Re: F12 Rkhunter, Have I a rootkit? SOLVED

2010-01-06 Thread John Horne
On Tue, 2010-01-05 at 18:31 -0500, Gene Heskett wrote:
 On Tuesday 05 January 2010, John Horne wrote:
 On Tue, 2010-01-05 at 11:35 -1000, David Burns wrote:
  On Tue, Jan 5, 2010 at 7:46 AM, Frank Murphy (Frankly3D)
 
  frankl...@gmail.com wrote:
   This is a false positive.
 
  rkhunter gave me so many false positives I stopped using it. This is
  probably as much (or more) a comment on my character as it is on the
  value of rkhunter.
 
 Specific tests in RKH can be disabled, and false-positives whitelisted.
 
 
 
 John.
 
 _Most_ of the time. Despite some people including me, asking about 
 /usr/sbin/unhide, one of fedora's forensic tools if I read the manpage 
 correctly, no one has managed to come up with a way to add that file to the 
 rkhunter database as a legit file.  So we get at least 2 emails a day mewling 
 about it.  More trouble than its worth if it isn't going to be supported any 
 better than that.
 
I'm not quite sure what you mean by 'add that file to the rkhunter
database as a legit file'? You mean it is failing the file properties
test? If you email me the error you are getting then I'll take a look at
it.



John.

-- 
John Horne, University of Plymouth, UK
Tel: +44 (0)1752 587287Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines


Re: F12 Rkhunter, Have I a rootkit? SOLVED

2010-01-05 Thread John Horne
On Tue, 2010-01-05 at 11:35 -1000, David Burns wrote:
 On Tue, Jan 5, 2010 at 7:46 AM, Frank Murphy (Frankly3D)
 frankl...@gmail.com wrote:
  This is a false positive.
 
 rkhunter gave me so many false positives I stopped using it. This is
 probably as much (or more) a comment on my character as it is on the
 value of rkhunter.

Specific tests in RKH can be disabled, and false-positives whitelisted.



John.

-- 
John Horne, University of Plymouth, UK
Tel: +44 (0)1752 587287Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines


Re: rkhunter warning after updating

2009-11-30 Thread John Horne
On Mon, 2009-11-30 at 23:49 +, Andy Blanchard wrote:

 APP_WHITELIST=gpg httpd named sshd...
 
 I don't think it would actually be that hard to manage the list as
 RKHunter currently only check the versions of nine key packages -
 presumably to the author of RKHunter since Exim and ProFTP are checked
 while Fedora's defaults of Sendmail and VSFTP are not.

The 'apps' test was a legacy from previous versions when RKH was
maintained by Michael Boelen. The test has been discussed, and we would
rather get rid of it. As mentioned it only checks a handful of apps, and
trying to maintain the version numbers is not really possible. Whilst
the app itself may change its version number, a distro such as
RHEL/Fedora etc may just patch their version and alter the patch level
number, not the actual version number. So the warnings may well be
false-positives.

The latest release of RKH (1.3.6 came out yesterday) caused the updated
app version file to be pushed out as well. Hence the sudden flurry of
warnings for all 1.3 versions of RKH.

Personally I disable the test.



John.

-- 
John Horne, University of Plymouth, UK
Tel: +44 (0)1752 587287Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines


Re: Can anyone with a 64bit Fedora11 check something for me.

2009-11-24 Thread John Horne
On Mon, 2009-11-23 at 12:33 -0700, Reg Clemens wrote:
 Im confused here.
 Im getting an error message from Anacron, that states:
 
 /usr/bin/ldd: line 163: /lib/ld-linux.so.2: cannot execute binary file
 
 and this is true, the file mentioned is  symbolic link to /lib/ld-2.10.1.so
 which is  32bit library.  The 64bit symbolic link/library are in /lib64.
 
 So my question.
 Can you check your machine, and see if you have these two files in lib, viz
   /lib/ld-2.10.1.so
   /lib/ld-linux.so.2
 actually any ld-* files are of interest.
 I SUSPECT that they should not be there, and I have no idea how they
 got there, but I would like to check another Fedora11/64bit instalation.
 
On my home system (64-bit F11):

  ls -l /lib/ld*
  -rwxr-xr-x. 1 root root 152952 2009-08-19 16:02 /lib/ld-2.10.1.so
  lrwxrwxrwx. 1 root root 12 2009-09-10 10:04 /lib/ld-linux.so.2 -
 ld-2.10.1.so

  rpm -qf /lib/ld-2.10.1.so
  glibc-2.10.1-5.i686

  rpm -qf /lib/ld-linux.so.2
  glibc-2.10.1-5.i686


I have no errors from anacron that I am aware of. I assume that the
above were installed by me as a requirement for some 32 bit package.

My F11 (64-bit) PC at work does not have the files present.



John.

-- 
John Horne, University of Plymouth, UK
Tel: +44 (0)1752 587287Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines


Re: Extra mouse buttons

2009-11-13 Thread John Horne
On Thu, 2009-11-12 at 14:46 -0800, Konstantin Svist wrote:
 Hi all,
 
 Is there a good way to make the extra mouse buttons work in F11/F12?
 In F8 I used something called btnx to map buttons to actions, is that 
 still the way to go?
 BTW, I use a Logitech VX Revolution.
 
