Linux-Misc Digest #104, Volume #27 Tue, 13 Feb 01 20:13:02 EST
Contents:
Java Port (olliecat)
Re: can't remove/rename file, even as root (Oliver Wiegand)
Re: Intruder ("rc")
Re: can't remove/rename file, even as root (Jason Fornelli)
Re: The procedure of configure scripts (Oliver Wiegand)
Re: Mail Server Newbie (Manish Jethani)
Re: can't remove/rename file, even as root (Manish Jethani)
Re: netcrap locks me up (Mladen Gavrilovic)
Re: O'Reilly: SSH book published (Dustin Puryear)
Re: Very odd behaviour of Forte 4 Java (Oliver Wiegand)
Re: Uninstalling Corel Linux? (John Hasler)
Re: SOLVED - The procedure of configure scripts (Mladen Gavrilovic)
Re: scp problem (openSSH/openSSL suite). (Dustin Puryear)
Re: netcrap locks me up (The Real Bev)
Re: Intruder ("rc")
Re: Verify crontab, please (Robert Jones)
----------------------------------------------------------------------------
From: olliecat <[EMAIL PROTECTED]>
Subject: Java Port
Date: Wed, 14 Feb 2001 00:10:26 GMT
Cam someone tell me what the most recent golden release of the java sdk
for Linux is, if there is one?
Thanks.
------------------------------
From: Oliver Wiegand <[EMAIL PROTECTED]>
Subject: Re: can't remove/rename file, even as root
Date: Wed, 14 Feb 2001 01:11:29 +0100
Reply-To: [EMAIL PROTECTED]
Mladen Gavrilovic wrote:
>
> Hmm... possibly I don't know what I'm talking about, but could you be
> running the file? Check with something like "ps -A | grep 'named'". If
> you're running it kill it and then delete the file.
>
> Regards,
> Mladen
>
> Jason Fornelli wrote:
> >
> > I'm running RH 6.1 and was trying to upgrade the bind package via rpm but it
> > fails saying it is unable to delete (via RPM_DELETE) the /usr/sbin/named file.
> > I then went in as root and tried to manually remove named but get an error
> > message saying "rm: cannot unlink `/usr/sbin/named': Operation not permitted".
> > I'd had a 4 second power outage recently and thought perhaps the problem had to
> > do with an inode or something being corrupted so I ran fsck to try to fix the
> > problems that were listed at boot. This did not do the trick.
> > Besides not being able to remove or overwrite this file, I'm also unable to run
> > chmod on it...
> > Any thoughts/suggestions on how I can kill off this pesky file?
> > Thanks.
> >
> > -jason
The ext2 filesystem has a feature,which lets you add attributes
(particular permissions) to files. For example set the attribute
"immutable" (chattr -i),which prohibits changes on files,even by root.
Maybe on of these attributes is set on named ? (lsattr shows them)
Greetings Oli
------------------------------
From: "rc" <[EMAIL PROTECTED]>
Subject: Re: Intruder
Date: Wed, 14 Feb 2001 00:22:43 GMT
Is there supposed to be a ro0t?
--
Roberto Cerini
CCS, Inc.
"Drew Roedersheimer" <[EMAIL PROTECTED]> wrote in message
news:[EMAIL PROTECTED]...
> On Tue, 13 Feb 2001 19:58:52 GMT, rc wrote:
> >I had someone FTP intp the system with a userid Jim and then the messages
> >log file said he su'd to ro0t, not root. How could he do that and what
is
> >ro0t?
> >
> >Thanks,
> >
> >--
> >Roberto
> >
> >
>
> This is probably a question that would be better in a security NG.
> That being said, it sounds to me like you might have been cracked. I'd
> check your /etc/passwd file (NIS maps if that applies), and see what
> uid ro0t has. If it's 0, and you didn't put it there, you've been
> rooted... BTW, the uid field is the 3rd field in /etc/passwd.
>
> root:x:0:0:root:/root:/bin/bash
> ^
> |
> uid
>
> I won't even delve into what to do next if you have been owned, but
> suffice it to say that probably the best thing to do first is physically
> disconnect the machine from any outside and/or untrusted networks.
