Re: [OT] Recommendations for CV/Resume Writers

2005-09-15 Thread Steve Holdoway
I'm well over 30, and had 17 years of UK education, and nobody ever taught
me grammar. However, even I know that slashdot (link from Nick) need to
learn some... they'll be writing 'a hotel' next (:

Steve

On Thu, September 15, 2005 12:59 pm, Roger Searle wrote:
 who over 30 can?  i sure can't...


 Christopher Sawtell wrote:

On Thu, 15 Sep 2005 12:01, Nick Rout wrote:


I regularly receive CV's from Germans looking to spend their three
month elective working in a law office in NZ. Their spelling and
grammar are usually perfect.



Ah. But they are actually taught the grammar of the English Language in
 all
it's glorious detail as part of of their curriculum. It just doesn't
 happen
in most of the English speaking world. e.g. who under the age of 30 on
 this
list can tell us what a gerund is -- without looking it up.







-- 
Windows: Where do you want to go today?
MacOS: Where do you want to be tomorrow?
Linux: Are you coming or what?


Re: [OT] Recommendations for CV/Resume Writers

2005-09-15 Thread Steve Holdoway

On Thu, September 15, 2005 3:49 pm, Volker Kuhlmann wrote:
 grave action=dig owner=self

 You might want to investigate the use of apostrophies between the
 letters it and s... ;)

 /grave

pedant
apostrophes
/pedant

Get digging (:

Steve

-- 
Windows: Where do you want to go today?
MacOS: Where do you want to be tomorrow?
Linux: Are you coming or what?


Re: [OT] Recommendations for CV/Resume Writers

2005-09-15 Thread Christopher Sawtell
On Thu, 15 Sep 2005 18:31, Steve Holdoway wrote:
 On Thu, September 15, 2005 3:49 pm, Volker Kuhlmann wrote:
  grave action=dig owner=self
 
  You might want to investigate the use of apostrophies between the
  letters it and s... ;)
 
  /grave

 pedant
 apostrophes
 /pedant

 Get digging (:

pedantry type='total'
There is only one apostrophe associated with the words its and it's
so the above sentence should read:-
You need to investigate the use of the apostrophe in, and meanings of, the 
words its and it's.

The apostrophe substitutes for the letter i and the preceding space in the 
word pair it is. The word its ( no apostrophe ) is the possesive of it. 
The one exception to the use of the apostrophe to signify the possesive.
/pedantry

Isn't the English language so much fun? :-)

Now all we need to do is to get the use of their, there, and the're sorted 
out, and we'll be able to tell the dotty slashers where to go.

-- 
CS


Re: [OT] Recommendations for CV/Resume Writers

2005-09-15 Thread yuri
On 15/09/05, Christopher Sawtell wrote:
 Ah. But they are actually taught the grammar of the English Language in all
 it's glorious detail as part of of their curriculum. It just doesn't happen
 in most of the English speaking world. e.g. who under the age of 30 on this
 list can tell us what a gerund is -- without looking it up.

I can tell you.
/me checks age -- oops, 32. You weren't talking to me :)
Anyway, I learned about gerunds and other forms in Latin, not in English.

I'm such a language geek, last time I was introduced to a girl called
Amanda I replied Oh, as in the gerundive of the latin verb amare?

Actually, that *is* where the name comes from.

Yuri
-- 
** WARNING to mailing list repliers **
Gmail over-rides Reply-To: field. Check your To: address before
sending reply to this post.


Re: [OT] and soooo pedantic. Recommendations for CV/Resume Writers

2005-09-15 Thread Steve Holdoway

On Thu, September 15, 2005 7:20 pm, Christopher Sawtell wrote:

 pedantry type='total'
 There is only one apostrophe associated with the words its and it's
 so the above sentence should read:-
 You need to investigate the use of the apostrophe in, and meanings of, the
 words its and it's.

Incorrect. The use of apostrophes is a perfectly acceptable English
phrase. See http://www.apostrophe.fsnet.co.uk/ and
http://owl.english.purdue.edu/handouts/grammar/g_apost.html

 Isn't the English language so much fun? :-)

 Now all we need to do is to get the use of their, there, and the're sorted
 out, and we'll be able to tell the dotty slashers where to go.

 --
 CS


they're?

(:

Steve

-- 
Windows: Where do you want to go today?
MacOS: Where do you want to be tomorrow?
Linux: Are you coming or what?