As others mentioned I think these originally went into xorg.conf.
However, with F11 as far as I remember all I did was put an xmodmap
command into my .bash_profile file:

   if [ -n `echo $DISPLAY | egrep '^(localhost)?:0'` ]; then
xmodmap -e pointer = 1 17 3 4 5 8 9 6 7 10 11 12 13 14 15 16 2
18 19 20  
   fi

This was for (I think) a Logitech MX performance at work, and something
like an M500 at home. The tilting wheel works, but you may want to remap
the button numbers to suit your own needs.




John.

-- 
John Horne   Tel: +44 (0)1752 587287
University of Plymouth, UK   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines


Re: rkhunter question

2009-10-23 Thread John Horne
On Fri, 2009-10-23 at 13:09 +0200, François Patte wrote:
 -BEGIN PGP SIGNED MESSAGE-
 Hash: SHA1
 
 Bonjour,
 
 rkhunter is running daily on my machine and for a while now I have this
 kind of message:
 
 [ Rootkit Hunter version 1.3.4 ]
 
 Checking rkhunter data files...
   Checking file mirrors.dat[ No update
   Checking file programs_bad.dat   [ No update ]
   Checking file backdoorports.dat  [ No update ]
   Checking file suspscan.dat   [ No update ]
   Checking file i18n/cn[ No update ]
   Checking file i18n/de[ No update ]
   Checking file i18n/en[ No update ]
   Checking file i18n/zh[ No update ]
   Checking file i18n/zh.utf8   [ No update ]
 
 What does it mean? No update every day?

Yes. These files change very rarely.


John.

-- 
John Horne   Tel: +44 (0)1752 587287
University of Plymouth, UK   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines


Re: SELinux Exim Problem

2009-09-09 Thread John Horne
On Wed, 2009-09-09 at 12:21 +0530, Didar Hossain wrote:
 On Wed, Sep 9, 2009 at 4:02 AM, John Hornejohn.ho...@plymouth.ac.uk wrote:
[snipped]
  However, and I don't know why, selinux objects when exim checks the /boot 
  partition. I
  suspect an selinux boolean may be required to allow exim to look at /boot.
 
 But, why check /boot? As far as I understood from the statvfs(2), it
 accepts a path to get the information. /boot is not something that
 Exim will use as a spool directory. Or am I missing something!?
 
  (When I installed F11 I used ext4 for the root partition, so I had to
  create a separate /boot partition using ext3.)
 
As said, because /boot is a separate partition. Statvfs looks at all the
partitions, not just the one containing the path, as far as I can tell
(look at strace output and you will see /proc/mounts being checked, and
then a stat of each partition). This is also why I was getting the same
errors for my other partitions. However, once I set their context to the
same as /usr (although I could have chosen some other directory
context), the errors for those partitions went away.

If /boot wasn't a separate partition then the problem wouldn't appear,
but since /boot must be ext3, and because I have / as ext4, so /boot
must be a separate partition.

The system is looking at /boot, but for some reason it is throwing up an
selinux error. That's the bit I don't understand (unless the 'boot_t'
context is somewhat specific about who can look at /boot, but then why
aren't errors shown if I simply try and do 'ls -l /boot'?).



John.

-- 
John Horne   Tel: +44 (0)1752 587287
University of Plymouth, UK   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines


Re: SELinux Exim Problem

2009-09-08 Thread John Horne
On Tue, 2009-09-08 at 13:12 +0530, Didar Hossain wrote:
 On Mon, Sep 7, 2009 at 4:08 PM, Daniel J Walshdwa...@redhat.com wrote:
  On 09/07/2009 04:34 AM, Didar Hossain wrote:
  On Sat, Sep 5, 2009 at 9:45 PM, Frank Chiullifrankc.fed...@gmail.com 
  wrote:
  On F11 when exim attempts to retrieve mail from my ISP, I get the 
  following:
 
[snipped]

 
  Since I have not heard anyone else complaining about this, I figure
  that it's my configuration.  I just don't know where else to look.
 
No, it's not just you. I upgraded my work PC yesterday from FC8 to F11.
I now see this problem.


 
 
  Probably some api that exim is calling is looking at the mounted
 file systems which is causing it to look at /boot.
 
 Do you think we need a Bug filed for this? An MTA doing a getattr on
 /boot seems a little unnecessary to me.
 
  I think we can allow this for now.
 
I pick up my mail using imaps both locally and remotely. To me this
'error' does not seem like correct behaviour; there is no need to look
at /boot at all. There are no accounts there, and no need to trawl
through / or the root directories. As to why it is doing it I have no
idea, but I would agree that it should be reported as a bug until
someone comes up with an explanation for it. I'll mention it on the Exim
mailing list to see if anyone there has an idea. I'll see if I can run
something locally to debug this.




John.

-- 
John Horne, University of Plymouth, UK
Tel: +44 (0)1752 587287Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines


Re: SELinux Exim Problem

2009-09-08 Thread John Horne
On Mon, 2009-09-07 at 06:38 -0400, Daniel J Walsh wrote:

 Probably some api that exim is calling is looking at the mounted file
 systems which is causing it to look at /boot.
 
 I think we can allow this for now.
 
Okay, I've done some investigating of this and can see what is happening
now.

Exim has 4 config options which check for disk space or inodes when a
message arrives. These are unset by default, but I had set one of them
('check_spool_space').

Exim checks the space/inodes by calling statvfs, which in turn looks
at /proc/mounts for mounted partitions. It then checks the mounted
partitions.

