "management"), I'm wondering >what is available as a real alternative to M$ for the great unwashed masses. > >Of course, the answer I would expect to hear is "Linux!", but... > >I'm talking about a solution that is useable by those who are not rabid >members of a LUG, or Sys admins in their day job. I'm talking about >productivity software that will seamlessly read and write M$ file formats >(Excel, Word, etc.). I don't know, for example, if Star Office is a real >alternative because I don't know how well it interoperates with those who >use Word, for example, on a daily basis. Perhaps there is a solution that >will reliably run M$ applications without having to buy the OS, but that is >only a step in the right direction. > >I was hoping to hear suggestions about what is out there and if Linux is >ready to work seamlessly in heterogeneous High-Tech world. This might be a >good topic for one of the WLUG meetings... > >Steve > >_______________________________________________ >Wlug mailing list >Wlug(a)mail.wlug.org >http://mail.wlug.org/mailman/listinfo/wlug

April 23, 2002

Re: [Wlug] Regarding M$ enforcement of licenses...

by desdinova＠soupforare.net

On 23 Apr 2002, at 7:44, Stephen C. Daukas wrote: > In case you haven't heard, M$ is auditing a dozen or so large school > districts for compliance on licensing. Of course, this will be ugly > and will run one district an estimated $1,000,000 per year to comply > with M$. That's $1,000,000 more then they pay now. M$ is offering a > simplified arrangement whereby a school system pays a flat fee for > every Intel box (regardless of what it might actually be running) that > would run that same district about $30,000. You can see where this is > headed! <snip> Actually, I believe it's every box, regardless of manufacturer. (ie apples too) James

April 23, 2002

Regarding M$ enforcement of licenses...

by Stephen C. Daukas

In case you haven't heard, M$ is auditing a dozen or so large school districts for compliance on licensing. Of course, this will be ugly and will run one district an estimated $1,000,000 per year to comply with M$. That's $1,000,000 more then they pay now. M$ is offering a simplified arrangement whereby a school system pays a flat fee for every Intel box (regardless of what it might actually be running) that would run that same district about $30,000. You can see where this is headed! Aside from noting that people's dishonesty about paying the real costs associated with M$ software has gotten them into this trouble (if only because the real costs are not apparent to "management"), I'm wondering what is available as a real alternative to M$ for the great unwashed masses. Of course, the answer I would expect to hear is "Linux!", but... I'm talking about a solution that is useable by those who are not rabid members of a LUG, or Sys admins in their day job. I'm talking about productivity software that will seamlessly read and write M$ file formats (Excel, Word, etc.). I don't know, for example, if Star Office is a real alternative because I don't know how well it interoperates with those who use Word, for example, on a daily basis. Perhaps there is a solution that will reliably run M$ applications without having to buy the OS, but that is only a step in the right direction. I was hoping to hear suggestions about what is out there and if Linux is ready to work seamlessly in heterogeneous High-Tech world. This might be a good topic for one of the WLUG meetings... Steve

April 23, 2002

Re: [Wlug] Whee! MIT Flea

by Bill Smith

On Mon, 22 Apr 2002 09:58:16 -0400 desdinova(a)soupforare.net wrote: DN> I'm thinking Debian potato would be alright? I most likely won't DN> install X, but if I do, I'll use X3.foo with a minimalist DN> windowmanager... Any suggestions? take a look at WindowMaker. It's been a favorite of mine for a LONG time. You can take a look at it at www.windowmaker.org . +--------------------------------------------------------------+ | William Smith wsmith at chezsmith dot com | | Fall River, MA http://www.chezsmith.com | +--------------------------------------------------------------+ | I'm not crazy, I've just been in a very | | bad mood for 30 years. | | * TAG! v2.2 * | +--------------------------------------------------------------+

April 23, 2002

RE: [Wlug] shot power supply?