Re: [OT] Recommendations for CV/Resume Writers

2005-09-15 Thread Graeme Chinnery

John Carter wrote:

On Thu, 15 Sep 2005, david merriman wrote:

I want to get a new CV/Resume written, and being a bit of a geek I'm 
not being that good at self-promotion ;-) , so I'd like a little help 
doing this. Does anyone have any recommendations for companies that 
produce good 'technical' CV's for IT personnel (programmers in 
particular) ?



You need to change your self image for awhile.

Your self image is that of Geek, but when you haven't got a job, have 
have got a job.


Salesman.

You're a salesman of a single, big ticket item.

Yourself.

So for now lose the Geek self image and think of yourself as a 
Salesman for a rather pricey item.


As a Geek you would never say, I can't do tech X, you would say I 
would love to learn to do tech X. I'm going to sit down and work at it 
until I can.


So you've got a job. Get to it. Sit down and get to work and learn to 
sell yourself.


Once you have sold yourself, you can shuck off that skin and get back to 
being a comfortable Geek.


On the other hand, keep some of the old Salesman personality around, you 
never know when you are going to need him again to sell your great idea 
to management, convince a big customer that your tech is best, 



John Carter Phone : (64)(3) 358 6639
Tait ElectronicsFax   : (64)(3) 359 4632
PO Box 1645 ChristchurchEmail : [EMAIL PROTECTED]
New Zealand

Carter's Clarification of Murphy's Law.

Things only ever go right so that they may go more spectacularly wrong 
later.



From this principle, all of life and physics may be deduced.






And I have a C/V writer program you can have a copy of if you want it.

Graeme.


Re: [OT] Recommendations for CV/Resume Writers

2005-09-15 Thread Philip Charles
On Thu, 15 Sep 2005 19:20, Christopher Sawtell wrote:

 Isn't the English language so much fun? :-)

 Now all we need to do is to get the use of their, there, and the're
 sorted out, and we'll be able to tell the dotty slashers where to go.

You will need to include colour, labour, disc etc  ;)

Phil. 
--
  Philip Charles; 39a Paterson Street, Abbotsford, Dunedin, New Zealand
   +64 3 488 2818Fax +64 3 488 2875Mobile 025 267 9420
 [EMAIL PROTECTED] - preferred.  [EMAIL PROTECTED]
  I sell GNU/Linux  GNU/Hurd CDs  DVDs.   See http://www.copyleft.co.nz


Re: [OT] Recommendations for CV/Resume Writers

2005-09-15 Thread Nick Rout
On Thu, 2005-09-15 at 19:20 +1200, Christopher Sawtell wrote:
 the're
?
-- 
Nick Rout [EMAIL PROTECTED]



Re: [OT] Recommendations for CV/Resume Writers

2005-09-15 Thread Christopher Sawtell
On Thu, 15 Sep 2005 21:05, Nick Rout wrote:
 On Thu, 2005-09-15 at 19:20 +1200, Christopher Sawtell wrote:
  the're

 ?
Yes, indeed!

They're is the trans-atlantic patois form.
Anyway that's what I was taught at school all those years ago.

-- 
CS


Re: [OT] Recommendations for CV/Resume Writers

2005-09-15 Thread Steve Holdoway
http://www.askoxford.com/concise_oed/theyre?view=uk

COED, Google and I have never heard of your alternative!

Steve

On Thu, September 15, 2005 9:23 pm, Christopher Sawtell wrote:
 On Thu, 15 Sep 2005 21:05, Nick Rout wrote:
 On Thu, 2005-09-15 at 19:20 +1200, Christopher Sawtell wrote:
  the're

 ?
 Yes, indeed!

 They're is the trans-atlantic patois form.
 Anyway that's what I was taught at school all those years ago.

 --
 CS



-- 
Windows: Where do you want to go today?
MacOS: Where do you want to be tomorrow?
Linux: Are you coming or what?


Re: [OT] Recommendations for CV/Resume Writers

2005-09-15 Thread Richard Tindall

Nick Rout wrote:


On Thu, 2005-09-15 at 21:23 +1200, Christopher Sawtell wrote:
 


the're
   


?
 


Yes, indeed!

They're is the trans-atlantic patois form.
Anyway that's what I was taught at school all those years ago.
   



Interesting, here is me thinking you had made a pselling mistake.
 


They are / them are = the're
   - a non-specific generalisation, rarely used.
   - derived from grrr.

:-)

--
FreeNix!