In my case I have 3 other partitions, and was receiving the same selinux
errors for those. I reset their selinux context to that of /usr (since
there is nothing of particular importance in those partitions). This
stopped selinux reporting about those partitions.

However, I still get errors about /boot, and obviously cannot reset its
context. I removed the exim config option (mentioned above), but it
seems that exim will also check on available space if a sending mail
server sends a message and uses the SIZE option to the SMTP MAIL
command. (I tested this and it is correct.) There is no way to disable
this.

So, the problem comes down to exim checking disk space/inodes to ensure
it can accept a message, and this is perfectly reasonable. To do this
the system checks the currently mounted partitions. However, and I don't
know why, selinux objects when exim checks the /boot partition. I
suspect an selinux boolean may be required to allow exim to look
at /boot.

(When I installed F11 I used ext4 for the root partition, so I had to
create a separate /boot partition using ext3.)



John.

-- 
John Horne, University of Plymouth, UK
Tel: +44 (0)1752 587287Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines


Virt-manager unable to access VM's.

2009-08-27 Thread John Horne
Hello,

Using F11, I have created, and used, 3 virtual machines. However, now
when I start the virtual machine manager (VMM) it only shows 'localhost'
as being active and nothing else. Previously it showed the 3 VM's, and
whether they were started up or shutdown, etc.

If I click on the localhost and ask for the 'details' and then
'Storage', it shows the 3 VM's and in the correct storage pool. The
state of the pool is active, and autostart on boot is ticked.

So the problem seems to be that the 3 VM's are present but that the VMM
is now not seeing them (having previously worked fine). Anyone any ideas
about this? How can I get the VMM to see the VM's?



Thanks,

John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: john.ho...@plymouth.ac.uk   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines


[OT] Awardbios virtualisation setting

2009-08-21 Thread John Horne
Hello,

I have been playing with KVM virtualisation under F11, and it has all
worked fine.

However, I am having a lot of trouble getting the 'Virtualisation'
setting to 'stick' in the BIOS. It seems that by default it is disabled.
If I enable it and then save the setting, the PC goes through a reboot,
but not power-off, and the setting is disabled again. IF I enable the
setting, save it, and then power off the PC, and then power-on/reboot,
it seems to work fine (virtualisation is enabled) until the next time I
reboot the PC. It is then back to being disabled.

Does anyone know how to make the virtualisation setting permanently
'enabled'? It is an abit motherboard (AN-M2; socket AM2), and an AMD
Athlon 64-bit X2 (6400 I think; the PC is at home and I'm at work at the
moment). The BIOS is phoenix awardbios version 6.01 (again I think). I
have checked with the abit web site, and I have the latest BIOS version
for this motherboard.


Thanks,

John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: john.ho...@plymouth.ac.uk   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines


Re: [OT] Awardbios virtualisation setting

2009-08-21 Thread John Horne
On Fri, 2009-08-21 at 10:40 -0400, Tom Horsley wrote:
 On Fri, 21 Aug 2009 15:11:32 +0100
 John Horne wrote:
 
  IF I enable the
  setting, save it, and then power off the PC, and then power-on/reboot,
  it seems to work fine (virtualisation is enabled) until the next time I
  reboot the PC. It is then back to being disabled.
 
 That sounds more like a symptom of the battery on the motherboard
 being too weak to keep the settings if power is removed for a while.
 You might try replacing it and see if the setting sticks then.
 
Well it's possible I guess. However, the time between setting
virtualization, power-off and reboot is a few seconds. The PC is usually
left off overnight, and has no problems the following day with any other
BIOS settings.



John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: john.ho...@plymouth.ac.uk   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines


Re: Is it possible to install Skype on Fedora 11 ?

2009-07-23 Thread John Horne
On Thu, 2009-07-23 at 13:58 +0300, Mark Ryden wrote:
 Hello,

 So I tried to install qt for 32 bit, and it failed with Transaction Check 
 Error:
 
Take a look at
http://www.my-guides.net/en/content/view/161/26/2/9/#fedora_skype

Scroll down for the skype installation. I used the skype repository. Yum
then resolves all the dependencies, and skype installed with no
problems.




John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: john.ho...@plymouth.ac.uk   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines


Re: Skype F11

2009-07-22 Thread John Horne
On Wed, 2009-07-22 at 18:50 +0200, DB wrote:
 Hi All,
 
 I know, Skype is not the most recommended...
 
 I've got Skype 2.0.0.75-fc5 (i586) running(?) on F11 
 2.6.29.5-191.fc11.i586 #1 SMP Tue Jun 16 23:11:39 EDT 2009 i686 i686 
 i386 GNU/Linux.  Using KDE.
 
 Whenever I try to test my webcam, call or receive a message,  Skype 
 closes down.  I can exchange Chat messages , and call the Skype Call 
 testing service.
 
Works for me:

skype-2.0.0.72-fc5.i586
kernel 2.6.29.5-191.fc11.x86_64
kdelibs-4.2.4-2.fc11.x86_64

Using KDE. Webcam is a logitech quickcam pro 9000. Webcam works fine, as
does sound; Skype test call works okay.

Anything in any log files?



