- WLUG - wlug.mailman3.com

Cinik worm (mod_ssl)
by Richard Goodman Oct. 13, 2002

Oct. 13, 2002

I have two rather new RH7.3 servers, which I installed without any patches (dumb- had never installed patches before). A couple of weeks ago both got infected with [different] strains of the Cinik (mod_ssl) worm. On machine "A" I shut down Apache for about a week, and left "B" running. On 10/5/02 I downloaded and installed RH patches for apache, bind, glibc, openssh, openssl, php and mod_ssl on both machines. I deleted the cinik stuff from /tmp. Machine "B" has been worm-free since. Cinik reappeared on machine "A" overnight last night -- process running and the usual suspect files back in /tmp. I happened to look in /var/log/cron (on the subject of cron I am rather clueless) and saw the following suspicious entries in the time frame when I believe the worm reappeared: Oct 13 05:20:00 archive3 CROND[25572]: (root) CMD (/usr/bin/mrtg /etc/mrtg/mrtg.cfg) Oct 13 05:20:00 archive3 CROND[25573]: (root) CMD (/usr/lib/sa/sa1 1 1) Oct 13 05:25:00 archive3 CROND[25577]: (root) CMD (/usr/bin/mrtg /etc/mrtg/mrtg.cfg) Oct 13 05:26:34 archive3 crontab[25622]: (apache) REPLACE (apache) Oct 13 05:27:00 archive3 crond[858]: (apache) RELOAD (cron/apache) Oct 13 05:27:29 archive3 crontab[25630]: (apache) REPLACE (apache) Oct 13 05:27:29 archive3 crontab[25635]: (apache) REPLACE (apache) Oct 13 05:27:29 archive3 crontab[25640]: (apache) REPLACE (apache) Oct 13 05:27:29 archive3 crontab[25645]: (apache) REPLACE (apache) Oct 13 05:28:01 archive3 crond[858]: (apache) RELOAD (cron/apache) Oct 13 05:30:00 archive3 CROND[25666]: (root) CMD (/usr/bin/mrtg /etc/mrtg/mrtg.cfg) Oct 13 05:30:00 archive3 CROND[25667]: (root) CMD (/usr/lib/sa/sa1 1 1) Oct 13 05:35:00 archive3 CROND[25670]: (root) CMD (/usr/bin/mrtg /etc/mrtg/mrtg.cfg) Any suggestions as to what the log entries mean (i.e. who did what to Apache?), and why cinik has reappeared? Also, can someone point me towards a resource about cron so that I may become less clueless? Thanks, Dick

2 1

Installfest Media...
by Keller, Tim Oct. 12, 2002

Oct. 12, 2002

So currently I've got ISO's for Redhat 7.3/8.0 and Mandrake 8.0 (disks 1 and 2, but not the 3rd internationalization disk) What other distributions would people like me to make some copies of? Also, I'm going to put together my obligatory Disk-o-everything. As a side note, I personally think it would be cool if we could have a repository of WLUG goodies, but I know there'd be some logistics around that. So far this is what's going to be on it. (unless otherwise noted, assume I'll be grabbing the latest) Office Stuff: OpenOffice Gimpprint Kernel Stuff: Latest Stable Kernel Sources Latest Unstable Kernel Sources (would like some input here) Sound Stuff: alsa free OSS drivers lame bladeenc cdparanoia grip ogg-vorbis ultramaster xmms xmms plugins Video: Nvidia Drivers (I'll grab everything, for every version they've got) (would like some input here) Video Tools: Cinelerra (and all the stuff that comes with it like Xmovie, etc) (input please!) Burning Tools: cdlabelgen cdrtools gcombust gtoaster xcdroast Browsers: Mozilla Phoenix Opera Netscape plugins video-players: xine mplayer libdvdcss region-changer (would like some input here) Games: Deluxe Xkobo Mame (help...)

4 3

rpm build error
by Bill Mills-Curran Oct. 11, 2002

Oct. 11, 2002

I just rebuilt apache from the RH 8.0 source rpm. The compilation succeeded, but the rpm failed with the following error message: Checking for unpackaged file(s): /usr/lib/rpm/check-files /home/bcurran/tmp/rpmBuild/httpd-root error: Installed (but unpackaged) file(s) found: /etc/httpd/conf/mime.types /usr/bin/apr-config /usr/bin/apu-config /usr/lib/APRVARS <snip-more files> RPM build errors: Installed (but unpackaged) file(s) found: /etc/httpd/conf/mime.types /usr/bin/apr-config /usr/bin/apu-config /usr/lib/APRVARS <snip-more files> Neither the modified source nor the binary rpm were generated. It looks like these files made it into the temporary install area just prior to generating the packages, and they should not have been there. Is there an option I should be using to make the install tree "right"? I know I can modify the spec file to wildcard include everything in the install directories, but that doesn't seem right. My command: "rpmbuild -ba httpd.spec". TIA, Bill

2 3

:( - Need Sendmail Setting!
by Aramico Oct. 11, 2002

Oct. 11, 2002

Hi all, Can u please tell me if you have ever installed and configured sendmail bye your self ? I mean, please tell me step by step the thing have you done for it in order to get sendmail running properly ? Of course including all its need. the available tutorial not helping me so much, i need your detail.. Plz... Thanks...

