Re: [gentoo-user] Suspend/Hibernate on Dell Inspiron 6000

2008-02-27 Thread Yahya Mohammad

On Wed, Feb 27, 2008 at 08:18:37AM +0930, Iain Buchanan wrote:
 I've never tried suspend to ram, so I don't have much help.  Did you try
 this with xdm shut down also?  You could try the vbetool settings in
 common.conf. Also, try with/without combinations of SwitchToTextMode,
 userui_program, etc.  And I don't know what AcpiVideoS3Bios but it's
 worth a try.

Yes, I did try with xdm shut down. When I enabled vbetool, hibernate to
disk stopped resuming too. I either got a blank screen, or one that
displayed lots of colors in a weird pattern before slowly turning off.

 As you can tell, I'm stabbing in the dark!  If you ultimately get
 nowhere, then the suspend2 users list has excellent help from some of
 the devs.

I'll check that list out too, thanks. It is quite a hassle testing this
though, next time I'm getting one of those vendor supported linux
laptops. Right now, I hope to get this working, and publish my settings
so others may be saved from the trouble.
-- 
gentoo-user@lists.gentoo.org mailing list



[gentoo-user] Links within HTML-pages not working any more in konqueror?

2008-02-27 Thread Erik
Unfortunately it seems like links within HTML-pages no longer works in 
kde-base/konqueror-3.5.8. When I past the following link in Firefox, it 
works fine and goes to line 343:

http://websvn.kde.org/tags/KDE/3.5.9/kdebase/kcontrol/energy/energy.cpp?annotate=774532#l343

But in Konqueror just goes to line 1.
--
gentoo-user@lists.gentoo.org mailing list



Re: [gentoo-user] System locale charset is ANSI_X3.4-1968

2008-02-27 Thread Etaoin Shrdlu
On Wednesday 27 February 2008, Richard Marzan wrote:

 System locale charset is ANSI_X3.4-1968

 I receive the message above after running k3b. I have my system
 locales set in /etc/locale.gen. I believe it is UTF-8. Moreover, idn
 --debug --quiet  corroborates k3b warning. Is there anything I can
 do?

What does 

$ echo $LC_ALL - $LANG

output?

Did you set your locale in /etc/env.d/02locale?
-- 
gentoo-user@lists.gentoo.org mailing list



[gentoo-user] Gtk-Message: Failed to load module gnomebreakpad

2008-02-27 Thread Shaochun Wang
Every time I launch acroread form the gnome-terminal, the following
warning is displayed:

Gtk-Message: Failed to load module gnomebreakpad: libgnomebreakpad.so:
cannot open shared object file: No such file or directory

Even though acoread works. But I am curious about this warning message,
does anyone know the reason?

THX

-- 
Shaochun Wang [EMAIL PROTECTED]

Jabber: [EMAIL PROTECTED]
-- 
gentoo-user@lists.gentoo.org mailing list



Re: [gentoo-user] md5sum for directories?

2008-02-27 Thread Etaoin Shrdlu
On Wednesday 27 February 2008, Stroller wrote:

  Of course, this does not detect a succesful, but somehow corrupted,
  copy
  (which should be exceptionally rare, anyway).

 Well perhaps I'm just being paranoid today.
 But how do I know that a successful, but somehow corrupted, copy has
 not occurred?

 What makes you confident that these are rare? I don't ask this to be
 antagonistic, just to increase my own confidence in the `cp` command.

Ah well, I have no statistics here. But I can say that such a thing has 
never occured to me in the past (or at least if it occured, I did not 
notice that). Not a definitive proof, I know; rather, just my 
experience. You are of course free to not trust me and, if you're truly 
paranoid, you probably should do so :-)

 I have to admit that I haven't run this command and I don't have any
 idea what its actual resource usage would be. I guess I'd be happy
 with a lower-grade of checksumming, if it would reduce the runtime to
 acceptable levels. With md5sum one can be - barring certain malicious
 external attacks - quite certain that a copied file is identical to
 the original. I would be happy with a the file's there and it looks
 ok level of confidence.