Re: [OT] Recommendations for CV/Resume Writers

2005-09-15 Thread Wesley Parish
On Thu, 15 Sep 2005 19:20, Christopher Sawtell wrote:
 On Thu, 15 Sep 2005 18:31, Steve Holdoway wrote:
  On Thu, September 15, 2005 3:49 pm, Volker Kuhlmann wrote:
   grave action=dig owner=self
  
   You might want to investigate the use of apostrophies between the
   letters it and s... ;)
  
   /grave
 
  pedant
  apostrophes
  /pedant
 
  Get digging (:

 pedantry type='total'
 There is only one apostrophe associated with the words its and it's
 so the above sentence should read:-
 You need to investigate the use of the apostrophe in, and meanings of, the
 words its and it's.

 The apostrophe substitutes for the letter i and the preceding space in the
 word pair it is. The word its ( no apostrophe ) is the possesive of
 it. The one exception to the use of the apostrophe to signify the
 possesive. /pedantry

 Isn't the English language so much fun? :-)

 Now all we need to do is to get the use of their, there, and the're sorted
 out, and we'll be able to tell the dotty slashers where to go.
corrigendum
their, there and they're
/corrigendum
;)

-- 
Clinersterton beademung, with all of love - RIP James Blish
-
Mau e ki, he aha te mea nui?
You ask, what is the most important thing?
Maku e ki, he tangata, he tangata, he tangata.
I reply, it is people, it is people, it is people.


Re: [OT] Recommendations for CV/Resume Writers

2005-09-15 Thread Wesley Parish
On Thu, 15 Sep 2005 13:00, Nick Rout wrote:
 On Thu, 15 Sep 2005 12:54:49 +1200

 Michael JasonSmith wrote:
  My favourite grammar question annoys many wingers: what is a person from
  Canterbury called?

 One-eyed?
That was the result of Richard Lowe (King Richard) getting in some practice, 
or so I heard ... ;)

Wesley Parish
-- 
Clinersterton beademung, with all of love - RIP James Blish
-
Mau e ki, he aha te mea nui?
You ask, what is the most important thing?
Maku e ki, he tangata, he tangata, he tangata.
I reply, it is people, it is people, it is people.


Re: [OT] Recommendations for CV/Resume Writers

2005-09-15 Thread Wesley Parish
On Thu, 15 Sep 2005 12:05, Christopher Sawtell wrote:
 On Thu, 15 Sep 2005 11:45, Craig FALCONER wrote:
  grammer

 The Collaborative International Dictionary of English v.0.48 [gcide]
 grammer \grammer\ (gr[a^]mm[~e]r) n.
Grammar; -- a common misspelling. [Misspelling]
[PJC]

 :-)

 My point precisely I think.

Actually, I thought Grammer was an English Midlands dialect word for 
grand-mother, the other being Gramps for grand-father. ;)

I could be wrong ... ;)

Wesley Parish
-- 
Clinersterton beademung, with all of love - RIP James Blish
-
Mau e ki, he aha te mea nui?
You ask, what is the most important thing?
Maku e ki, he tangata, he tangata, he tangata.
I reply, it is people, it is people, it is people.


Re: [OT] Recommendations for CV/Resume Writers

2005-09-15 Thread Christopher Sawtell
On Thu, 15 Sep 2005 21:44, Nick Rout wrote:
 On Thu, 2005-09-15 at 21:23 +1200, Christopher Sawtell wrote:
  On Thu, 15 Sep 2005 21:05, Nick Rout wrote:
   On Thu, 2005-09-15 at 19:20 +1200, Christopher Sawtell wrote:
the're
  
   ?
 
  Yes, indeed!
 
  They're is the trans-atlantic patois form.
  Anyway that's what I was taught at school all those years ago.

 Interesting, here is me thinking you had made a pselling mistake.
pselling? nice one! much better than speeling.

 Must confess to never seeing the're before. Will consult wife with
 engrish degree. (lit not lang)

It is also quite a possibility that said teacher got it wrong.
He also told us that aweful was the correct spelling for the word which is a 
synonym of ghastly. I am now quite convinced that he was utterly wrong on 
that one. Similarly arn't. Interesting how language changes.

-- 
CS


configure shortcut

2005-09-15 Thread motivated
I have a shortcut icon (CD-ROM device) on my desktop. Clicking on it gets
me:
/home/kelvyn/desktop/cd-rom device is of type FS-Device but has no
dev= entry

Thats all very nice, but how do I fix it so that it works.
OR
Is it better to run it from the command prompt, xconsole, whatever you want
to call it.