by dibb_jim＠emc.com

Most drives require +5 and + 12 volt supplies. Some newer (very new) drives only require +12V. -----Original Message----- From: bryon3245(a)netzero.com [mailto:bryon3245@netzero.com] Sent: Monday, April 22, 2002 1:54 PM To: wlug(a)mail.wlug.org Subject: [Wlug] shot power supply? I have a Dell Dimension 4100 and I am pretty sure that the power supply is shot. I was wondering if there are any tests that I can do to make sure that it is the power supply and not something else. I am sure that there is nothing wrong with the power cord. When I plug in the cord and push the power button nothing happens and nothing lights up. I was also wondering why there are four cords going to each drive. I know it needs a positive and negative and posibly a ground but what is the last one for. What does each cord do? Is it possible to replace it with a generic PSU becuase i heard that only dell ones will work with a dell computer. Thanks -------------------------------------------------------------------- mail2web - Check your email from the web at http://mail2web.com/ . _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug

April 22, 2002

shot power supply?

by bryon3245＠netzero.com

I have a Dell Dimension 4100 and I am pretty sure that the power supply is shot. I was wondering if there are any tests that I can do to make sure that it is the power supply and not something else. I am sure that there is nothing wrong with the power cord. When I plug in the cord and push the power button nothing happens and nothing lights up. I was also wondering why there are four cords going to each drive. I know it needs a positive and negative and posibly a ground but what is the last one for. What does each cord do? Is it possible to replace it with a generic PSU becuase i heard that only dell ones will work with a dell computer. Thanks -------------------------------------------------------------------- mail2web - Check your email from the web at http://mail2web.com/ .

April 22, 2002

Whee! MIT Flea

by desdinova＠soupforare.net

::Dances around:: Got so much great swag at the flea this time ^_^; Anyway, I picked up two Dolch 486DX/33s, on board scsi, 32meg for $15. It's been a loooong time since I've run linux on a 486 (slack 2.something, iirc) I'm thinking Debian potato would be alright? I most likely won't install X, but if I do, I'll use X3.foo with a minimalist windowmanager... Any suggestions? It's going to be alot of shoehorning for sure. I won't lie, I haven't ran a linux system since my P200 died, she was a fileserver and random-use machine. So, getting these running would be great so I could fool around at work during slow hours. Thanks, James KB1FJQ

April 22, 2002

Re: [Wlug] I hate crackers (not the kind you eat)

by Jason Calvert

Yes I agree, but since it came with a ping and only once, I figured it was not a worm but a person on the other end. On Thu, 2002-04-18 at 08:50, Charles R. Anderson wrote: > On Thu, Apr 18, 2002 at 08:39:00AM -0400, Jason Calvert wrote: > calvert> It does not really look like some one is trying to break through your > calvert> file wall, they are not sending acks or anything strange, they are > calvert> simply trying to view content on your httpd server which you are not > calvert> running I guess. Have they scanned any other ports?(other than the ICMP > calvert> ping?) If I saw an port scan or ack packets I would be more concerned. > calvert> If you have a dynamic IP it could be someone trying to return to a site > calvert> they were at before... > calvert> Usually a break in attempt will cause a lot more traffic that a http > calvert> request. > > Actually, unsolicited http requests like this are usually viruses like > Code Red or Nimda. > > Sometimes the IP address doesn't have a DNS reversal. In either case, I > like to look them up in ARIN/RIPE/APNIC: > > >whois 66.189.81.226(a)whois.arin.net > [whois.arin.net] > Charter Communications (NETBLK-CHARTER-NET-5BLK) CHARTER-NET-5BLK > 66.188.0.0 - 66.191.255.255 > Charter Communications (NETBLK-OXFD-MA-66-189-080) OXFD-MA-66-189-080 > 66.189.80.0 - 66.189.83.255 > > To single out one record, look it up with "!xxx", where xxx is the > handle, shown in parenthesis following the name, which comes first. > > The ARIN Registration Services Host contains ONLY Internet > Network Information: Networks, ASN's, and related POC's. > Please use the whois server at rs.internic.net for DOMAIN related > Information and whois.nic.mil for NIPRNET Information. > > >whois \!NETBLK-OXFD-MA-66-189-080@whois.arin.net > [whois.arin.net] > Charter Communications (NETBLK-OXFD-MA-66-189-080) > 12405 Powerscourt Dr. > St. Louis, MO 63131 > US > > Netname: OXFD-MA-66-189-080 > Netblock: 66.189.80.0 - 66.189.83.255 > > Coordinator: > Charter Communications (ZC119-ARIN) ipaddressing(a)chartercom.com > 314-965-0555 > > Domain System inverse mapping provided by: > > NS1.CHARTER.COM 24.196.241.11 > NS2.CHARTER.COM 24.213.60.79 > > Record last updated on 12-Dec-2001. > Database last updated on 17-Apr-2002 19:59:25 EDT. > > The ARIN Registration Services Host contains ONLY Internet > Network Information: Networks, ASN's, and related POC's. > Please use the whois server at rs.internic.net for DOMAIN related > Information and whois.nic.mil for NIPRNET Information. > > > > If the results come up with RIPE, redo the query with whois.ripe.net. > If the results come up with APNIC, use whois.apnic.net. > > -- > Charles R. Anderson <cra(a)wpi.edu> / http://angus.ind.wpi.edu/~cra/ > PGP Key ID: 49BB5886 > Fingerprint: EBA3 A106 7C93 FA07 8E15 3AC2 C367 A0F9 49BB 5886 > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug >

April 19, 2002

Re: [Wlug] Motherboard Monitor

by Charles R. Anderson

lm_sensors? http://freshmeat.net/projects/lm_sensors/?topic_id=862%2C146 On Thu, Apr 18, 2002 at 06:21:48PM -0400, Michael Frysinger wrote: vapier> are there any utilities out there that you guys vapier> know of that work with the sensors that vapier> motherboards have ? i'm looking for something vapier> that can obtain CPU temperature, fan rpm's, vapier> and all that other fun stuff ... at this point i just vapier> want something so i can read those values ... vapier> i dont need any fancy programs really ... vapier> -mike -- Charles R. Anderson <cra(a)wpi.edu> / http://angus.ind.wpi.edu/~cra/ PGP Key ID: 49BB5886 Fingerprint: EBA3 A106 7C93 FA07 8E15 3AC2 C367 A0F9 49BB 5886

April 18, 2002

Re: [Wlug] Motherboard Monitor

by Brian J. Conway

> are there any utilities out there that you guys > know of that work with the sensors that > motherboards have ? i'm looking for something > that can obtain CPU temperature, fan rpm's, > and all that other fun stuff ... at this point i just > want something so i can read those values ... > i dont need any fancy programs really ... Lmsensors is pretty much the standard and consists of kernel modules that are loaded depending upon your chipset and then read by external programs. I used to use a nice dock app to keep track of things, but I've found recent releases of lmsensors to be highly unsafe for SMP use and would dump my kernel when I tried to load or access them, though I might have just misconfigured one of the modules. Brian J. Conway bconway(a)wpi.edu "LINUX is obsolete" - Andrew S. Tanenbaum, creator of Minix - Jan 29, 1992

April 18, 2002

Motherboard Monitor

by Michael Frysinger

are there any utilities out there that you guys know of that work with the sensors that motherboards have ? i'm looking for something that can obtain CPU temperature, fan rpm's, and all that other fun stuff ... at this point i just want something so i can read those values ... i dont need any fancy programs really ... -mike

April 18, 2002

Re: [Wlug] I hate crackers (not the kind you eat)

by jeff

another fun toy for the paranoid is lsof - a really nifty process tool. shows ALL the stuff tunning on your machine and who's running them. maybe check for rootkits and stuff like that. :) but i agree with the other guys...i get tons of http and ftp and even some ssh hits every day. of course, earthlink's network - especially in my ip range - is littered with nimda and code red IIS machines. scary... -jeff

April 18, 2002

Re: [Wlug] I hate crackers (not the kind you eat)