Well, md5deep has already been suggested. If you are content with a 
lower-grade checksumming, you could write your own script that compares 
file lenghts and calculate checksums only on the first n and last m 
bytes of each file, for some reasonable values of n and m (bigger is 
better, as you guess). This is what backuppc (an excellent backup 
software) does when it has to decide whether a file has changed (and 
thus has to be backed up) compared with the copy stored in the backup 
pool.
Read this for more info:

http://backuppc.sourceforge.net/faq/BackupPC.html#some_design_issues

The hashing function paragraph. Do note that (of course) that method is 
not 100% accurate and might report false negatives if the corruption is 
in the middle of the file and file length did not change.
-- 
gentoo-user@lists.gentoo.org mailing list



Re: [gentoo-user] Links within HTML-pages not working any more in konqueror?

2008-02-27 Thread Philip Webb
080227 Erik wrote:
 When I past the following link in Firefox, it goes to line 343:
   
 http://websvn.kde.org/tags/KDE/3.5.9/kdebase/kcontrol/energy/energy.cpp?annotate=774532#l343
 But in Konqueror just goes to line 1.

Confirmed here with Konqueror 3.5.9  Firefox 2.0.0.12 .
Lynx goes to the correct line, but Dillo goes to line 403 (!)

-- 
,,
SUPPORT ___//___,  Philip Webb : [EMAIL PROTECTED]
ELECTRIC   /] [] [] [] [] []|  Centre for Urban  Community Studies
TRANSIT`-O--O---'  University of Toronto
-- 
gentoo-user@lists.gentoo.org mailing list



Re: [gentoo-user] Links within HTML-pages not working any more in konqueror?

2008-02-27 Thread Alan McKinnon
On Wednesday 27 February 2008, Philip Webb wrote:
 080227 Erik wrote:
  When I past the following link in Firefox, it goes to line 343:
   
  http://websvn.kde.org/tags/KDE/3.5.9/kdebase/kcontrol/energy/energy
 .cpp?annotate=774532#l343 But in Konqueror just goes to line 1.

 Confirmed here with Konqueror 3.5.9  Firefox 2.0.0.12 .

Same here

-- 
Alan McKinnon
alan dot mckinnon at gmail dot com

-- 
gentoo-user@lists.gentoo.org mailing list



Re: [gentoo-user] Links within HTML-pages not working any more in konqueror?

2008-02-27 Thread Norberto Bensa
Alan McKinnon wrote:
 On Wednesday 27 February 2008, Philip Webb wrote:
  Confirmed here with Konqueror 3.5.9  Firefox 2.0.0.12 .

 Same here

http://bugs.kde.org

-- 
gentoo-user@lists.gentoo.org mailing list



[gentoo-user] how to update just one package ?

2008-02-27 Thread saifikhan
Hi:

On running 'emerge --fetchonly apache' on a Gentoo 2007.0 system, 
the following packages are expected to be downloaded ie.
 app-misc/mime-types-7
 app-admin/apache-tools
 www-servers/apache-2.2.6-r5

Along with these packages, there is a file gentoo-apache-2.2.6-r5 which
is required. However, the portage tree has 
gentoo-apache-2.2.6-r7-20080107.tar.bz2

Is there a way that i can update just one package ie. 
www-servers/apache-2.2.6-r5
so that is matches the gentoo-apache-2.2.6-r7 version file ?