>
>
> Best of luck
> -DR
------------------------------
From: [EMAIL PROTECTED] (Jason Fornelli)
Subject: Re: can't remove/rename file, even as root
Reply-To: fornelli(AT)home(DOT)com
Date: Wed, 14 Feb 2001 00:24:28 GMT
On Wed, 14 Feb 2001 01:11:29 +0100, Oliver Wiegand <[EMAIL PROTECTED]> wrote:
>Mladen Gavrilovic wrote:
>>
>> Hmm... possibly I don't know what I'm talking about, but could you be
>> running the file? Check with something like "ps -A | grep 'named'". If
>> you're running it kill it and then delete the file.
>>
>> Regards,
>> Mladen
>>
>> Jason Fornelli wrote:
>> >
>> > I'm running RH 6.1 and was trying to upgrade the bind package via rpm but it
>> > fails saying it is unable to delete (via RPM_DELETE) the /usr/sbin/named file.
>> > I then went in as root and tried to manually remove named but get an error
>> > message saying "rm: cannot unlink `/usr/sbin/named': Operation not permitted".
>> > I'd had a 4 second power outage recently and thought perhaps the problem had to
>> > do with an inode or something being corrupted so I ran fsck to try to fix the
>> > problems that were listed at boot. This did not do the trick.
>> > Besides not being able to remove or overwrite this file, I'm also unable to run
>> > chmod on it...
>> > Any thoughts/suggestions on how I can kill off this pesky file?
>> > Thanks.
>> >
>> > -jason
>
>The ext2 filesystem has a feature,which lets you add attributes
>(particular permissions) to files. For example set the attribute
>"immutable" (chattr -i),which prohibits changes on files,even by root.
>Maybe on of these attributes is set on named ? (lsattr shows them)
>Greetings Oli
Thanks a lot. That's exactly what the problem is (er, was...<grin>).
-jason
------------------------------
From: Oliver Wiegand <[EMAIL PROTECTED]>
Subject: Re: The procedure of configure scripts
Date: Wed, 14 Feb 2001 01:25:26 +0100
Reply-To: [EMAIL PROTECTED]
Mladen Gavrilovic wrote:
>
> Hi all,
>
> Does anyone know how configure scripts check for libraries? I'm trying
> to compile something that requires Qt, but the configure script doesn't
> detect the libraries.
>
> I'm using redhat 7 (fully updated) and qt-2.2.3 and qt-devel-2.2.3 (from
> rpmfind). The qt library dir is in ld.so.conf. Libraries are in
> /usr/lib/qt-2.2.3/lib, while headers are in /usr/lib/qt-2.2.3/headers.
> A program that comes with the devel package (Qt designer) works, and I
> think it uses Qt, so the libaries seem to be working fine. Note that
> I'm not using KDE, but GNOME.
>
> But I digress...
>
> Coming back to my question, where is it that configure stores it's
> directories for checking dependencies? Is it in one of the
> config.something files?
>
> Regards,
> Mladen
After running configure,it stores its dependencies in config.cache.
Sometimes,if you are changing paths or so and config.cache still remains
unchanged in the directory,the changes are not recognized.Delete
config.cache and run configure with new values again. (is that what you
asked for ?)
Oli
------------------------------
From: Manish Jethani <[EMAIL PROTECTED]>
Subject: Re: Mail Server Newbie
Date: Wed, 14 Feb 2001 04:55:30 +0530
On Wed, 14 Feb 2001, James Horvath wrote:
>I am looking to set up a simple Linux mail server at home to collect email
>from a number of POP3 accounts, store them on a "mail hub" machine, and
>allow access to those messages from Microsoft Outlook 2000 (on a Windows
>[snip]
>mailhub. Do I need NIS? NFS? Samba? Sendmail? Procmail? Something
>else?
Try qpopper. Download from qualcomm.com and check the documentation. It's a
POP server (daemon) that will allow your Windows clients to access mail on the
Linux server.
Manish Jethani
--
Not only is UNIX dead, it's starting to smell really bad.
-- Rob Pike
------------------------------
From: Manish Jethani <[EMAIL PROTECTED]>
Subject: Re: can't remove/rename file, even as root
Date: Wed, 14 Feb 2001 05:01:34 +0530
On Wed, 14 Feb 2001, Jason Fornelli wrote:
>I'm running RH 6.1 and was trying to upgrade the bind package via rpm but it
>fails saying it is unable to delete (via RPM_DELETE) the /usr/sbin/named file.