John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: john.ho...@plymouth.ac.uk   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines


Re: Worried about having been hacked

2009-07-08 Thread John Horne
On Wed, 2009-07-08 at 12:08 +0100, James Allsopp wrote:
 Hi,
 I've checked all the files you asked me to. The following is the files
 from the yum whatprovides followed by that grepped on /var/log/
 
 chkconfig-1.3.38-1.i386
 Mar 26 00:53:01 Updated: chkconfig-1.3.38-1.i386
 rpm-4.6.1-1.fc10.i386
 Jun 10 08:34:24 Updated: rpm-4.6.1-1.fc10.i386
 passwd-0.75-2.fc9.i386
 never been updated.
 perl-5.10.0-68.fc10.i386
 Apr 22 16:54:07 Updated: 4:perl-5.10.0-68.fc10.i386
 
 
 This machine was installed about August 2008. The /usr/bin/passwd is
 shown in red, which I think indicates a broken symbolic link?
 
 [r...@87-194-141-15 ~]# which chkconfig
 /sbin/chkconfig
 [r...@87-194-141-15 ~]# ls -l /sbin/chkconfig
 -rwxr-xr-x 1 root root 28000 2008-10-29 15:35 /sbin/chkconfig
 
 [r...@87-194-141-15 ~]# which passwd
 /usr/bin/passwd
 [r...@87-194-141-15 ~]# ls -l /usr/bin/passwd
 -rwsr-xr-x 1 root root 25700 2008-04-08 14:48 /usr/bin/passwd
 
 [r...@87-194-141-15 ~]# which rpm
 /bin/rpm
 [r...@87-194-141-15 ~]# ls -l /bin/rpm
 -rwxr-xr-x 1 root root 23240 2009-05-18 12:26 /bin/rpm
 
 [r...@87-194-141-15 ~]# which perl
 /usr/bin/perl
 [r...@87-194-141-15 ~]# ls -l /usr/bin/perl
 -rwxr-xr-x 2 root root 8140 2009-04-14 12:26 /usr/bin/perl
 
 
 
 None of these files seems new, but could they have been altered? This
 is the first time I've seen this in rkhunter.
 Jim
 
The message means that some part of the system - libraries probably -
have been changed and hence the prelinking of commands (passwd,
chkconfig etc) now requires to be redone. Hence you get the warning
message, and an advisory to run the 'prelink' command.

Your system will, at some time, automatically prelink the relevant
commands/libraries, but if you want to avoid the rkhunter warnings until
then, then run the suggested prelink commands.

Run the shown prelink comands and then run:

  rkhunter --enable properties

The warnings should have gone.



John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: john.ho...@plymouth.ac.uk   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines


Re: Another rkhunter question

2009-05-17 Thread John Horne
On Sun, 2009-05-17 at 09:35 -0400, Gene Heskett wrote:
 Greetings all;
 
 What is /dev/shm?
 
 I've given up on rkhunter ever shutting up about the group and passwd files, 

What is it saying about the files? If necessary disable the relevant
passwd/group tests (use 'rkhunter --list test' to see the test names).


 but fussing about this is new.
 -- Start Rootkit Hunter Scan --
 Warning: Suspicious file types found in /dev:
  /dev/shm/sem.ADBE_REL_root: data
  /dev/shm/sem.ADBE_WritePrefs_root: data
  /dev/shm/sem.ADBE_ReadPrefs_root: data
 
Items in /dev/shm that are genuine can be whitelisted in rkhunter.conf.
There is an example of the pulse file whitelisted in the supplied
rkhunter.conf file. It is easy enough to do the same for the ADBE files.
No need to remove any packages.




John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: john.ho...@plymouth.ac.uk   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines


Re: Another rkhunter question

2009-05-17 Thread John Horne
On Sun, 2009-05-17 at 13:41 -0400, Gene Heskett wrote:
 On Sunday 17 May 2009, John Horne wrote:
 On Sun, 2009-05-17 at 09:35 -0400, Gene Heskett wrote:

 
  I've given up on rkhunter ever shutting up about the group and passwd
  files,
 
 What is it saying about the files? If necessary disable the relevant
 passwd/group tests (use 'rkhunter --list test' to see the test names).
 
 I would rather not, I would rather rkhunter's bug was fixed.  I have also 
 copied those files manually into rkhunters db, but that made no diff.
 From an email from rkhunter:
 Warning: Unable to check for passwd file differences: no copy of the passwd 
 file exists.
 Warning: Unable to check for group file differences: no copy of the group 
 file 
 exists.

Okay, can you run:

rkhunter --debug --enable passwd_changes group_changes

This will create a file in the /tmp directory named something like
'rkhunter_debug'. Can you email that to me please (it will be big, so do
not email to this list).

Secondly, did you install rkhunter from source or via an RPM from a
repository?

 
 I'd druther rkhunter was fixed.  --propupd, which is supposed to record the 
 systems 'clean' state if I understand it correctly, doesn't fix this.
 
No, the propupd option has nothing to do with passwd/group files. It
records file properties (mode, permissions, hash values etc). running
rkhunter with --propupd will make no difference in that respect.


  but fussing about this is new.
  -- Start Rootkit Hunter Scan --
  Warning: Suspicious file types found in /dev:
   /dev/shm/sem.ADBE_REL_root: data
   /dev/shm/sem.ADBE_WritePrefs_root: data
   /dev/shm/sem.ADBE_ReadPrefs_root: data
 
 Items in /dev/shm that are genuine can be whitelisted in rkhunter.conf.
 There is an example of the pulse file whitelisted in the supplied
 rkhunter.conf file. It is easy enough to do the same for the ADBE files.
 No need to remove any packages.
 