Any pointers in this direction will be greatly appreciated.

thanks
Saifi.
-- 
gentoo-user@lists.gentoo.org mailing list



[gentoo-user] broken portage

2008-02-27 Thread Gavin Seddon
Hi,
When I use emerge I gt
'
'import site' failed; use -v for traceback
Traceback (most recent call last):
  File /usr/bin/emerge, line 23, in ?
import os, stat
ImportError: No module named os
'
Will someone tell me how to fix this pls?
GAVIN
-- 
gentoo-user@lists.gentoo.org mailing list



Re: [gentoo-user] broken portage

2008-02-27 Thread Neil Bothwick
On Wed, 27 Feb 2008 13:43:28 +, Gavin Seddon wrote:

 'import site' failed; use -v for traceback
 Traceback (most recent call last):
   File /usr/bin/emerge, line 23, in ?
 import os, stat
 ImportError: No module named os

os is a core Python module. Have you recently emerged or unmerged a
version of Python?


-- 
Neil Bothwick

If you cannot fix it, feature it.


signature.asc
Description: PGP signature


Re: [gentoo-user] how to update just one package ?

2008-02-27 Thread Elyahou ITTAH
2008/2/27, [EMAIL PROTECTED] [EMAIL PROTECTED]:
 Hi:

  On running 'emerge --fetchonly apache' on a Gentoo 2007.0 system,
  the following packages are expected to be downloaded ie.
   app-misc/mime-types-7
   app-admin/apache-tools
   www-servers/apache-2.2.6-r5

  Along with these packages, there is a file gentoo-apache-2.2.6-r5 which
  is required. However, the portage tree has 
 gentoo-apache-2.2.6-r7-20080107.tar.bz2

  Is there a way that i can update just one package ie. 
 www-servers/apache-2.2.6-r5
  so that is matches the gentoo-apache-2.2.6-r7 version file ?

  Any pointers in this direction will be greatly appreciated.

  thanks
  Saifi.

 --
  gentoo-user@lists.gentoo.org mailing list



Maybe emerge --sync before...
-- 
gentoo-user@lists.gentoo.org mailing list



Re: [gentoo-user] broken portage

2008-02-27 Thread Gavin Seddon
Neil Bothwick wrote:
 On Wed, 27 Feb 2008 13:43:28 +, Gavin Seddon wrote:
 
 'import site' failed; use -v for traceback
 Traceback (most recent call last):
   File /usr/bin/emerge, line 23, in ?
 import os, stat
 ImportError: No module named os
 
 os is a core Python module. Have you recently emerged or unmerged a
 version of Python?
 
 
I'm unsure.  I mean I started using software that creates its own python
enviroment.  This may have done it.  How do I replace python wout portag?
THANKS
GAVIN
-- 
gentoo-user@lists.gentoo.org mailing list



[gentoo-user] Renaming tons of files

2008-02-27 Thread Amar Cosic
Hello

I have issue where I have something.TXT something.PDF and I need to rename
them to something.txt something.pdf (so with lower cases) . Is there any
easy way to do this (command,script? )

Thanks

-- 
Amar Ćosić
[EMAIL PROTECTED]
[EMAIL PROTECTED]
+38761240095
http://www.amar.co.ba


Re: [gentoo-user] Renaming tons of files

2008-02-27 Thread Daniel Iliev
On Wed, 27 Feb 2008 16:12:41 +0100
Amar Cosic [EMAIL PROTECTED] wrote:

 Hello
 
 I have issue where I have something.TXT something.PDF and I need to
 rename them to something.txt something.pdf (so with lower cases) . Is
 there any easy way to do this (command,script? )
 
 Thanks
 



Use at your own risk. Make a backup before try.

