Linux-Networking Digest #846, Volume #10 Tue, 13 Apr 99 21:13:43 EDT
Contents:
How to clear a hung port ("Michael T. Smith")
Static NAT with Linux (Willis Sarka III)
Re: Hacker 'SATANIC SERVER' on my LAN (Andreas Dilger)
DHCPD install problems ("Hugo Th�riault")
Reverse DNS over PPP ([EMAIL PROTECTED])
fast ethernet cards ("ryan")
IBM Etherjet card setup ([EMAIL PROTECTED])
Routing problem with two modems ("Micky Gough")
Re: Problem with Linux and NTServer ("Michael Baumgartner")
httpd daemon problems (Chris Quick)
Re: Is this Port Scanning? (READ THIS ONE) (Nick B.)
Re: Help with interpretation of rfc951 (Ken Pizzini)
Re: Network Printer (Linux + MacOS + HP JetDirect) (Ron Watkins)
Re: How does daemon take control from inetd? (L J Bayuk)
Re: DNS - for yu (yugoslav) top-level-domain ([EMAIL PROTECTED])
Re: Samba->Win98 FAILS! ([EMAIL PROTECTED])
Re: Detech Modem Speed (Anthony)
ipchains MASQ problem... ([EMAIL PROTECTED])
Re: Problem with outbound e-mail on 2.2.5 (Michael J Surette)
----------------------------------------------------------------------------
From: "Michael T. Smith" <[EMAIL PROTECTED]>
Subject: How to clear a hung port
Date: Tue, 13 Apr 1999 14:04:41 -0400
Reply-To: [EMAIL PROTECTED]
I have a process (an Oracle listener) that is no longer running but is
still using the port.
When I stop the listener it closes correctly. If I then do a netstat
-na | grep 1521 then I get
0.0.0.0:1521
The only way I have found to clear that port out is to reboot the box.
Does anyone know of a way to clear that entry.
Thanks for the help,
Michael
------------------------------
From: [EMAIL PROTECTED] (Willis Sarka III)
Subject: Static NAT with Linux
Date: 13 Apr 1999 22:28:31 GMT
Hello all.
I'm not looking to do IP Masquerade, but rather do specific Network Address
Translationto certain hosts on my inside network. For instance, the IP to the world
would be 206.247.11.8, but it would really be a static mapping to 192.178.10.1 (or
some other non-routable IP address). My question is: Are there any tools to make
this happen? Could you use IP Masquerade in a special way?
Thanks
------------------------------
From: [EMAIL PROTECTED] (Andreas Dilger)
Subject: Re: Hacker 'SATANIC SERVER' on my LAN
Date: 13 Apr 1999 15:46:39 GMT
In article <[EMAIL PROTECTED]>,
star <[EMAIL PROTECTED]> wrote:
>At the time of the hack this was my firewall:
>ipchains input -l -i eth0 -S 127.0.0.1/32 -j deny
You should really have "-S 127.0.0.1/8" because this is the entire
loopback address space. Apparently (according to ipchains docs),
this should be covered by the 2.2 kernel already, but not the 2.0
kernel.
Cheers, Andreas
--
Andreas Dilger University of Calgary \"If a man ate a pound of pasta and
Micronet Research Group \ a pound of antipasto, would they
Dept of Electrical & Computer Engineering \ cancel out, leaving him still
http://www-mddsp.enel.ucalgary.ca/People/adilger/ hungry?" -- Dogbert
------------------------------
From: "Hugo Th�riault" <[EMAIL PROTECTED]>
Subject: DHCPD install problems
Date: Tue, 13 Apr 1999 22:46:54 GMT
Hello everyone, i have a problem installing dhcpd server... as follows
did install the make package and still have an error message as
follows when i type the make command
cc -g -DLINUX_2_0 -c dhcpd.c -o dhcpd.o
make: cc: Command not found
make: *** dhcpd.o error 127
and didn t find any cc package????
thanx
hugo
------------------------------
From: [EMAIL PROTECTED]
Subject: Reverse DNS over PPP
Date: Tue, 13 Apr 1999 18:47:21 GMT
Hi friends,
Any idea why Reverse DNS search results can sometimes not be passed over ppp
to the client ppp (forgive me for telling this a client!).
Anything to do with serial port setup?