 I realize that John  thank you for the reply, but that doesn't tell me IF 
 they are _genuine_ or what the heck they are doing.
 
Ah, yes. Whether they are genuine or not is, I'm afraid, for you to
decide. I too have just upgraded acrobat to version 9, and have seen
these files created. I suspect a lot of people running rkhunter will get
caught out by them.

 
 I did find out who owns /dev/shm though, its kded4, and even with x stopped, 
 or a fresh reboot to runlevel 3, /dev/shm can be emptied, but cannot be 
 deleted as its 'busy'.  So I suppose the other files will reappear at some 
 point in the course of my daily activities.
 
I think if you run 'mount' you will see that /dev/shm is mounted as a
tmpfs. Basically it resides in memory (AFAIK), so the files will be
recreated when necessary after each reboot.



John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: john.ho...@plymouth.ac.uk   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines


Re: Web cam recommendations?

2009-02-23 Thread John Horne
On Mon, 2009-02-23 at 22:53 +0100, Erik P. Olsen wrote:
 On 23/02/09 22:41, Fernando Apesteguía wrote:
  On Mon, Feb 23, 2009 at 10:33 PM, Erik P. Olsen epod...@gmail.com wrote:
  On 23/02/09 14:34, Fernando Apesteguía wrote:
  [snip]
  You could try another choice like Ekiga, although I'm afraid to say it
  doesn't reach the quality in video than Skype does (I can receive
  video with Skype)
 
  What version of Skype do you have? The one I've got (version 2.0.0.72) 
  does not
  seem to have any video support at all.
  
  Hi,
  
  I'm gonna open a new thread instead of hijacking the subject of this one :)
  
 I don't think I hijacked the subject. It is about webcam recommendation for
 Skype and I don't believe that Skype for linux has video support, so AFAICT no
 webcam can be recommended at all. Or am I totally wrong?
  [snip]
 
Totally wrong I would say. I've got a Logitech Quickcam pro 9000 on my
F10 box. It has both video and audio - works fine with skype.


John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: john.ho...@plymouth.ac.uk   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines


Re: Skype and video[Was:Webcam recommendations?]

2009-02-23 Thread John Horne
On Mon, 2009-02-23 at 22:54 +0100, Fernando Apesteguía wrote:
 Hi all,
 
 I'm using Skype 2.0.0.72 and I have a Logitech QuickCam for Notebooks,
 as reported by lsusb:
 
 idVendor   0x046d Logitech, Inc.
 idProduct  0x08dd QuickCam for Notebooks
 bcdDevice1.00
 
 With this version of Skype, I'm able to see other people doing video
 conference (better quality with compiz disabled), but I can't get the
 webcam working. In Options-Video, the webcam is detected, but when I
 push the Test button, all I get is this:
 
 Starting the process...
 Skype Xv: Xv ports available: 4
 Skype XShm: XShm support enabled
 Skype Xv: Using Xv port 131
 Here Skype closes and I get the command prompt again
 
 Nothing catches my eye in the system log. I tried to install
 libv4l.i386 but it didn't make any difference.
 
 Any success cases? Any hints on how to solve this?
 
For just testing the webcam video I used the 'ucview' command (it's in
the ucview package). As mentioned in the old thread, I have a Logitech
webcam, on a PC not a notebook though, and the ucview command detects
the webcam fine, and displays what the webcam sees (basically me looking
at my monitor!).

I've been using skype from home to work using both audio and video. The
only problem I had was getting audio to work, one setting in skype
needed to be changed, then audio worked.

Skype package is: skype-2.0.0.72-fc5.i586



John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: john.ho...@plymouth.ac.uk   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines


Re: Web cam recommendations?

2009-02-23 Thread John Horne
On Mon, 2009-02-23 at 23:41 +0100, Erik P. Olsen wrote:

 Thanks, but I can't find any newer version than 2.0.0.72 and I can't see how 
 you
 enable video on this version.

The package I am running is skype-2.0.0.72-fc5.i586 (albeit on an F10
x86_64 box).

I don't think I had to enable it as such, skype automatically found the
webcam as a usb device. However, right-clicking on the skype icon and
selecting 'options' shows a 'Video Devices' section. Within there there
are tick-boxes to enable video, and select the video device.



John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: john.ho...@plymouth.ac.uk   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines


Re: KDE 4.2 Konsole Minor Problem?

2009-02-09 Thread John Horne
On Mon, 2009-02-09 at 13:20 -0500, homb...@tips-q.com wrote:
 There are no longer screen size options, There is no longer
 a save as default option which saves the geometry nor is
 the screen size available in profiles. 
 
Sounds like this reported bug/feature:
https://bugs.kde.org/show_bug.cgi?id=152385

You may want to add some votes to it, to see if it gets picked up soon.



John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: john.ho...@plymouth.ac.uk   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines


Re: rkhunter Question.

2009-01-16 Thread John Horne
On Fri, 2009-01-16 at 12:18 -0200, Paulo Cavalcanti wrote:

 I have run rkhunter --propupd many times, I do have  a copy of group
 and passwd in /var/run/rkhunter, but I always receive an email saying
 that there is no copy of group and passwd. Upgrading to 1.3.4 did not
 change anything. This happens on every computer I have rkhunter
 installed.
 
Copying of the files does not happen when '--propupd' is used. It occurs
when the system is checked - using '--check' or more specifically when
the 'passwd_changes' and/or 'group_changes' tests are enabled.