And..  Chris, I'm logged in as root (whoami), but havent had time this
evening to go any further, been playing with other things.

Thankyou
Regards Kelvyn.



Re: [OT] Recommendations for CV/Resume Writers

2005-09-15 Thread Steve Holdoway

On Thu, September 15, 2005 10:23 pm, Christopher Sawtell wrote:

 It is also quite a possibility that said teacher got it wrong.
 He also told us that aweful was the correct spelling for the word which
 is a
 synonym of ghastly. I am now quite convinced that he was utterly wrong
 on
 that one. Similarly arn't. Interesting how language changes.

 --
 CS

at least he got the apostrophe in the right place!



ssh hacking.

2005-09-15 Thread Steve Holdoway
I was just checking the entry that Wesley needs in his /etc/fstab to get
/mnt/cdrom to start up without error, and was grepping for cd in dmesg,
when I didn't get the matches I expected.

It seems that I've got on to some list or other, and about a dozen clients
out there have been attempting by brute force to break in to my system...
10,000 attempts on my poor ssh daemon since the 11th! That's 2,500 per day
on an ihug dsl line.

I recommend that anyone out there who allows any kind of access from the
outside world check their logs, and make sure that they've got decent
passwords, etc in place.

My usual ostrich approach may soon become inappropriate!

Cheers,

Steve.

-- 
Windows: Where do you want to go today?
MacOS: Where do you want to be tomorrow?
Linux: Are you coming or what?


Re: configure shortcut

2005-09-15 Thread Christopher Sawtell
On Thu, 15 Sep 2005 22:26, motivated wrote:
 I have a shortcut icon (CD-ROM device) on my desktop. Clicking on it gets
 me:
 /home/kelvyn/desktop/cd-rom device is of type FS-Device but has no
 dev= entry

 Thats all very nice, but how do I fix it so that it works.
cursor to cdrom icon -right hand click - properties - select correct device 
from drop-down menu.

 Is it better to run it from the command prompt, xconsole, whatever you want
 to call it. 
Without doubt, because for the former method to work you have to have 
the /etc/fstab file and the device mount point permissions set up correctly. 
It is an unknown as to whether Mandrivel have managed to do that.

Actually there is the possibility that the automount daemon might work for 
you. Bung a CD in the slot and write:-
ls -l /mnt/cdrom
If you get a few lines out after a moment or two, it's worked.
If you don't it hasn't.


 And..  Chris, I'm logged in as root (whoami),
You can go anywhere and do anything in the filesystem then.
Take care!

 but havent had time this 
 evening to go any further, been playing with other things.
np 

-- 
CS


Re: ssh hacking.

2005-09-15 Thread Steve Holdoway
...after a bit more investigation, here's my /etc/hosts.deny, based on the
25,000 attempts in the last month!

On Thu, September 15, 2005 10:49 pm, Steve Holdoway wrote:
 I was just checking the entry that Wesley needs in his /etc/fstab to get
 /mnt/cdrom to start up without error, and was grepping for cd in dmesg,
 when I didn't get the matches I expected.

 It seems that I've got on to some list or other, and about a dozen clients
 out there have been attempting by brute force to break in to my system...
 10,000 attempts on my poor ssh daemon since the 11th! That's 2,500 per day
 on an ihug dsl line.

 I recommend that anyone out there who allows any kind of access from the
 outside world check their logs, and make sure that they've got decent
 passwords, etc in place.

 My usual ostrich approach may soon become inappropriate!

 Cheers,

 Steve.

 --
 Windows: Where do you want to go today?
 MacOS: Where do you want to be tomorrow?
 Linux: Are you coming or what?



-- 
Windows: Where do you want to go today?
MacOS: Where do you want to be tomorrow?
Linux: Are you coming or what?


hosts.deny
Description: Binary data


Re: ssh hacking.

2005-09-15 Thread Volker Kuhlmann
 ...after a bit more investigation, here's my /etc/hosts.deny, based on the
 25,000 attempts in the last month!

Wrong approach. You do it the other way round. You work out which IP
numbers need to connect to your ssh server (usually very few), the rest
goes to /dev/null. To be really anal, restrict which users are allowed
to use sshd, the rest gets a password failure until the sky comes down.
Both can be configured within /etc/ssh/sshd_config, though using
tcpwrappers as a first shield might be better. Even better, use your
firewall.