by Jeremy

I would have to agree. If you have DSL/broadband, it seems that you are bound to get these "random" hits. Like Charles said, most are the http IIS virus which you dont need to "worry" about. My PPC linux box gets tons of the http hits which I just ignore, as well as the occasional SSH hits, and anonymous FTP (which anon is turned off). Acutally I am surprise you only got 2 http hits. Usually a few an hour for me. Anyway, just keep tabs on your daily logs. Possibly install log analyis tools. Actually, if you have openssh installed, I believe it installs a neat simple script called: "logcheck.sh" It doesnt do much, but shows failed login attempts etc. Start a crontab and have it email u the results. PS if your running Intel definately keep update to date on patches; or is this no longer true (i.e. asm buffer code etc)? -jeremy no warrently included --- "Brian J. Conway" <bconway(a)WPI.EDU> wrote: > > Looking at my log file from my firewall reveals that not I've got > > people trying to through my firewall from... > > > > 66.189.81.226 (and 246) (http connect attempts) > > 62.163.126.100 (same domain as yesterday) > > > > How do I track them back to the ISP's and send a message to their abuse@ > > address? > > > > Someone's trying to ping me from 66.189.24.226 as well. > > [dogbert@ladyluck /]$ host 66.189.81.226 > 226.81.189.66.in-addr.arpa domain name pointer > cpe-66-189-81-226.ma.charter.com.[dogbert@ladyluck /]$ host 62.163.126.100 > 100.126.163.62.in-addr.arpa domain name pointer a126100.upc-a.chello.nl. > [dogbert@ladyluck /]$ host 66.189.24.226 > 226.24.189.66.in-addr.arpa domain name pointer > cpe-66-189-24-226.ma.charter.com. > > > Am I being paranoid or could my isp be trying to crack my firewall to > > see if I've got any servers running? > > Port scanning isn't illegal, I wouldn't be that concerned unless something > actually gets broken into, and it doesn't sound like you're in imminent > danger of that. There's a lot of noise that's gonna show up in firewall > or PortSentry-type logs, especially on cable or DSL IP ranges, I really > don't pay it much attention myself. It's your call, of course. > > Brian J. Conway > bconway(a)wpi.edu > > "LINUX is obsolete" > - Andrew S. Tanenbaum, creator of Minix - Jan 29, 1992 > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug __________________________________________________ Do You Yahoo!? Yahoo! Tax Center - online filing with TurboTax http://taxes.yahoo.com/

April 18, 2002

Re: [Wlug] I hate crackers (not the kind you eat)

by Charles R. Anderson

On Thu, Apr 18, 2002 at 08:39:00AM -0400, Jason Calvert wrote: calvert> It does not really look like some one is trying to break through your calvert> file wall, they are not sending acks or anything strange, they are calvert> simply trying to view content on your httpd server which you are not calvert> running I guess. Have they scanned any other ports?(other than the ICMP calvert> ping?) If I saw an port scan or ack packets I would be more concerned. calvert> If you have a dynamic IP it could be someone trying to return to a site calvert> they were at before... calvert> Usually a break in attempt will cause a lot more traffic that a http calvert> request. Actually, unsolicited http requests like this are usually viruses like Code Red or Nimda. Sometimes the IP address doesn't have a DNS reversal. In either case, I like to look them up in ARIN/RIPE/APNIC: >whois 66.189.81.226(a)whois.arin.net [whois.arin.net] Charter Communications (NETBLK-CHARTER-NET-5BLK) CHARTER-NET-5BLK 66.188.0.0 - 66.191.255.255 Charter Communications (NETBLK-OXFD-MA-66-189-080) OXFD-MA-66-189-080 66.189.80.0 - 66.189.83.255 To single out one record, look it up with "!xxx", where xxx is the handle, shown in parenthesis following the name, which comes first. The ARIN Registration Services Host contains ONLY Internet Network Information: Networks, ASN's, and related POC's. Please use the whois server at rs.internic.net for DOMAIN related Information and whois.nic.mil for NIPRNET Information. >whois \!NETBLK-OXFD-MA-66-189-080@whois.arin.net [whois.arin.net] Charter Communications (NETBLK-OXFD-MA-66-189-080) 12405 Powerscourt Dr. St. Louis, MO 63131 US Netname: OXFD-MA-66-189-080 Netblock: 66.189.80.0 - 66.189.83.255 Coordinator: Charter Communications (ZC119-ARIN) ipaddressing(a)chartercom.com 314-965-0555 Domain System inverse mapping provided by: NS1.CHARTER.COM 24.196.241.11 NS2.CHARTER.COM 24.213.60.79 Record last updated on 12-Dec-2001. Database last updated on 17-Apr-2002 19:59:25 EDT. The ARIN Registration Services Host contains ONLY Internet Network Information: Networks, ASN's, and related POC's. Please use the whois server at rs.internic.net for DOMAIN related Information and whois.nic.mil for NIPRNET Information. If the results come up with RIPE, redo the query with whois.ripe.net. If the results come up with APNIC, use whois.apnic.net. -- Charles R. Anderson <cra(a)wpi.edu> / http://angus.ind.wpi.edu/~cra/ PGP Key ID: 49BB5886 Fingerprint: EBA3 A106 7C93 FA07 8E15 3AC2 C367 A0F9 49BB 5886