Try running 'rkhunter --enable passwd_changes,group_changes --sk', and
then run it again. If the second one still produces a warning about the
files, then email me off list with a copy of your log file
(usually /var/log/rkhunter.log).



John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: john.ho...@plymouth.ac.uk   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines


Re: rkhunter Question.

2009-01-08 Thread John Horne
On Thu, 2009-01-08 at 15:22 -0500, Gene Heskett wrote:
 On Thursday 08 January 2009, John Horne wrote:
 On Thu, 2009-01-08 at 16:42 +, John Horne wrote:
  On Thu, 2009-01-08 at 09:38 -0500, Gene Heskett wrote:
   They say a little paranoia is a good thing, so I installed the rkhunter
   rpm, which in turn apparently sets itself up as a cron job.
  
   I got emails from it bitching about a couple of perfectly legit files,
   and I found out where to whitelist them, so that warning is gone.  While
   I was at it I enabled another set of tests that weren't by default, the
   additional_rkts.
  
   Now it is complaining about the lack of copies for passwd and group, but
   they do exist as name- files.  Is this a foible of rkhunter, or a
   redhatism?
  
   Recommended fix?
 
  Do nothing. When rkhunter is first run it has no copy of the
  passwd/group files to check against for changes. Hence the warning. As
  it runs, it will take a copy. When it runs again, it then has a copy, so
  the warning goes away.
 
 Hmm, actually thinking about it the rkhunter.spec file specifies to
 install copies of the files when the rpm is installed. As such the error
 should not have occurred. May want to raise that with the packager of
 the rpm (i.e. report it via the fedora bugzilla).
 
 If they previously exist as name- files due to being edited with vim, they 
 apparently are not over written.  Each was a generation old, not containing 
 my latest additions.  I have over written them now  we'll see.
 
 Should the rpm installer have over written them?  I dunno, there could be 
 problems intro'd either way in this case.
 
The rkhunter installer will not overwrite anything in /etc. The copies
it takes of the files are for its own use and put into a separate secure
directory. It is those files it looks for.

Looking at the rkhunter 1.3.2 rpm spec file (as used for the Fedora
package), it does not seem to take an initial copy of the files. So that
would explain why you got the initial warning. However, as has already
been replied, the spec file for 1.3.4 FC10 does do this initial copy
(although I cannot personally verify that).




John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: john.ho...@plymouth.ac.uk   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines


Re: Verifying inode number using rpm and ls

2008-12-18 Thread John Horne
On Thu, 2008-12-18 at 20:18 +0200, Panu Matilainen wrote:
 On Sat, 13 Dec 2008, John Horne wrote:
  [Apologies for cross-posting from the opensuse list]
 
  Hello,
 
  I was wondering if someone could tell me why there is a difference in
  the reported inode number of a file from the 'ls' command, and from the
  'rpm' command. For example, using the /usr/bin/wget file, I get:
 
  ls -i /usr/bin/wget
  365523 /usr/bin/wget
 
  rpm -qf --qf '[%{FILEINODES}:%{FILENAMES}\n]' /usr/bin/wget|
  grep ':/usr/bin/wget$'
  157816006:/usr/bin/wget
 
  I realise that prelinking will cause the inode number to change, but
  even without prelinking the numbers reported are not the same.
 
  Surely the rpm package manager database will report the inode number of
  the installed file. Running 'rpm -Vf /usr/bin/wget' verifies the file as
  okay, although as far as I am aware rpm verification does not include
  testing the inode number.
 
 Hysterical as it is, the inode numbers in packages are from the host used 
 to build the package so they'll never match what you have installed.
 
Hmm, so it seems! Even rebuilding a package and then installing it, the
inode numbers come up different. Thanks for the reply.



John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: john.ho...@plymouth.ac.uk   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines


Re: What is a VDHL document (text/x-vdhl)

2008-12-13 Thread John Horne
On Sat, 2008-12-13 at 16:09 +0100, M. Fioretti wrote:
 On Sat, Dec 13, 2008 12:30:46 PM +0100, Chitlesh GOORAH wrote:
   With the installation of rkhunter-1.3.2-5.fc10.noarch, my Daily Run
   email (generated by cron) is being sent as a VDHL document (text/x-
   vdhl).  The script is sending the output of rkhunter with /bin/mail.
  
   Can anyone say what a VDHL doc is and how one opens it?
  
  Hello Geoffrey,
  
  VHDL is a hardware description language used to design chips/FPGA.
 
 yes, but:
 
 1) the OP said vdhl, not vhdl
 2) why should a rootkit hunter generate hardware description languages
as a report?
 
It isn't. This problem was recently reported to the rkhunter users list.
The problem is the Fedora package contains a cron job to run rkhunter.
That job, however, should have included an option (for cron jobs) which
suppresses certain console character codes (makes pretty colours on the
console output). The output from the rkhunter cron job is emailed to the
root user, and when the mailer sees those odd character codes it
generates the vdhl mime type.

As far as I am aware this has been reported to the fedora rkhunter
packager as a bug.



John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: john.ho...@plymouth.ac.uk   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines


Verifying inode number using rpm and ls

2008-12-13 Thread John Horne
[Apologies for cross-posting from the opensuse list]

Hello,

I was wondering if someone could tell me why there is a difference in
the reported inode number of a file from the 'ls' command, and from the
'rpm' command. For example, using the /usr/bin/wget file, I get:

 ls -i /usr/bin/wget
 365523 /usr/bin/wget

 rpm -qf --qf '[%{FILEINODES}:%{FILENAMES}\n]' /usr/bin/wget|
grep ':/usr/bin/wget$'
 157816006:/usr/bin/wget

I realise that prelinking will cause the inode number to change, but
even without prelinking the numbers reported are not the same.