Volker

-- 
Volker Kuhlmann is possibly list0570 with the domain in header
http://volker.dnsalias.net/ Please do not CC list postings to me.


Google evil?

2005-09-15 Thread Volker Kuhlmann
This afternoon I received a you are over quota email from Paradise
(thank goodness). Turns out crawl.NN-NN-NN-NN.googlebot.com downloaded
the same 9MB pdf as often and as fast as they possibly could with the
available bandwidth, clocking up 8.5GB in 2 weeks. Have Google become
royal bastards, or is there another explanation? No signs of being
hacked, and anyway the Paradise usage pages agree with my server logs,
both putting the offending IP numbers square with Google.

Volker

-- 
Volker Kuhlmann is possibly list0570 with the domain in header
http://volker.dnsalias.net/ Please do not CC list postings to me.


Re: ssh hacking.

2005-09-15 Thread Steve Holdoway
Yes, I couldn't agree more - the 'default permit' approach is evil and
stupid. However, when requiring ssh access from sites with dynamic ip
addresses it's a good first line of defence.

Cheers,

Steve

On Fri, September 16, 2005 12:08 am, Volker Kuhlmann wrote:
 ...after a bit more investigation, here's my /etc/hosts.deny, based on
 the
 25,000 attempts in the last month!

 Wrong approach. You do it the other way round. You work out which IP
 numbers need to connect to your ssh server (usually very few), the rest
 goes to /dev/null. To be really anal, restrict which users are allowed
 to use sshd, the rest gets a password failure until the sky comes down.
 Both can be configured within /etc/ssh/sshd_config, though using
 tcpwrappers as a first shield might be better. Even better, use your
 firewall.

 Volker

 --
 Volker Kuhlmann   is possibly list0570 with the domain in 
 header
 http://volker.dnsalias.net/   Please do not CC list postings to me.



-- 
Windows: Where do you want to go today?
MacOS: Where do you want to be tomorrow?
Linux: Are you coming or what?


Re: Google evil?

2005-09-15 Thread Olwen Williams
Use robots.txt to prevent it being spidered.
Notes on robots.txt at
http://www.searchengineworld.com/robots/robots_tutorial.htm

and notify Google. See

http://www.google.co.nz/webmasters/bot.htmlOn 9/16/05, Volker Kuhlmann 
[EMAIL PROTECTED] wrote:This afternoon I received a you are over quota email from Paradise
(thank goodness). Turns out crawl.NN-NN-NN-NN.googlebot.com downloadedthe same 9MB pdf as often and as fast as they possibly could with theavailable bandwidth, clocking up 
8.5GB in 2 weeks. Have Google becomeroyal bastards, or is there another explanation? No signs of beinghacked, and anyway the Paradise usage pages agree with my server logs,both putting the offending IP numbers square with Google.
Volker--Volker
Kuhlmann
is possibly list0570 with the domain in headerhttp://volker.dnsalias.net/
Please do not CC list postings to me.


Re: Google evil?

2005-09-15 Thread Volker Kuhlmann
 Use robots.txt to prevent it being spidered.

Dealing with the immediate attack isn't the problem, there are plenty of
ways to do that. If the google spider has gone beserk, robots.txt isn't
the method I'd want to rely on.

 and notify Google. See

More complain than notify.

If the ISP's traffic usage protocols point to googlebot.com, is there
any scam which someone could use successfully for some time to be
deliberately obnoxious while pretending to be googlebot? I can't think
of any.

Volker

-- 
Volker Kuhlmann is possibly list0570 with the domain in header
http://volker.dnsalias.net/ Please do not CC list postings to me.


RE: IPCOP Question

2005-09-15 Thread Craig FALCONER
No idea sorry - I've never used the VPN functions of any of the firewall
distros.



-Original Message-
From: Charles Beneby [mailto:[EMAIL PROTECTED] 
Sent: Thursday, 15 September 2005 11:17 p.m.
Subject: IPCOP Question


Anyone out there have VPN connectivity issues with it??? (IPCOP) anyone
using it??

Mainly why does it allow the VPN connection to only be connected for about 3
minutes or so and then poof it kicks the user out of it..



Re: embarrassed by ssh hacking.

2005-09-15 Thread Nick Rout
I am embarrassed to say that my home system has been hacked into just
last night, an hour or two before Steve's first message on this subject.