Anything to do with ppp options?
or Just DNS setup?
I am not sending any details here to keep the message short, believe me the
DNS is working extremely well over ethernet, only not properly over ppp. It
also works OK over ppp for search from name to IP just does not work for IP
to name. Because of this I have trouble using ftp, telnet etc. over my home
network over ppp.
Thank you for help!
I would greatly appreciate any kind of comments, including flames!
email: [EMAIL PROTECTED]
============= Posted via Deja News, The Discussion Network ============
http://www.dejanews.com/ Search, Read, Discuss, or Start Your Own
------------------------------
From: "ryan" <[EMAIL PROTECTED]>
Subject: fast ethernet cards
Date: Tue, 13 Apr 1999 17:35:15 -0700
i am having a world of trouble with a couple of fast ethernet cards.
i currently have dsl, but it uses dhcp, this works fine however it does not
make for a good network. what i want to do is set up an internal lan using
samba for my win32 clients. my 3com card works perfect, but no matter what i
try to compile into my kernel i have yet to get my smc ez fast ethernet(pci)
or my acer (nexus chip) to work. any idea's? i dont really want to have to
go get another 3com as they cost so much $$$$$$$$
thanks
ryan
------------------------------
From: [EMAIL PROTECTED]
Subject: IBM Etherjet card setup
Date: Tue, 13 Apr 1999 22:51:59 GMT
Forgive me it this is basic. I'm still very new to networking and linux, but
very eager to learn. Read many docs and walked thru several installs,
recompiled kernels, etc...
I pulled the precompiled driver module for the etherjet from the Crystal
website, which makes the internal chip. (cs89x0.o) Instructions say to use
'insmod' to load the module. When I do that, I get the message 'cs89x0.o:
init_module: Device or resource busy' Tried copying the file into the
/lib/modules/pcmcia and /lib/modules/net and use netcfg to install it. It
won't show up in the module list. I don't see a .conf file to manually add it
in. If I could get the laptop to recognize the etherjet card, I'm pretty sure
I can handle the rest.
Any help would be greatly appreciated.
Rick...
============= Posted via Deja News, The Discussion Network ============
http://www.dejanews.com/ Search, Read, Discuss, or Start Your Own
------------------------------
From: "Micky Gough" <[EMAIL PROTECTED]>
Subject: Routing problem with two modems
Date: 14 Apr 1999 09:45:15 +1000
Hi. I have a system that is running as a masquerading server for a local
network. It also does packet redirection for http and ftp to an internal
NT server (not my choice).
For this we have a dedicated IP address with our ISP.
I'd like to add a second modem, because we're running into bandwidth
problems. I'd like to make the default route through ppp1 (the second
modem) which would be a dynamic IP address, but if any traffic comes
through ppp0 I'd like it routed back through ppp0. Is this possible? I'm
using ipfwadm to do the masquerading and ipautofw to do the packet
forwarding (redirection) on a redhat 5.0 system.
Thanx,
Micky
------------------------------
From: "Michael Baumgartner" <[EMAIL PROTECTED]>
Subject: Re: Problem with Linux and NTServer
Date: Wed, 14 Apr 1999 00:48:26 +0200
>I can ping the Linux-Machine from WIN98-Clients, but NOT with the
NT-Server.
>Pinging WIN98 from Linux works, but NOT to the NT-Server.
check if you use TCP/IP on NT-Server
Best Regards
mike (austria)
------------------------------
From: Chris Quick <[EMAIL PROTECTED]>
Subject: httpd daemon problems
Date: 13 Apr 1999 23:58:41 GMT
As many people state in here, I'm new to Linux and I've already hit my
first wall. I've been trying to get my httpd daemon running, but I can't
seem to get things to work properly. When I try to start the daemon, I
get a message stating that it could not find the servername and it tells
me to set it with ServerName. I went into the /etc/httpd/conf/httpd.conf
file and set the name to my domain. I then tried to restart the daemon,
but then it states that it cannot find the IP for the servername. What
could I be doing wrong? I checked all the networking stuff that I could,
but still nothing. I have a similiar system that runs the httpd server
just fine. By the way, I'm running Redhat 5.1.