1)
rename .PDF .pdf *.PDF
rename .TXT .txt *.TXT


2)
find . -iname *.pdf -o -iname *.txt | while read -r oldname
do
newname=$(echo ${fname} | tr [[:upper:]] [[:lower:]])
mv ${oldname} ${newname}
done




-- 
Best regards,
Daniel
-- 
gentoo-user@lists.gentoo.org mailing list



Re: [gentoo-user] Renaming tons of files

2008-02-27 Thread Amar Cosic
rename command worked (everything is still here :)) ) . Thanks Daniel



On Wed, Feb 27, 2008 at 4:30 PM, Daniel Iliev [EMAIL PROTECTED]
wrote:

 On Wed, 27 Feb 2008 16:12:41 +0100
 Amar Cosic [EMAIL PROTECTED] wrote:

  Hello
 
  I have issue where I have something.TXT something.PDF and I need to
  rename them to something.txt something.pdf (so with lower cases) . Is
  there any easy way to do this (command,script? )
 
  Thanks
 



 Use at your own risk. Make a backup before try.

 1)
 rename .PDF .pdf *.PDF
 rename .TXT .txt *.TXT


 2)
 find . -iname *.pdf -o -iname *.txt | while read -r oldname
 do
newname=$(echo ${fname} | tr [[:upper:]] [[:lower:]])
mv ${oldname} ${newname}
 done




 --
 Best regards,
 Daniel
 --
 gentoo-user@lists.gentoo.org mailing list




-- 
Amar Ćosić
[EMAIL PROTECTED]
[EMAIL PROTECTED]
+38761240095
http://www.amar.co.ba


Re: [gentoo-user] Renaming tons of files

2008-02-27 Thread Erik

Amar Cosic skrev:

I have issue where I have something.TXT something.PDF and I need to rename
them to something.txt something.pdf (so with lower cases) . Is there any
easy way to do this (command,script? )
  

emerge kde-misc/krename and see if it is useful to you.
--
gentoo-user@lists.gentoo.org mailing list



Re: [gentoo-user] Renaming tons of files

2008-02-27 Thread Galevsky
On Wed, Feb 27, 2008 at 4:40 PM, Erik [EMAIL PROTECTED] wrote:
 Amar Cosic skrev:

  emerge kde-misc/krename and see if it is useful to you.

emerging extra stuff just for a very simple mv or rename ? Oh my God .

Gal'
-- 
gentoo-user@lists.gentoo.org mailing list



Re: [gentoo-user] Renaming tons of files

2008-02-27 Thread Alan McKinnon
On Wednesday 27 February 2008, Galevsky wrote:
 On Wed, Feb 27, 2008 at 4:40 PM, Erik [EMAIL PROTECTED] wrote:
  Amar Cosic skrev:
 
   emerge kde-misc/krename and see if it is useful to you.

 emerging extra stuff just for a very simple mv or rename ? Oh my God
 .

The download is 82kB.
The build is  30 seconds

I shudder to think of the number of times I've written a script to do 
exactly this job, how many times I've seen this exact question on many 
mailing lists and the sheer frustration of dealing with all the edge 
cases. THIS emerge is infinitely cheaper than other way to do the same 
job.

And it's not A rename the OP wants to do - check the thread title

-- 
Alan McKinnon
alan dot mckinnon at gmail dot com

-- 
gentoo-user@lists.gentoo.org mailing list



[gentoo-user] SSH brute force attacks and blacklist.py

2008-02-27 Thread Steve
I can't believe that I'm the only person with this, so it's probably 
worth asking.


I'm one of the (many) people who has opportunists trying usernames and 
passwords against SSH... while every effort has been made to secure this 
service by configuration; strong passwords; no root login remotely etc.  
I would still prefer to block sites using obvious dictionary attacks 
against me.


I used to use DenyHosts - but that became annoying as it used rather a 
lot of resources (and relied upon tcp wrappers... which, I'm informed 
are somewhat old-fashioned)


I migrated to try using iptables as my firewall and using blacklist.py - 
which I got working after some minor config-tweaking.  I'm aware that 
there is configuration in the blacklist.py script for BLOCKING_PERIOD - 
but what I really miss the blocked forever nature of the DenyHosts 
alternative though I prefer every other aspect of the 
iptables/blacklist.py approach.