April 18, 2002

Re: [Wlug] I hate crackers (not the kind you eat)

by Skip Gaede

On Thursday 18 April 2002 08:05 am, Wesley Allen wrote: > OK, > Looking at my log file from my firewall reveals that not I've got > people trying to through my firewall from... > > 66.189.81.226 (and 246) (http connect attempts) > 62.163.126.100 (same domain as yesterday) > > How do I track them back to the ISP's and send a message to their abuse@ > address? > > Someone's trying to ping me from 66.189.24.226 as well. > > Am I being paranoid or could my isp be trying to crack my firewall to > see if I've got any servers running? > > Time to batten down the hatches... > > Wes Hi Wes, Thye're out there! I had the same problem when I setup an http site to debug an app I was working on. I kinda forgot about it and kept getting virus droppings in my scripts directory. Eventually I figured out what was going on and tightened the security on the site so I was the only one whjo had write access and that stopped it. I think there are folks who have nothing better to do than to write webbots to look for things inside their ISPs domain. As long as you have adequate protection against write access, you're probably OK. Some of the accesses were from machines operated by my ISP. I don't know what they were for :-} --Skip

April 18, 2002

Re: [Wlug] I hate crackers (not the kind you eat)

by Jason Calvert

It does not really look like some one is trying to break through your file wall, they are not sending acks or anything strange, they are simply trying to view content on your httpd server which you are not running I guess. Have they scanned any other ports?(other than the ICMP ping?) If I saw an port scan or ack packets I would be more concerned. If you have a dynamic IP it could be someone trying to return to a site they were at before... Usually a break in attempt will cause a lot more traffic that a http request. Jason On Thu, 2002-04-18 at 08:05, Wesley Allen wrote: > OK, > Looking at my log file from my firewall reveals that not I've got > people trying to through my firewall from... > > 66.189.81.226 (and 246) (http connect attempts) > 62.163.126.100 (same domain as yesterday) > > How do I track them back to the ISP's and send a message to their abuse@ > address? > > Someone's trying to ping me from 66.189.24.226 as well. > > Am I being paranoid or could my isp be trying to crack my firewall to > see if I've got any servers running? > > Time to batten down the hatches... > > Wes > > > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug >

April 18, 2002

Re: [Wlug] I hate crackers (not the kind you eat)

by Brian J. Conway

> Looking at my log file from my firewall reveals that not I've got > people trying to through my firewall from... > > 66.189.81.226 (and 246) (http connect attempts) > 62.163.126.100 (same domain as yesterday) > > How do I track them back to the ISP's and send a message to their abuse@ > address? > > Someone's trying to ping me from 66.189.24.226 as well. [dogbert@ladyluck /]$ host 66.189.81.226 226.81.189.66.in-addr.arpa domain name pointer cpe-66-189-81-226.ma.charter.com.[dogbert@ladyluck /]$ host 62.163.126.100 100.126.163.62.in-addr.arpa domain name pointer a126100.upc-a.chello.nl. [dogbert@ladyluck /]$ host 66.189.24.226 226.24.189.66.in-addr.arpa domain name pointer cpe-66-189-24-226.ma.charter.com. > Am I being paranoid or could my isp be trying to crack my firewall to > see if I've got any servers running? Port scanning isn't illegal, I wouldn't be that concerned unless something actually gets broken into, and it doesn't sound like you're in imminent danger of that. There's a lot of noise that's gonna show up in firewall or PortSentry-type logs, especially on cable or DSL IP ranges, I really don't pay it much attention myself. It's your call, of course. Brian J. Conway bconway(a)wpi.edu "LINUX is obsolete" - Andrew S. Tanenbaum, creator of Minix - Jan 29, 1992

April 18, 2002