Thanks in advance,
Chris Quick
[EMAIL PROTECTED]
------------------------------
From: Nick B. <[EMAIL PROTECTED]>
Subject: Re: Is this Port Scanning? (READ THIS ONE)
Date: Tue, 13 Apr 1999 23:44:24 GMT
Sorry about the formatting in the above post - it looked much better in the
Preview than it did after posting. Thus I am reposting the message here with
different formatting which, I hope, will make it readable.
===========================
Hi guys,
I just wanted to ask those experienced in network security if the following
"edited" region, copied from my /var/log/messages file, is what it looks like
to be port scanned? I "edited" the copy to protect the innocent, so I've made
the following changes:
<my-machine> = substitution for the actual name of my firewalling Linux
machine
<offending-IP> = substitution for the actual IP address (www.xxx.yyy.zzz) of
the external machine
<my-IP> = substitution for the actual IP address (www.xxx.yyy.zzz) of my
machine
Below is the "edited" region of my /var/log/messages file:
======================================================================
Apr 11 03:50:48 <my-machine> kernel: IP fw-in deny eth0 TCP
<offending-IP>:4762 <my-IP>:110 L=44 S=0x00 I=6175 F=0x0000 T=45
Apr 11 03:50:51 <my-machine> kernel: IP fw-in deny eth0 TCP
<offending-IP>:4762 <my-IP>:110 L=44 S=0x00 I=6309 F=0x0000 T=46
Apr 11 03:50:53 <my-machine> kernel: IP fw-in deny eth0 TCP
<offending-IP>:6139 <my-IP>:79 L=44 S=0x00 I=6385 F=0x0000 T=46
Apr 11 03:50:56 <my-machine> kernel: IP fw-in deny eth0 TCP
<offending-IP>:6139 <my-IP>:79 L=44 S=0x00 I=6512 F=0x0000 T=46
Apr 11 03:50:57 <my-machine> kernel: IP fw-in deny eth0 TCP
<offending-IP>:7326 <my-IP>:23 L=44 S=0x00 I=6575 F=0x0000 T=46
Apr 11 03:51:01 <my-machine> kernel: IP fw-in deny eth0 TCP
<offending-IP>:7326 <my-IP>:23 L=44 S=0x00 I=6680 F=0x0000 T=46
Apr 11 03:51:02 <my-machine> kernel: IP fw-in deny eth0 TCP
<offending-IP>:9081 <my-IP>:143 L=44 S=0x00 I=6746 F=0x0000 T=46
Apr 11 03:51:06 <my-machine> kernel: IP fw-in deny eth0 TCP
<offending-IP>:9081 <my-IP>:143 L=44 S=0x00 I=6846 F=0x0000 T=46
Apr 11 03:51:07 <my-machine> kernel: IP fw-in deny eth0 TCP
<offending-IP>:10679 <my-IP>:53 L=44 S=0x00 I=6914 F=0x0000 T=46
Apr 11 03:51:11 <my-machine> kernel: IP fw-in deny eth0 TCP
<offending-IP>:10679 <my-IP>:53 L=44 S=0x00 I=7009 F=0x0000 T=46
Apr 11 03:51:13 <my-machine> kernel: IP fw-in deny eth0 TCP
<offending-IP>:12321 <my-IP>:635 L=44 S=0x00 I=7079 F=0x0000 T=46
Apr 11 03:51:16 <my-machine> kernel: IP fw-in deny eth0 TCP
<offending-IP>:12321 <my-IP>:635 L=44 S=0x00 I=7167 F=0x0000 T=46
Apr 11 03:51:18 <my-machine> kernel: IP fw-in deny eth0 TCP
<offending-IP>:12647 <my-IP>:143 L=44 S=0x00 I=7226 F=0x0000 T=46
Apr 11 03:51:21 <my-machine> kernel: IP fw-in deny eth0 TCP
<offending-IP>:12647 <my-IP>:143 L=44 S=0x00 I=7328 F=0x0000 T=46
Apr 11 03:51:28 <my-machine> kernel: IP fw-in deny eth0 TCP
<offending-IP>:14925 <my-IP>:110 L=44 S=0x00 I=7555 F=0x0000 T=46
Apr 11 03:51:31 <my-machine> kernel: IP fw-in deny eth0 TCP
<offending-IP>:14925 <my-IP>:110 L=44 S=0x00 I=7656 F=0x0000 T=46
Apr 11 03:51:32 <my-machine> kernel: IP fw-in deny eth0 TCP
<offending-IP>:16413 <my-IP>:110 L=44 S=0x00 I=7719 F=0x0000 T=46
Apr 11 03:51:36 <my-machine> kernel: IP fw-in deny eth0 TCP
<offending-IP>:16413 <my-IP>:110 L=44 S=0x00 I=7823 F=0x0000 T=46
======================================================================
It sort of looks like to me that someone at <offending-IP> was testing access
every few seconds from a number of different ports from <offending-IP> to
<my-IP> on a number of priviledged ports including 110 (POP), 79 (finger), 23
(telnet), 143 (IMAP), 53 (DNS), and 635 (RLZ DBase).