Has anyone else resolved this?  As far as I'm concerned, once I detect 
someone has attempted a brute force (which blaclist.py does 
fantastically well) what I want is for no further communication to be 
accepted from the IP address - even after I reboot etc.  While I don't 
know which sites I want to be accessible from in advance, I can be sure 
none of them would launch a brute force attack against me. :-)


Recommendations?

I'm looking for the neatest Gentoo way to do this... rather than 
recommendations for how to write something to do what I want from scratch...


Steve

--
gentoo-user@lists.gentoo.org mailing list



Re: [gentoo-user] Renaming tons of files

2008-02-27 Thread Etaoin Shrdlu
On Wednesday 27 February 2008, Alan McKinnon wrote:
 On Wednesday 27 February 2008, Galevsky wrote:
  On Wed, Feb 27, 2008 at 4:40 PM, Erik [EMAIL PROTECTED] wrote:
   Amar Cosic skrev:
  
emerge kde-misc/krename and see if it is useful to you.
 
  emerging extra stuff just for a very simple mv or rename ? Oh my God
  .

 The download is 82kB.
 The build is  30 seconds

Well...if you have kde or most of its libraries already in place. 
Otherwise I think it's not as lightweight :-)
-- 
gentoo-user@lists.gentoo.org mailing list



Re: [gentoo-user] Renaming tons of files

2008-02-27 Thread Alan McKinnon
On Wednesday 27 February 2008, Etaoin Shrdlu wrote:
 On Wednesday 27 February 2008, Alan McKinnon wrote:
  On Wednesday 27 February 2008, Galevsky wrote:
   On Wed, Feb 27, 2008 at 4:40 PM, Erik [EMAIL PROTECTED] wrote:
Amar Cosic skrev:
   
 emerge kde-misc/krename and see if it is useful to you.
  
   emerging extra stuff just for a very simple mv or rename ? Oh my
   God .
 
  The download is 82kB.
  The build is  30 seconds

 Well...if you have kde or most of its libraries already in place.
 Otherwise I think it's not as lightweight :-)

kde 

/me double checks original mail

Oops. That was krename. I read rename and tested such.

/me thinks it's time to remember that only livestock are supposed to get 
Foot and Mouth disease, not geeks sheepish grin

-- 
Alan McKinnon
alan dot mckinnon at gmail dot com

-- 
gentoo-user@lists.gentoo.org mailing list



[gentoo-user] Re: SSH brute force attacks and blacklist.py

2008-02-27 Thread 7v5w7go9ub0o

Steve wrote:
I can't believe that I'm the only person with this, so it's probably 
worth asking.


I'm one of the (many) people who has opportunists trying usernames and 
passwords against SSH... while every effort has been made to secure this 
service by configuration; strong passwords; no root login remotely etc.  
I would still prefer to block sites using obvious dictionary attacks 
against me.


I used to use DenyHosts - but that became annoying as it used rather a 
lot of resources (and relied upon tcp wrappers... which, I'm informed 
are somewhat old-fashioned)


I migrated to try using iptables as my firewall and using blacklist.py - 
which I got working after some minor config-tweaking.  I'm aware that 
there is configuration in the blacklist.py script for BLOCKING_PERIOD - 
but what I really miss the blocked forever nature of the DenyHosts 
alternative though I prefer every other aspect of the 
iptables/blacklist.py approach.


Has anyone else resolved this?  As far as I'm concerned, once I detect 
someone has attempted a brute force (which blaclist.py does 
fantastically well) what I want is for no further communication to be 
accepted from the IP address - even after I reboot etc.  While I don't 
know which sites I want to be accessible from in advance, I can be sure 
none of them would launch a brute force attack against me. :-)


Recommendations?


If this is a personal or low-user connection, consider fwknop - single 
packet authorization port knocking.