For some reason I su'd to root for a maintenance task, and noted with
alarm that the last login by root had been over ssh earlier in the day
from an address that ended aol.com.

I quickly shut down sshd and made sure that the connection was no longer
active.

I then grepped my auth.log (and the copies that had been log rotated)
for root logins and discovered that there had been two on the same day 
(ie the one I had already spotted and one about 20 minutes before, from
a different but equally suspicious address.) The funny thing was that
there didn't seem to have been a whole lot of attempts, just a simple
login like they knew the password.

I then used netstat -tap and noted that there were several connections being 
made by the syslogd binary to port 6667 (irc) on various undernet
irc servers. I have found instances via google of crackers logging into
irc via owned machines, but I'm not sure what syslogd's role in this
is, perhaps its just a way of sending my logs to irc for other crackers
to view and use as a basis for further criminal activity.

I quickly killed all instances of syslogd and restarted the real one.
I also closed down all network based services.

I thought I had better start taking a look around and tried to emerge
chkrootkit, but this bombed telling me it failed to untar the source
code :(

I tried to su to root in another xterm and was given a seg fault.

I ssh'd into my work machine and pulled chkrootkit off it (already
compiled) and managed to make it work on the home machine. Strangely tar
worked when installing the binary version via emerge. chkrootkit
reported nothing untoward. I am not 100% sure how chkrootkit works, and
whether it can be run for the first time on an already compromised
network.

I am now worried that it is extremely likely that something has been
compromised (besides my root password, which I will change). The machine
is taking stress leave and won't be in the internet today. But this
weekend I have the choice of doing further tests, or doing a complete
re-install (/home is on a separate partition). What do people recommend?

I guess the real concern is how they managed to log in in the first
place. Yes, I should not have  had the (default) option of allowing root
login via ssh. I do however keep my system up to date and perhaps
naively assumed that I didn't have any insecure software versions (as
opposed to insecure setups for the software).

I am just glad that I happened to notice within a few hours.


On Fri, 16 Sep 2005 06:31:58 +1200 (NZST)
Steve Holdoway wrote:

 Yes, I couldn't agree more - the 'default permit' approach is evil and
 stupid. However, when requiring ssh access from sites with dynamic ip
 addresses it's a good first line of defence.
 
 Cheers,
 
 Steve
 

-- 
Nick Rout [EMAIL PROTECTED]



Re: embarrassed by ssh hacking.

2005-09-15 Thread yuri
On 16/09/05, Nick Rout wrote:
 I am embarrassed to say that my home system has been hacked into just
 last night, an hour or two before Steve's first message on this subject.
[snip]
 weekend I have the choice of doing further tests, or doing a complete
 re-install (/home is on a separate partition). What do people recommend?

Re-install. Once a machine is compromised you can't trust anything it tells you.
Either that, or make a chrootkit boot CD on a known clean machine.

Yuri
-- 
** WARNING to mailing list repliers **
Gmail over-rides Reply-To: field. Check your To: address before
sending reply to this post.


Re: ssh hacking.

2005-09-15 Thread yuri
On 16/09/05, Steve Holdoway wrote:
 Yes, I couldn't agree more - the 'default permit' approach is evil and
 stupid. However, when requiring ssh access from sites with dynamic ip
 addresses it's a good first line of defence.

If you need to connect from a dial-up box that connects thru Foo ISP,
just allow the IP block used by Foo's dial-up pool. That narrow's the
possible attacks to Foo's other customers. Combined with good
passwords and disallowing root login, you should be reasonably okay.

Yuri
-- 
** WARNING to mailing list repliers **
Gmail over-rides Reply-To: field. Check your To: address before
sending reply to this post.


Re: embarrassed by ssh hacking.

2005-09-15 Thread Hadley Rich
On Fri, 16 Sep 2005 09:50, Nick Rout wrote:
 I am embarrassed to say that my home system has been hacked into just
 last night, an hour or two before Steve's first message on this subject.
[snip]
 I ssh'd into my work machine and pulled chkrootkit off it (already
 compiled) and managed to make it work on the home machine. Strangely tar
 worked when installing the binary version via emerge. chkrootkit
 reported nothing untoward. I am not 100% sure how chkrootkit works, and
 whether it can be run for the first time on an already compromised
 network.

I hope you didn't ssh to your work box from the compromised box? If you did 
then I would recommend changing the password you used (if there was one) for 
that and having a good look at that box too, just to be sure.