>I then went in as root and tried to manually remove named but get an error
>message saying "rm: cannot unlink `/usr/sbin/named': Operation not permitted".
>I'd had a 4 second power outage recently and thought perhaps the problem had to
>do with an inode or something being corrupted so I ran fsck to try to fix the
>problems that were listed at boot. This did not do the trick.
>Besides not being able to remove or overwrite this file, I'm also unable to run
>chmod on it...
>Any thoughts/suggestions on how I can kill off this pesky file?
Try "lsattr peskyfile" on the cmd line. It'll show you some attributes. Try to
remove the attributes that you don't want using "chattr". Read the man page for
lsattr and chattr.
Manish Jethani
--
Not only is UNIX dead, it's starting to smell really bad.
-- Rob Pike
------------------------------
From: Mladen Gavrilovic <[EMAIL PROTECTED]>
Subject: Re: netcrap locks me up
Date: Wed, 14 Feb 2001 00:29:42 GMT
Sorry, I have to stick this in every time I see netscape getting
bashed...
I've had no problems with netscape on a variety of systems (Red Hat 5,
6, 7) and a variety of netscape versions. There is the occasional
crash, but certainly nothing more than once every 2 months or so... and
those are easily fixed by restarting netscape after cleaning it up. In
my opinion it's the best option for Linux right now... easy graphical
browser/news/mail all in one solution, java and everything... I'm sure
once Mozilla matures it'll be good, but from what I've heard it's not
worth a try right now (although the same is true for netscape).
Anyone have any suggestions for better browser/mail/news systems than
netscape (fully graphical, that is... I'm sure some text based solutions
may be more stable, but I'm also pretty sure they're more cumbersome and
less "pretty" to use, and this is based on experience)? Also, other
browsers may be more stable than netscape, but are they able to read all
kinds of content like netscape? What I'm talking about is Java, flash,
even qplug.
Regards,
Mladen
The Real Bev wrote:
>
> Chris Webster wrote:
> >
> > john connolly wrote:
> > >
> > > Occasionally, when using netscape 4.7x on a slackware7.0 (xfree 3.6xx)
> > > system and kde2.?? my cpu (celeron 400) usage goes up to nearly 100% and
> > > stays there and the only way to recover is to kill netscape. This has
> > > happened any number of times in navigator when visiting web sites and
> > > once in a while in communicator using the local road runner news server.
> > > Any ideas about this?
> >
> > Happens to me 3-6 times a day, along with 3-6 crashes a day. A while
> > back I'd heard something about Java problems.
>
> Yup. Sometimes it happens when I'm just reading my email, too.
> Occasionally it will kill X. Some of us are lazier than others and use
> something like this...
>
> alias killnet='rm -f /root/.netscape/lock;killall -9 netscape'
>
> --
> Cheers,
> Bev
> ***********************************************
> "A complete lack of evidence is the surest sign
> that the conspiracy is working." -- Tanuki
------------------------------
From: [EMAIL PROTECTED] (Dustin Puryear)
Subject: Re: O'Reilly: SSH book published
Date: 14 Feb 2001 00:32:40 GMT
Reply-To: [EMAIL PROTECTED]
On Tue, 13 Feb 2001 23:00:03 +0100, Peter T. Breuer <[EMAIL PROTECTED]> wrote:
>> While I suppose it was posted to the wrong newsgroup, I got the book
>> because I saw the post, and it just arrived today. I skimmed it and it
>> looks good.
>
>Is it? I teach ssl in an e-commerce course and might need it. My
>ssl knowledge comes from the RFCs and the various notes from the
>drafts. I'm not at all sure how ssh fits in to that picture, and
>could do with something that gives some data. Does it? Or is it
>all howto?
Well, I've only seen a few not-so-great books come from O'Reilly, so
I would assume this book does have some meat to it. When one of the authors
originally posted his message I believe he included a link to the TOC.
You may want to peruse that as well as get a recommendation from
Daniel.
Regards, Dustin
--
Dustin Puryear <[EMAIL PROTECTED]>
Integrate Linux Solutions into Your Windows Network
- http://www.prima-tech.com/integrate-linux
------------------------------
From: Oliver Wiegand <[EMAIL PROTECTED]>
Subject: Re: Very odd behaviour of Forte 4 Java
Date: Wed, 14 Feb 2001 01:41:52 +0100
Reply-To: [EMAIL PROTECTED]
alan simes wrote:
>
> I decided to use Suns Forte Java development IDE for my Java
> develoment....