Is this a proper interpretation? If so, what should I do to better protect my
machine? What should I do to check if they actually succeeded in breaching my
firewall? (I mean, all I logged was their failures, not their successes.) Is
there anything else I should do, such as trying to contact the administrator
of the <offending-IP> machine?
Thanks,
Nick B.
============= Posted via Deja News, The Discussion Network ============
http://www.dejanews.com/ Search, Read, Discuss, or Start Your Own
------------------------------
From: [EMAIL PROTECTED] (Ken Pizzini)
Crossposted-To:
comp.os.ms-windows.networking.tcp-ip,comp.os.ms-windows.nt.admin.networking,comp.protocols.tcp-ip,comp.unix.questions,comp.unix.solaris
Subject: Re: Help with interpretation of rfc951
Date: 8 Apr 1999 09:32:13 GMT
Reply-To: [EMAIL PROTECTED]
On Tue, 6 Apr 1999 09:39:33 -0400, Alan Booth <[EMAIL PROTECTED]> wrote:
>It seems that the way they interpreted rfc951, if the client places a text
>string in the "file" field in the Bootp request they do not replace that
>string with the string defined on the QIP server. So, the reply comes back
>with the "tip" string.
...
> Is this a fair interpretation
>of rfc951? In section 2 paragraph 4 it states that the client may provide a
>"tip" in it's request and quote:
>
> "When the server sends
> the bootreply, it replaces this field with the fully qualified
> path name of the appropriate boot file. In determining this name,
> the server may consult his own database correlating the client's
> address and filename request, with a particular boot file
> customized for that client."
This paragraph is quite specific about requiring the server
to return the actual FQPN of the boot file chosen. The "tip"
may be used or ignored by the server (at least as far as
this and the other paragraph of rfc951 that you quoted are
concerned) at its whim, but it _must_ return the actual FQPN
of the boot file that it chose for that client.
Please note, however, that I am just basing my statement on the
quoted sections of the rfc; it is possible that some other section
gives the server more latitude than is indicated in the above
paragraph.
--Ken Pizzini
------------------------------
From: Ron Watkins <[EMAIL PROTECTED]>
Subject: Re: Network Printer (Linux + MacOS + HP JetDirect)
Date: Mon, 12 Apr 1999 15:11:47 -0700
I thought I saw that HP had released the JetDirect admin software for Linux.
You might do a search on Linux at their site. I think I even downloaded it,
but I'm not sure where I put it offhand -- I never got around to installing
it. If you can't find it, send me email and I'll see if I can scrounge it up.
If you connect the printer via a parallel cable, you *should* be able to
enable TCP/IP that way. The odd network addresses you're seeing are Appletalk
network numbers, which do not correspond in any way to TCP/IP. You probably
cannot do a network snoop and find the printer, because it probably is
accessed only via Appletalk at the moment.
With TCP/IP disabled on the printer, the HP will suppress any TCP/IP settings
at the control panel until that protocol is enabled. The JetAdmin utility,
even though it claims otherwise, MIGHT be sufficiently compatible to at least
allow that much.
There is probably also some method of upgrading to a more recent firmware
revision.
The prior poster's idea of using an external print server isn't a bad one. I
bought one for a client for about $250 a year ago; it's very fast and works
very well. The one I got was from Lexmark. Had more options than you could
shake a stick at. :-)
<<RON>>
------------------------------
From: [EMAIL PROTECTED] (L J Bayuk)
Subject: Re: How does daemon take control from inetd?