- works well for my home box
- the port simply drops pings, connection attempts, etc. 'til opened
- fwknop uses pcap to listen for authorization packets; when one comes 
through with the correct (encrypted) command, it'll send an iptables 
command to temporarily open the port for a designated period of time 
allowing you to connect. The encrypted packets include a time of day 
field to prevent replay attacks.



http://www.cipherdyne.org/fwknop/download/



I'm looking for the neatest Gentoo way to do this... rather than 
recommendations for how to write something to do what I want from 
scratch...


fwknop is not Gentoo; but compiles cleanly.

HTH


--
gentoo-user@lists.gentoo.org mailing list



[gentoo-user] Re: SSH brute force attacks and blacklist.py

2008-02-27 Thread 7v5w7go9ub0o

Sorry  here's the link I should have posted:

http://www.cipherdyne.org/fwknop/
--
gentoo-user@lists.gentoo.org mailing list



Re: [gentoo-user] SSH brute force attacks and blacklist.py

2008-02-27 Thread Alan McKinnon
On Wednesday 27 February 2008, Steve wrote:

 I migrated to try using iptables as my firewall and using
 blacklist.py - which I got working after some minor config-tweaking. 
 I'm aware that there is configuration in the blacklist.py script for
 BLOCKING_PERIOD - but what I really miss the blocked forever nature
 of the DenyHosts alternative though I prefer every other aspect
 of the
 iptables/blacklist.py approach.

blacklist.py seems to work well for you, so why not just set 
BLOCKING_PERIOD to it's maximum value?

I would imagine that even after say one week the vast majority of zombie 
bots would have given up and moved on



-- 
Alan McKinnon
alan dot mckinnon at gmail dot com

-- 
gentoo-user@lists.gentoo.org mailing list



Re: [gentoo-user] Links within HTML-pages not working any more in konqueror?

2008-02-27 Thread Erik

Norberto Bensa skrev:

Alan McKinnon wrote:
  

On Wednesday 27 February 2008, Philip Webb wrote:


Confirmed here with Konqueror 3.5.9  Firefox 2.0.0.12 .
  

Same here



http://bugs.kde.org


http://bugs.kde.org/show_bug.cgi?id=57360 to be precise (in case anyone 
wants to subscribe or vote). It is the 36th most hated bug in KDE.

--
gentoo-user@lists.gentoo.org mailing list



Re: [gentoo-user] Renaming tons of files

2008-02-27 Thread Uwe Thiem
On Wednesday 27 February 2008, Alan McKinnon wrote:

 /me thinks it's time to remember that only livestock are supposed
 to get Foot and Mouth disease, not geeks sheepish grin

People (including geeks) can get it as well. It's hard but possible to 
get infected. Sieve the spores out of your soil. Then inhale *lots* 
of them.

Uwe

-- 
Informal Linux Group Namibia:
http://www.linux.org.na/
SysEx (Pty) Ltd.:
http://www.SysEx.com.na/
-- 
gentoo-user@lists.gentoo.org mailing list



Re: [gentoo-user] Renaming tons of files

2008-02-27 Thread Markus Schönhaber
Alan McKinnon wrote:

 And it's not A rename the OP wants to do - check the thread title

The thread title, the OP and the OP's reply to the suggestion to let
rename do the job make me think that a rename is exactly what the OP
wants to do.

Regards
  mks


-- 
gentoo-user@lists.gentoo.org mailing list



Re: [gentoo-user] SSH brute force attacks and blacklist.py

2008-02-27 Thread Justin



Steve schrieb:
I can't believe that I'm the only person with this, so it's probably 
worth asking.


I'm one of the (many) people who has opportunists trying usernames and 
passwords against SSH... while every effort has been made to secure 
this service by configuration; strong passwords; no root login 
remotely etc.  I would still prefer to block sites using obvious 
dictionary attacks against me.