>
> Couldnt understand why the hell it was so dam slow on my Linux OS, PIII
> 700 with 128mb of RAM.
>
> Believe it or not it creates 30 <- Yes 30 seperate 34mb Java instances
> as it is running!!!!!
>
> What the hell???
>
> Its even worse if you use the IBM SDK and Yes the black down SDK is just
> as awful!!!
>
> Does anybody have the faintest clue as to what is happening???
>
> Thanks
>
> simes
Buy more memory or switch to a real programming language.
Oli
------------------------------
From: John Hasler <[EMAIL PROTECTED]>
Subject: Re: Uninstalling Corel Linux?
Date: Tue, 13 Feb 2001 23:38:00 GMT
Jay writes:
> I went to install a second hard drive on that same computer, which I want
> to partition up for different operating systems. To install the hard
> drive, I need Windows on my machine.
Whatever gave you that idea? You install a hard drive with a screwdriver,
not with an operating system.
--
John Hasler
[EMAIL PROTECTED]
Dancing Horse Hill
Elmwood, Wisconsin
------------------------------
From: Mladen Gavrilovic <[EMAIL PROTECTED]>
Subject: Re: SOLVED - The procedure of configure scripts
Date: Wed, 14 Feb 2001 00:55:30 GMT
Well, no, but I was able to solve the problem.
What I was asking is how to make the configure script look in the right
place. I had the requirements in place before I ran configure for the
first time and before config.cache was created. The paths for Qt seemed
to be in the config.status file... and they were wrong :) After editing
the config.status everything went fine.
Regards,
Mladen
Oliver Wiegand wrote:
>
> Mladen Gavrilovic wrote:
> >
> > Hi all,
> >
> > Does anyone know how configure scripts check for libraries? I'm trying
> > to compile something that requires Qt, but the configure script doesn't
> > detect the libraries.
> >
> > I'm using redhat 7 (fully updated) and qt-2.2.3 and qt-devel-2.2.3 (from
> > rpmfind). The qt library dir is in ld.so.conf. Libraries are in
> > /usr/lib/qt-2.2.3/lib, while headers are in /usr/lib/qt-2.2.3/headers.
> > A program that comes with the devel package (Qt designer) works, and I
> > think it uses Qt, so the libaries seem to be working fine. Note that
> > I'm not using KDE, but GNOME.
> >
> > But I digress...
> >
> > Coming back to my question, where is it that configure stores it's
> > directories for checking dependencies? Is it in one of the
> > config.something files?
> >
> > Regards,
> > Mladen
>
> After running configure,it stores its dependencies in config.cache.
> Sometimes,if you are changing paths or so and config.cache still remains
> unchanged in the directory,the changes are not recognized.Delete
> config.cache and run configure with new values again. (is that what you
> asked for ?)
> Oli
------------------------------
From: [EMAIL PROTECTED] (Dustin Puryear)
Subject: Re: scp problem (openSSH/openSSL suite).
Date: 14 Feb 2001 00:41:30 GMT
Reply-To: [EMAIL PROTECTED]
On Tue, 13 Feb 2001 16:07:08 -0500, Jean-David Beyer <[EMAIL PROTECTED]>
wrote:
>While I have openSSH working just fine between my two machines, and I
>have even had it work from my nephew's machine hundreds of miles from
>here, I have never gotten scp to work. Here is a typical attempt:
>debug: Entering interactive session.
>bash: scp: command not found
You probably installed via source to /usr/local. The problem is that scp is not
in the path on the remote end. You can set /usr/local/bin as part of everyone's
path or even better just created a symlink from /usr/local/bin/scp to
/usr/bin/scp.
Regards, Dustin
--
Dustin Puryear <[EMAIL PROTECTED]>
Integrate Linux Solutions into Your Windows Network
- http://www.prima-tech.com/integrate-linux
------------------------------
From: The Real Bev <[EMAIL PROTECTED]>
Subject: Re: netcrap locks me up
Date: Tue, 13 Feb 2001 17:06:13 -0800
Stephen Rank wrote:
>
> The Real Bev <[EMAIL PROTECTED]> writes:
>
> [...]