Date: 14 Apr 1999 00:34:50 GMT
[EMAIL PROTECTED] wrote:
>
>
>I have a fairly sparse background in networking so please bear with me in
>the following question. I'm just learning networking (concentrating on
>how Linux does it as well).
>
>I'm trying to write a simple proof-of-concept Linux daemon to implement a
>simple protocl called NMP (Nearest-Mirror-Protocol) I'm designing, and I
>think I have everything I need to know figured out except for one thing -
>when inetd detects a connection to a port and spawns a daemon, how does
>the daemon connect to the proper client? The answer to this question
>would appear to be simple: the daemon connects to the proper port and the
>client and daemon are then connected. But I know that more than one
>client can connect to a given port and be served at a time, so how does
>the one-to-one correspondence come about? How does inetd get an IP
>address, or whatever else it sends, to the daemon so that the daemon can
>connect to the proper port and IP address?
>
>If this question is answered simply by just looking at the linux sockets
>interface, then please forgive me. I thought I'd go ahead and fire the
>question off *before* trying to write the code (though I am reading up on
>the sockets interface right now) to avoid major re-writes. I have looked
>all through my available docs (info, man, /usr/doc, and the RedHat Linux
>Library), but all the info I've found on inetd has been on how to
>configure it, which was useful to me but didn't help any with the
>programming side.
It's very simple. inetd accepts the connection, forks a new process running
the daemon program, and passes the open socket to the daemon as its
standard input (stream 0). So, the daemon doesn't do anything to connect
to the client - it is already connected when it starts; it just uses
stream 0 to talk to the client.
Multiple clients are simply by multiple daemons. inetd is always
listening for new connections, and creates a daemon for each one.
(Assuming the inetd.conf entry has "tcp" and "wait".)
------------------------------
From: [EMAIL PROTECTED]
Crossposted-To: nl.burgerrechten,nl.internet.algemeen,nl.internet.misbruik
Subject: Re: DNS - for yu (yugoslav) top-level-domain
Date: Tue, 13 Apr 1999 23:37:04 GMT
"Thijs Cobben" <[EMAIL PROTECTED]> wrote:
> The following is output from the relevant (unix-)command (like nslookup):
[snip]
> This can be interpreted as that all queries to any web-site under the .yu
> (yugoslav) TopLevelDomain are routed/answered/resolved by either ns.EU.net,
> sunic.sunet.se, ns.uu.net . True or not?
> All queries/GET requests for srbija.yu will be resolved by SOLAIR4.EUnet.yu
> (probably in possesion of EUNet organisation).
>
> I'm curious whether the delivery of this 'high-tech telecom service' is
> against trade embargo.
Sorry, but who gave you the idea that DNS is a 'high-tech telecom service'?
> Also curious about EUNet getting paid by Yugoslav government.
EUNet is not being paid by the Yugoslav government. EUnet.yu is 'owned' by the
private company, that can easily make payments from any part of the world. I
don't also remember that any european country did put embargo against
Yugoslavia for any 'high-tech telecom service', so why would it be a problem
anyway?
> Technically, I wonder what would happen if the DNS-entries for the yu-tld
> were to be deleted from these servers.
Nothing. First, you can't make them do it. Second, they would just reappear in
some other DNS servers.
--
http://members.xoom.com/nato_retards/index.html
--
============= Posted via Deja News, The Discussion Network ============
http://www.dejanews.com/ Search, Read, Discuss, or Start Your Own
------------------------------
Crossposted-To: comp.protocols.smb,linux.samba
From: [EMAIL PROTECTED]
Subject: Re: Samba->Win98 FAILS!
Date: Tue, 13 Apr 1999 17:11:55 +0100 (BST)
> I often get the same problem from a Win98-> Win98 machine or from a
> WinNT 4.0 SP4 to a Win98 machine... But when I do traffic the other
> way it works fine... never found a solution..
>
> > "Cannot copy filexyz: the specified network resource or device is
> > no longer available."
There are a variety of causes of this, probably associated to a greater
or lesser extent with Windows 98. Windows 98 is proprietary, and you
should consider contacting the vendor.
Specific causes include problems with the NIC or its driver; excessive
number of interrupts per second or cpu load (check with performance
monitor) and errors in the file sharing set-up.
Ben.