Surely the rpm package manager database will report the inode number of
the installed file. Running 'rpm -Vf /usr/bin/wget' verifies the file as
okay, although as far as I am aware rpm verification does not include
testing the inode number.



Thanks,

John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: john.ho...@plymouth.ac.uk   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines


Re: NetworkManager and OpenVPN

2008-12-13 Thread John Horne
On Sat, 2008-12-13 at 15:08 -0800, Geoffrey Leach wrote:
 I'm unable to communicate locally on my very small -:) local network. 
 
 There's a laptop with wired (192.168.10.2) and wireless (192.168.10.3)
 connected to a NetGear router (192.168.10.1). As a consequence of these 
 two connections, I got NetworkManager when I installed F10. There have 
 been problems with NM in the past, but the setup seems to work fine.
 
 I'm attempting to add another system with a wireless connection. (As 
 192.168.10.4) I was able to ping the new connection, but I couldn't get 
 beyond that.
 
 Same problems talking _locally_, viz:
 
 # telnet 127.0.0.1 
 Trying 127.0.0.1...
 telnet: connect to address 127.0.0.1: Connection refused
 
To enable this you need the telnet-server and xinetd packages installed.
Then make sure you have enabled the telnet service
in /etc/xinetd.d/telnet (and restart the xinetd service)



John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: john.ho...@plymouth.ac.uk   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines


RE: root login

2008-12-01 Thread John Horne
On Wed, 2008-11-26 at 07:23 -0800, bruce wrote:

 appparently f10, has modified the default behavior to restrict you
 from logging in as the root user. 
 
Not that I have noticed. I installed F10 on my home PC at the weekend.
Installed the KDE desktop, and not GNOME. Logged straight in as root.
Didn't have to change anything.



John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: [EMAIL PROTECTED]   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines


Re: KDE4 auto-hiding of panel

2008-10-23 Thread John Horne
On Thu, 2008-10-23 at 12:54 -0500, Rex Dieter wrote:
 Patrick Mansfield wrote:
 
  Did this get backported into Fedora 9?
  If so, how do you auto-hide the panel?
 
 https://admin.fedoraproject.org/updates/F9/FEDORA-2008-9028
 
Okay, maybe I'm being a bit dumb here, but that link goes to a web page
which says:

   1. Click on the palette (cashew) icon for the panel to bring up the
  panel controller.
   2. Choose More Settings.

What 'palette icon'? Where is that? I can find nothing which says 'more
settings'.



John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: [EMAIL PROTECTED]   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines


Re: KDE4 auto-hiding of panel

2008-10-23 Thread John Horne
On Thu, 2008-10-23 at 21:19 +0100, John Horne wrote:
 On Thu, 2008-10-23 at 12:54 -0500, Rex Dieter wrote:
  Patrick Mansfield wrote:
  
   Did this get backported into Fedora 9?
   If so, how do you auto-hide the panel?
  
  https://admin.fedoraproject.org/updates/F9/FEDORA-2008-9028
  
 Okay, maybe I'm being a bit dumb here, but that link goes to a web page
 which says:
 
1. Click on the palette (cashew) icon for the panel to bring up the
   panel controller.
2. Choose More Settings.
 
 What 'palette icon'? Where is that? I can find nothing which says 'more
 settings'.
 
Okay, forget that. Wrong version of kdebase-workspace. Sorry.

John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: [EMAIL PROTECTED]   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines


Re: F9 KDE4 running ssh-add at login

2008-10-06 Thread John Horne
On Sun, 2008-10-05 at 19:39 -0500, Rex Dieter wrote:
 John Horne wrote:
  
  I am running Fedora 9, with KDE4, and am trying to get ssh-add to prompt
  me for my passphrase when KDE starts up. Actually it does prompt me, but
  the problem seems to be that it never remembers the passphrase. I always
  have to manually run 'ssh-add' from the command-line, and then enter the
  passphrase.
  
  I see that others have had a similar problem (and not just Fedora
  users), but none of the solutions work. I have tried adding a soft link
  to 'ssh-add' in the ~/.kde/Autostart directory; I currently have a very
  small shell script that calls '/usr/bin/ssh-add' in the Autostart
  directory; I have also tried these solutions in the ~/.kde/env
  directory; and finally I have tried using ksshaskpass, which also did
  not work, but as far as I can tell this only works for KDE3 at the
  moment.
 
 ~/.kde/env should work (so should ksshaskpass, afaik).
 
 ~/Autostart (afaik) only works for .desktop files.
 
I have used a small shell script in the Autostart directory for the past
several releases of Fedora, and it has worked fine. If the use of
'Autostart' has changed (which is perfectly possible), then it is
something recent.

The site I looked at for ksshaskpass
(http://www.kde-apps.org/content/show.php/Ksshaskpass?content=50971)
states:

A KDE 4 version of ksshaskpass is in the works.

and the current version depends on KDE 3.x. Hence I assumed the
currently available version is for KDE3 only.