I used to use DenyHosts - but that became annoying as it used rather a 
lot of resources (and relied upon tcp wrappers... which, I'm informed 
are somewhat old-fashioned)


I migrated to try using iptables as my firewall and using blacklist.py 
- which I got working after some minor config-tweaking.  I'm aware 
that there is configuration in the blacklist.py script for 
BLOCKING_PERIOD - but what I really miss the blocked forever nature 
of the DenyHosts alternative though I prefer every other aspect of 
the iptables/blacklist.py approach.


Has anyone else resolved this?  As far as I'm concerned, once I detect 
someone has attempted a brute force (which blaclist.py does 
fantastically well) what I want is for no further communication to be 
accepted from the IP address - even after I reboot etc.  While I don't 
know which sites I want to be accessible from in advance, I can be 
sure none of them would launch a brute force attack against me. :-)


Recommendations?

I'm looking for the neatest Gentoo way to do this... rather than 
recommendations for how to write something to do what I want from 
scratch...


Steve



Try fail2ban. I started as newby on iptables and I still am, because it 
is very easy to configure and does it job perfect.


http://gentoo-wiki.com/HOWTO_fail2ban
http://www.fail2ban.org/wiki/index.php/Main_Page
--
gentoo-user@lists.gentoo.org mailing list



[gentoo-user] Re: Renaming tons of files

2008-02-27 Thread Amar Cosic
Yea.. Thanks to all of you for sugestions. Its server without X so
krename is out. Anyway rename did the job. Thanks again

On 2/27/08, Markus Schönhaber [EMAIL PROTECTED] wrote:
 Alan McKinnon wrote:

  And it's not A rename the OP wants to do - check the thread title

 The thread title, the OP and the OP's reply to the suggestion to let
 rename do the job make me think that a rename is exactly what the OP
 wants to do.

 Regards
   mks


 --
 gentoo-user@lists.gentoo.org mailing list




-- 
Amar Ćosić
[EMAIL PROTECTED]
[EMAIL PROTECTED]
+38761240095
http://www.amar.co.ba


Re: [gentoo-user] Re: Digest of gentoo-user@lists.gentoo.org issue 1418 (76078-76127)

2008-02-27 Thread sync test1
2008/2/26 [EMAIL PROTECTED]:

 Por las nuevas políticas de calidad ISO 9001 que la empresa está
 implementando, todos los temas relacionados con soporte técnico deben ser
 realizadas al correo electrónico [EMAIL PROTECTED]

 Muchas gracias y disculpe las molestías.

 Automáticamente este email será reenvio a [EMAIL PROTECTED]



 --
 gentoo-user@lists.gentoo.org mailing list




[gentoo-user] Re: SSH brute force attacks and blacklist.py

2008-02-27 Thread Remy Blank

Steve wrote:
I'm one of the (many) people who has opportunists trying usernames and 
passwords against SSH... while every effort has been made to secure this 
service by configuration; strong passwords; no root login remotely etc.  
I would still prefer to block sites using obvious dictionary attacks 
against me.


The best advice I can give is to use public key authentication only. 
This will defend against all dictionary-based attacks, which is what you 
describe.


The only remaining problem is that your log files will be filled with 
unsuccessful login attempts. A simple solution is to run sshd on a 
non-standard, high-numbered port, e.g. in the 30'000. Bots only ever try 
to connect on port 22. This will *not* improve the protection of your 
server, but it will avoid having your logs spammed.


-- Remy



signature.asc
Description: OpenPGP digital signature


[gentoo-user] Re: SSH brute force attacks and blacklist.py

2008-02-27 Thread Anno v. Heimburg
Justin wrote:

 Try fail2ban

Alternatively, you can use the builtin iptables connection rate limiter.