 I am now worried that it is extremely likely that something has been
 compromised (besides my root password, which I will change). The machine
 is taking stress leave and won't be in the internet today. But this
 weekend I have the choice of doing further tests, or doing a complete
 re-install (/home is on a separate partition). What do people recommend?

Reinstall. If you have the resources then I would clone the drive onto another 
disk, or use a fresh disk to install onto. You then have the compromised disk 
for further analysis later on.

Do a thorough check of that home partition too.

HTH

hads

-- 
If you want your spouse to listen and pay strict attention to every
word you say, talk in your sleep.


Re: ssh hacking.

2005-09-15 Thread Jim Cheetham
Steve Holdoway wrote:
 ...after a bit more investigation, here's my /etc/hosts.deny, based on the
 25,000 attempts in the last month!

If you really can't lock down to whitelist-only, run DenyHosts from
http://denyhosts.sf.net

It runs as a daemon, every 30 seconds looks for bad guys in auth.log,
and adds them to hosts.deny.

You also run a purge every day or so, which will take out old entries.
This prevents hosts.deny getting so long that all tcpwrappered services
take too long to do checks.

Of course, whitelist yourself first :-) Or, if your machine is on a
dynamic address and you haven't set up a VPN, whitelist all the other
fixed-IP address machines you have, so you can log in via them at least.

-jim


Re: [OT] Recommendations for CV/Resume Writers

2005-09-15 Thread Michael JasonSmith
On Thu, 2005-09-15 at 22:28 +1200, Steve Holdoway wrote:
 At least he got the apostrophe in the right place!

Now does everyone see why GNOME banned the accursed character? 
http://developer.gnome.org/documents/style-guide/grammar.html

-- 
Michael JasonSmithhttp://ldots.org/



Re: embarrassed by ssh hacking.

2005-09-15 Thread Volker Kuhlmann
On Fri 16 Sep 2005 09:50:36 NZST +1200, Nick Rout wrote:

 I am embarrassed to say that my home system has been hacked into

You mean logged into?  ;(

 I then grepped my auth.log (and the copies that had been log rotated)
 for root logins and discovered that there had been two on the same day 

They didn't bother to delete their log entries? How unprofessional.

 I thought I had better start taking a look around and tried to emerge
 chkrootkit

Compiling chkrootkit on a cracked box? Don't waste your time.

 chkrootkit reported nothing untoward

If it reports infected you know you've had it.
If it reports nothing, you know nothing!!!

 I am now worried that it is extremely likely that something has been
 compromised

Don't kid yourself. You have a reinstall job for this weekend.

If you want to do any forensics on it, you'll need a copy of the entire
hard disk. You can either take the disk out and copy it on another
machine, or try booting a rescue system. Of course after a real hacker
you'd be sending the motherboard back to the manufacturer...

When using a rescue system, do not mount the disk, use dd to copy it. If
you absolutely have to, mount noexec. Running any binary from the
infected disk once means your rescue system is history too. I've seen
it. Of course if you don't have another computer with a disk big enough
to hold the entire bad disk once, much better twice, you have a problem.

 But this
 weekend I have the choice of doing further tests, or doing a complete
 re-install (/home is on a separate partition). What do people recommend?

Both

 I guess the real concern is how they managed to log in in the first
 place.

Work out how they snooped your root password. Your bigger worry are all
the other machines you're using, not the one which you know has had it.

Volker

PS Good luck :(

-- 
Volker Kuhlmann is possibly list0570 with the domain in header
http://volker.dnsalias.net/ Please do not CC list postings to me.


RE: IPCOP Question

2005-09-15 Thread Steve Holdoway
It didn't work at all in earlier 1.4.x versions, so I junked it, and use
an openvpn server behind the firewall.

Steve

On Fri, September 16, 2005 9:45 am, Craig FALCONER wrote:
 No idea sorry - I've never used the VPN functions of any of the firewall
 distros.



 -Original Message-
 From: Charles Beneby [mailto:[EMAIL PROTECTED]
 Sent: Thursday, 15 September 2005 11:17 p.m.
 Subject: IPCOP Question


 Anyone out there have VPN connectivity issues with it??? (IPCOP) anyone
 using it??

 Mainly why does it allow the VPN connection to only be connected for about
 3
 minutes or so and then poof it kicks the user out of it..





-- 
Windows: Where do you want to go today?
MacOS: Where do you want to be tomorrow?
Linux: Are you coming or what?