1 0

Future WLUG meeting dates posted
by Andy Stewart Oct. 11, 2002

Oct. 11, 2002

HI Everybody, I've just posted the meeting dates for the first half of 2003 on the WLUG website. I've also extended an invitation to Jon 'Maddog' Hall to come to speak at a future WLUG meeting, and he has accepted our invitation. He'll visit during our February 20, 2003 meeting. Maddog travels alot and there was no way I could get him to come sooner (we tried). Remember that the Install Fest is only 2 weeks away! I haven't received any e-mails from prospective installees, but that doesn't surprise me since we still have 2 weeks until the event. Nonetheless, please start telling people about this event - advertise it on the WPI campus and tell all your friends! Later, Andy -- Andy Stewart, Founder Worcester Linux Users' Group Worcester, MA USA http://www.wlug.org

1 0

Linux Developer (Contract Position)
by Sylvain, Michael Oct. 10, 2002

Oct. 10, 2002

I am working on a three month contract in the Burlington, Ma area. If you or anyone you know might be interested in this position. Please contact me immediately. This is a Jr/Mid level position. Please let me know if you have any questions. Sincerely, Mike Sylvain Recruiter 800-482-9494 ext 6024 508-481-9500 ext. 6024 www.daviscos.com The Davis Companies 33 Boston Post Rd. West Marlborough, MA. 01752 Linux Developer The candidate will participate in the development of complete system architecture for a new mobile device. Responsibilities include significant Linux kernel programming, evaluation of Linux packages and applications and C/C++ programming. Qualifications: * Experience with Linux kernel * Familiar with embedded systems programming * Experience with C/C++ * Start work immediately Knowledge of the following will be a plus: * OS programming * Network programming / socket programming * IEEE 802.11 Wireless LAN * Bluetooth * Java and OOP Length: 3 Months possible extension

1 0

(no subject)
by Aramico Oct. 10, 2002

Oct. 10, 2002

Hi all, Can somebody inform me about what port that should I close in order to disable the connection for YahooMessanger, MSNMessanger, ICQ ? The thing that I wanna know is the port number on my server as clients gateway to connect to the internet that used by ICQ, YahooMesanger, and MSN Messanger. If somebody knows so, please tell me detail, Thanks, Bye there and have a nice day.

4 3

RE: [Wlug] fetchamail!
by Simoncini, Matthew Oct. 10, 2002

Oct. 10, 2002

I second that ... it soundsa good !! > -----Original Message----- > From: Chuck Homic [mailto:chuck@vvisions.com] > Sent: Thursday, October 10, 2002 10:18 AM > To: wlug(a)mail.wlug.org > Subject: Re: [Wlug] fetchamail! > > > On Thu, Oct 10, 2002 at 10:11:41AM -0400, Brian J. Conway wrote: > > While we're on this topic, does anyone know of any secure > alternatives to > > Fetchmail? There's seriously a new buffer overflow > announcement every > > week, and it's rather bothersome. I'd be happy to just use > the pop3 > > support in whichever mail client I'm using, but they all > seem to be using > > the Fetchmail code. Perhaps we need OpenFetchmail? ;-) > > Build fetchmail from sources, and link to electric fence. > > Then a dangerous exploit becomes merely an annoying denial of > service. ;) > > BTW, I propose officially changing the name to the much more melodious > 3-syllable FETCHAMAIL! > > -Chuck > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug >

1 0

RE: [Wlug] fetchamail!
by Keller, Tim Oct. 10, 2002

Oct. 10, 2002

Also, it should be noted that whatever version of fetchmail you've got on your machine, your going to want to upgrade it ASAP. A couple buffer overruns (via malformed mail) were just reported the other day... Tim. -----Original Message----- From: Chuck Homic [mailto:chuck@vvisions.com] Sent: Thursday, October 10, 2002 9:11 AM To: wlug(a)mail.wlug.org Subject: Re: [Wlug] fetchamail! On Thu, Oct 10, 2002 at 10:44:08AM +0700, Aramico wrote: > how can I get my email using fetchamil ? Fetchmail will use POP or IMAP to get your mail from a remote host and deposit it locally (using whatever local mail setup you have... I think it delivers to your local SMTP). Just make a .fetchmailrc with your servers/passwords and you're in business. "man fetchmail" for more info. -Chuck _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug

3 2

fetchamail!
by Aramico Oct. 10, 2002

Oct. 10, 2002

Hi all, how can I get my email using fetchamil ? What is the ./fetchmail listing to access my mail server ? Thanks,

3 2