>
> > alias killnet='rm -f /root/.netscape/lock;killall -9 netscape'
>
> Implying that you're running Netscrape as root...
>
> Erk!
>
> Hint: don't!
Yeahyeahyeahyeahyeah... Like you're the first person on earth to say that
:-)
One serious problem: whenever I try to create a new user, it doesn't
work. Not with useradd or adduser with all the bells and whistles, not
with yast or yast2. And I seem to remember a lot of people complaining
that they could ONLY run netscape as root.
Three years and still alive. So far, so good, and way better than win9*.
--
Cheers,
Bev
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
"Friends help you move. *Real* friends help you move bodies."
--A. Walker
------------------------------
From: "rc" <[EMAIL PROTECTED]>
Subject: Re: Intruder
Date: Wed, 14 Feb 2001 01:06:56 GMT
I noticed that the a-hole created 2 or 3 users that were hidden. I removed
them and closed the ftp access. I am not sure what else to do. Does anyone
know if sendmail works behind a firewall?
Rob
"Drew Roedersheimer" <[EMAIL PROTECTED]> wrote in message
news:[EMAIL PROTECTED]...
> On Tue, 13 Feb 2001 19:58:52 GMT, rc wrote:
> >I had someone FTP intp the system with a userid Jim and then the messages
> >log file said he su'd to ro0t, not root. How could he do that and what
is
> >ro0t?
> >
> >Thanks,
> >
> >--
> >Roberto
> >
> >
>
> This is probably a question that would be better in a security NG.
> That being said, it sounds to me like you might have been cracked. I'd
> check your /etc/passwd file (NIS maps if that applies), and see what
> uid ro0t has. If it's 0, and you didn't put it there, you've been
> rooted... BTW, the uid field is the 3rd field in /etc/passwd.
>
> root:x:0:0:root:/root:/bin/bash
> ^
> |
> uid
>
> I won't even delve into what to do next if you have been owned, but
> suffice it to say that probably the best thing to do first is physically
> disconnect the machine from any outside and/or untrusted networks.
>
>
> Best of luck
> -DR
------------------------------
From: Robert Jones <[EMAIL PROTECTED]>
Subject: Re: Verify crontab, please
Date: Tue, 13 Feb 2001 19:07:20 -0600
"Peter T. Breuer" wrote:
> Robert Jones <[EMAIL PROTECTED]> wrote:
> > [root@localhost rj]# crontab -l
> > # DO NOT EDIT THIS FILE - edit the master and reinstall.
> > # (/tmp/crontab.20475 installed on Tue Feb 13 06:00:08 2001)
> > # (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp
> > $)
> > */5 * * * * /usr/sbin/init
>
> > Looks like I'm running init every 12 seconds.
>
> man cron/crontab. That's not every 5 seconds!
Better yet, "man what-the-hell-does-'/'-usually-mean". I plead
pre-breakfast insanity. Can we settle on every 5 minutes or 12 times/hour?
> It is curious, through. Man init for more info. It should have an
> argument, possibly "q".
"q" would make sense except that "q" or "Q" appear to be valid arguments
for telinit but not for init -- which I also find rather curious.
SYNOPSIS
/sbin/init [ 0123456Ss ]
/sbin/telinit [ -t sec ] [ 0123456sSQqabcUu ]
I guess what I was really wondering is how it came to pass that that line
is even there.
Root's crontab has taken a beating on this machine in the last couple
months between a tape drive that died, one that was d.o.a. and one that
worked fine except for the PCI slot I put the SCSI card in, trying to make
the 2nd drive work.
Arrrggh! Come to think of it, maybe breakfast has nothing to do with my
insanity plea.
Thanks for the reply!
--
Progress was all right. Only it went on too long.
-- James Thurber
4:51pm up 3 days, 43 min, 2 users, load average: 0.26, 0.21, 0.14
------------------------------
** FOR YOUR REFERENCE **
The service address, to which questions about the list itself and requests
to be added to or deleted from it should be directed, is:
Internet: [EMAIL PROTECTED]
You can send mail to the entire list by posting to comp.os.linux.misc.
Linux may be obtained via one of these FTP sites:
ftp.funet.fi pub/Linux
tsx-11.mit.edu pub/linux
sunsite.unc.edu pub/Linux
End of Linux-Misc Digest
******************************