Re: [OT] Recommendations for CV/Resume Writers

2005-09-15 Thread Volker Kuhlmann
 Now does everyone see why GNOME banned the accursed character?

Not sure why this has anything to do with gnomes.

   http://developer.gnome.org/documents/style-guide/grammar.html

Where did they ban apostrophes? They only say don't use them where you
shouldn't.

Volker

-- 
Volker Kuhlmann is possibly list0570 with the domain in header
http://volker.dnsalias.net/ Please do not CC list postings to me.


Re: [OT] Recommendations for CV/Resume Writers

2005-09-15 Thread Christopher Sawtell
On Fri, 16 Sep 2005 10:09, Michael JasonSmith wrote:
 On Thu, 2005-09-15 at 22:28 +1200, Steve Holdoway wrote:
  At least he got the apostrophe in the right place!

 Now does everyone see why GNOME banned the accursed character?
   http://developer.gnome.org/documents/style-guide/grammar.html
generalisation type='sweeping'  !- but pretty close to the truth imho --
  The GNOME people had to write an English grammar lesson because the school 
systems in most English speaking countries fail spectacularly in that 
activity. 
/generalisation

What would be interesting is to know whether schools in countries which use 
other languages similarly fail to teach the grammars of their Mother Tongues?

-- 
CS


Re: [OT] Recommendations for CV/Resume Writers

2005-09-15 Thread Joshua Collins

On 9/16/05, Christopher Sawtell [EMAIL PROTECTED] wrote:
What would be interesting is to know whether schools in countries which useother languages similarly fail to teach the grammars of their Mother Tongues?


Dunno about that but (interesting _totally_ OT stuff to follow)according to some Japanese people I was talking to apparently using chopsticks is a dying skill amongst young people over there.

--Slosh


Re: [OT] Recommendations for CV/Resume Writers

2005-09-15 Thread Michael JasonSmith
On Fri, 2005-09-16 at 10:30 +1200, Volker Kuhlmann wrote:
 Where did they ban apostrophes? They only say don't use them where you
 shouldn't.

To quote the page
Apostrophe Rules:

  * Do not use
apostrophes to
denote
possession. 
  * Do not use
apostrophes to
denote
contractions. 
  * Do not use
apostrophes to
denote plurals. 

I would like to know of a use of apostrophes outside possessions,
contractions, and (rare) plurals! Neither “The Penguin Guide to
Punctuation” and “The Elements of Style” do not list any other uses…

-- 
Michael JasonSmithhttp://ldots.org/



Re: embarrassed by ssh hacking.

2005-09-15 Thread Pete

I guess the real concern is how they managed to log in in the first
place.


Work out how they snooped your root password. Your bigger worry are  
all
the other machines you're using, not the one which you know has had  
it.


They may not have snooped the password.

Nick - what version of sshd are you running?

I recently saw a box that was running an earlier version of sshd  
(3.71p) and had been exploited. The exploiter had written a very  
simple shell script that he was using on the exploited machine. The  
script polled ranges of IPs on port 22 greping out just the SSH  
header string  logging it - there is obviously an easy exploit on  
earlier versions of sshd without needing to know any passwords...


I guess the bottom line in that instance is always keep internet- 
facing services up to date!


Regards,
Pete



Re: embarrassed by ssh hacking.

2005-09-15 Thread Nick Rout

On Fri, 16 Sep 2005 15:35:15 +1200
Pete wrote:

  I guess the real concern is how they managed to log in in the first
  place.
 
  Work out how they snooped your root password. Your bigger worry are  
  all
  the other machines you're using, not the one which you know has had  
  it.
 
 They may not have snooped the password.
 
 Nick - what version of sshd are you running?

3.9_p1 (I think, the machine is turned off and at home.)

-- 
Nick Rout [EMAIL PROTECTED]



Re: embarrassed by ssh hacking.

2005-09-15 Thread Volker Kuhlmann
 They may not have snooped the password.
 
 Nick - what version of sshd are you running?

Always a possibility. However I'd assume Nick knows to keep a system
uptodate on fixes, being a gentoo action-man ;), and there hasn't been a
security fix to openssh in quite some time (ok let's say 6 months). Of
course it's always possible you just found a new hole, Nick...

Volker

-- 
Volker Kuhlmann is possibly list0570 with the domain in header
http://volker.dnsalias.net/ Please do not CC list postings to me.