Excerpt from my home-grown firewall script:


for port in $INPUT_LIMITER_TCPPORTS; do
$IPT_IN -p tcp  --dport $port -m state --state NEW -m \
recent --name limit-${port} --set
$IPT_IN -p tcp  --dport $port -m state --state NEW -m \
recent --name limit-${port} --rcheck --seconds
$INPUT_LIMITER_TIME --hitcount $INPUT_LIMITER_COUNT -j \
LOG --log-prefix limit-rjct-${port} 
$IPT_IN -p tcp  --dport $port -m state --state NEW -m \
recent --name limit-${port} --rcheck --seconds
$INPUT_LIMITER_TIME --hitcount $INPUT_LIMITER_COUNT -j REJECT \
$IPT_IN -p tcp  --dport $port -m state --state NEW -j
LOG --log-level notice --log-prefix limit-acpt-${port}  \
$IPT_IN -p tcp  --dport $port -m state --state NEW -j ACCEPT
done


It limits the number of new connections on each port in
INPUT_LIMITER_TCPPORTS from any individual host to INPUT_LIMITER_COUNT
within INPUT_LIMITER_TIME.

More precisely, it does the following:

1. When a new connection is established by a previously unkown host, set a
mark (first rule).
2. When the number of marks from that host has exceeded the specified upper
connection limit, reject the connection (third rule), you could also drop.
3. Otherwise, accept the connection (fifth rule)

Rules numbers 2 and 4 are for logging purposes only, and have no impact on
functionality. By using --log-prefix, you can use your logging daemon's
filtering capabilities to sort these requests into new 

The count is reset after INPUT_LIMITER_TIME seconds have passed. Thus, after
exceeding INPUT_LIMITER_COUNT, you have to wait for $INPUT_LIMITER_SECONDS
before a new attempt.

Oh yeah, $IPT_IN is shorthand for ${IPTABLES} -t filter -A INPUT, where
${IPTABLES} points to the iptables executable, of course.

The advantage of this solution is that it does not rely on log files parsing
or any other magic, it simply counts the number of connections from each
host on a specific port. It it does very easy on CPU and very stable, it
continues working as long as your kernel works.

The disadvantage is that it does not rely on log files parsing or any other
magic, it simply counts the number of connections from each host on a
specific port. It cannot do anything clever. Also, your iptables -L output
gets a bit cluttered by adding five rules for every port you want to
rate-limit.

Anno.

-- 
gentoo-user@lists.gentoo.org mailing list



Re: [gentoo-user] Re: SSH brute force attacks and blacklist.py

2008-02-27 Thread Iain Buchanan

On Wed, 2008-02-27 at 21:24 +0100, Remy Blank wrote:

  A simple solution is to run sshd on a 
 non-standard, high-numbered port, e.g. in the 30'000. Bots only ever try 
 to connect on port 22. This will *not* improve the protection of your 
 server, but it will avoid having your logs spammed.

+1

I hosed my router, and had to go back to an old one that could only
forward port 22 to an internal machine port 22.  I got lots of brute
force attacks.  Well, most of them only tried about 5 passwords each, so
not exactly brute force...  Anyway, once I upgraded my router again and
forwarded port x to port 22, I haven't seen one since.

HTH,
-- 
Iain Buchanan iaindb at netspace dot net dot au

Linux - because software problems should not cost money.

   -- Shlomi Fish

-- 
gentoo-user@lists.gentoo.org mailing list



Re: [gentoo-user] System locale charset is ANSI_X3.4-1968

2008-02-27 Thread Richard Marzan
 On Wednesday 27 February 2008, Richard Marzan wrote:
 
  System locale charset is ANSI_X3.4-1968
 
  I receive the message above after running k3b. I have my system
  locales set in /etc/locale.gen. I believe it is UTF-8. Moreover, idn
  --debug --quiet  corroborates k3b warning. Is there anything I can
  do?
 
 What does 
 
 $ echo $LC_ALL - $LANG
 
 output?
 
 Did you set your locale in /etc/env.d/02locale?

$ echo $LC_ALL - $LANG give  - C

I don't have an /etc/env.d/02locale file. I don't know the syntax of
this file. I will need a sample...I'll goog-it.


-- 
gentoo-user@lists.gentoo.org mailing list