------------------------------
From: Anthony <[EMAIL PROTECTED]>
Crossposted-To:
comp.os.linux.misc,comp.os.linux.setup,hk.comp.os.linux,tw.bbs.comp.linux
Subject: Re: Detech Modem Speed
Date: Tue, 13 Apr 1999 19:54:39 +0000
Jack Cheng wrote:
>
> Hello,
>
> How do I check the connection speed while the modem on line ?
>
> Thanks
> Jack Cheng
Depends on how you get online. If you use minicom to gets online
you can deal with the modem directly - there is a trick to suspend
the modem and than type something like at commands to show the
statistic, after that you can resume it.
If you are using Kppp to dial into an ISP then Kppp has a graph to
show you the speed (not accurate if you use a local proxy server).
I use WindowMaker 0.52, the wmppp dock icon show me bytes transfer
per second in a small graph - if this is what u want.
Connection speed is a constant, online the transfer rate is different
over time. Also, data travel in a network is always in packets,
like letter from postoffice, you can wait for seconds or minutes
untill the next packet come so transfer rate is only an approximation.
------------------------------
From: [EMAIL PROTECTED]
Subject: ipchains MASQ problem...
Date: Wed, 14 Apr 1999 00:42:57 GMT
Hi,
I'm running RedHat 5.2 with version 2.2.5 of the kernel.
I'm try to get masqurading to work with IpChains (v 1.3.8)
The IPCHAINS-HOWTO stats that I can run:
# echo 1 > /proc/sys/net/ipv4/ip_forward
# ipchains -P forward -j DENY
# ipchains -A forward -i ppp0 -j MASQ
ipchains complains:
# ipchains -P forward -j DENY
ipchains: -P requires a chain and policy
# ipchains -A forward -i ppp0 -j MASQ
ipchains: no chain by that name
I must have something very wrong (with the kernel?). I turned on the proper
options in the kernel.
Any help would be greatly appreciated.
John
============= Posted via Deja News, The Discussion Network ============
http://www.dejanews.com/ Search, Read, Discuss, or Start Your Own
------------------------------
From: Michael J Surette <[EMAIL PROTECTED]>
Subject: Re: Problem with outbound e-mail on 2.2.5
Date: Mon, 12 Apr 1999 22:14:50 -0400
Edward Vale wrote:
> Michael J Surette wrote:
> >
> > "Gary S. Mackay" wrote:
> >
> > > Since I upgraded my RedHat 5.2 box to the newest
> > > ppp/kernel/diald/dialmon/etc., my users have been able to do everything
> > > except send mail. No matter what OS, email client, etc they use, NO
> > > email will go. They can browse (masq is working), receive e-mail, ftp,
> > > newsgroups, etc., they just can not send mail. As a test I setup an old
> > > 486 with the stock RedHat 5.2 (2.0.36) w/ ppp-2-3-5, and everything
> > > works just fine. I guess one solution is to leave well enough alone, but
> > > being a computer geek, I'd like to know why the new stuff won't work.
> > > (Same modem, phone line, ISP, etc.) Any ideas?
> > >
> > > --
> > > Edison Information Technologies
> > > P.O. Box 554
> > > Milan, OH 44846-0554
> > > 419.499.7040
> > > [EMAIL PROTECTED]
> > > --
> >
> > You need an mta running. On Stampede/Slackware which I am familiar with
> > that would be sendmail.
>
> You don't need sendmail running to SEND mail, only to receive it.
> BTW I have the exact problem as the original poster (with 2.2.1).
>
> > Another possibility is that your ipfw isn't allowing port 25 traffic
> > through.
> >
> > HTH
Actually, you do need sendmail or some other mta running unless your mua (the
mail program you actually use) is set up to use your ISPs mta. In that case
you can only send mail while you're online.
------------------------------
** FOR YOUR REFERENCE **
The service address, to which questions about the list itself and requests
to be added to or deleted from it should be directed, is:
Internet: [EMAIL PROTECTED]
You can send mail to the entire list (and comp.os.linux.networking) via:
Internet: [EMAIL PROTECTED]
Linux may be obtained via one of these FTP sites:
ftp.funet.fi pub/Linux
tsx-11.mit.edu pub/linux
sunsite.unc.edu pub/Linux
End of Linux-Networking Digest
******************************