John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: [EMAIL PROTECTED]   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines


F9 KDE4 running ssh-add at login

2008-10-05 Thread John Horne
Hello,

I am running Fedora 9, with KDE4, and am trying to get ssh-add to prompt
me for my passphrase when KDE starts up. Actually it does prompt me, but
the problem seems to be that it never remembers the passphrase. I always
have to manually run 'ssh-add' from the command-line, and then enter the
passphrase.

I see that others have had a similar problem (and not just Fedora
users), but none of the solutions work. I have tried adding a soft link
to 'ssh-add' in the ~/.kde/Autostart directory; I currently have a very
small shell script that calls '/usr/bin/ssh-add' in the Autostart
directory; I have also tried these solutions in the ~/.kde/env
directory; and finally I have tried using ksshaskpass, which also did
not work, but as far as I can tell this only works for KDE3 at the
moment.

Putting in some simple echo commands (redirected to a file), I can see
that the script in Autostart is being run, and that ssh-agent is
running.

Anyone got a solution for this?


Thanks,

John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: [EMAIL PROTECTED]   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines


Re: what's wrong with rkhunter?

2008-09-04 Thread John Horne
On Thu, 2008-09-04 at 08:40 +0200, François Patte wrote:
 Le 04.09.2008 02:02, Kevin Fenzi a écrit :
  On Thu, 04 Sep 2008 00:01:24 +0200
  [EMAIL PROTECTED] (François Patte) wrote:
  
  -BEGIN PGP SIGNED MESSAGE-
  Hash: SHA1
 
  Bonjour,
  
  Greetings. 
  
  I tried to run rkhunter -c on my system.
 
  Result:
 
  The language specified is not available: en
  Use the command 'rkhunter --lang en --list languages' to see the list
  of available languages.
 
 
  I am not so bad, I tried what they said:
 
  rkhunter --lang en --list languages
 
  then again:
 
  The language specified is not available: en
  Use the command 'rkhunter --lang en --list languages' to see the list
  of available languages.
 
If it is a default installation - which I think the Fedora RPM does -
then the language files should be in the '/var/lib/rkhunter/db/i18n'
directory. What rkhunter (RKH) is saying is that the 'en' language file
is not there.

You can run 'rkhunter --update' and it will try and download the latest
language files, even if they (including the 'en' file) are not currently
present on your system.

If you want to provide a new translation then you can do this by
translating the 'en' file into your langauge. (You only need to
translate the message text in the file, not the keywords (e.g. not
MSG_TYPE_WARNING and so on, just the text after the first colon)). Put
the file into the above directory, and either use the '--lang'
command-line option, or set the LANGUAGE in your /etc/rkhunter.conf
configuration file. You can then test it out. The downside is that as
RKH develops so the 'en' file changes; you need to try and keep up with
those changes. RKH will use the 'en' file if a particular keyword is not
in your language file - that way RKH keeps working even if your langauge
file gets out of date. If you want the language file made part of the
RKH program, then please submit this as a feature request on the RKH bug
tracker page
(http://sourceforge.net/tracker/?atid=794190group_id=155034func=browse)



Regards,

John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: [EMAIL PROTECTED]   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines


Re: pptp tunnel mss clamping

2008-07-17 Thread John Horne
On Sun, 2008-06-29 at 21:41 +0100, William Murray wrote:
 Hi all,
 I am having big trouble with a pptp tunnel from a home network to
 work. I need to prevent large frames coming back through the tunnel.
 For years I used this in the firewall/nat iptables setup:
 
 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1100
 
 but something, (upgrading F7 to F9, I think) has stopped it working. I 
 have been trying lots of examples of the WWW and have no luck. Does anyone 
 know what
 changed - or even which table I should be applying this to?
 
 Also, it is hard to debug as wireshark does not receive the large frame 
 which brings down the tunnel.  Is there an easy way to generate arbitrary 
 sized frames?
 
 Thanks for any help.
 Ps: My rules:. Rather guessed at...
 [EMAIL PROTECTED] sbin]# /sbin/iptables -L
 Chain INPUT (policy ACCEPT)
 target prot opt source   destination
 ACCEPT all  --  anywhere anywhere   
 ACCEPT all  --  anywhere anywhere   
 REJECT udp  --  anywhere anywhereudp 
 dpt:bootps reject-with icmp-port-unreachable
 REJECT udp  --  anywhere anywhereudp 
 dpt:domain reject-with icmp-port-unreachable
 ACCEPT tcp  --  anywhere anywheretcp dpt:ssh
 DROP   tcp  --  anywhere anywheretcp 
 dpts:spr-itunes:1023
 DROP   udp  --  anywhere anywhereudp 
 dpts:0:1023
 
 Chain FORWARD (policy DROP)
 target prot opt source   destination
 DROP   all  --  anywhere 168.254.0.0/16 
 ACCEPT all  --  168.254.0.0/16   anywhere   
 ACCEPT all  --  anywhere 168.254.0.0/16 
 
Your iptables output doesn't show TCPMSS at all. Using F9, I added your
command (-A FORWARD ...) to iptables and it shows:

  Chain FORWARD (policy ACCEPT)
  target prot opt source   destination
  TCPMSS tcp  --  0.0.0.0/00.0.0.0/0   tcp
flags:0x06/0x02 TCPMSS set 1100
  REJECT all  --  0.0.0.0/00.0.0.0/0
reject-with icmp-host-prohibited

iptables version iptables-1.4.1.1-1.fc9.x86_64.

Since it doesn't appear in the iptables output is anything about it
logged in /var/log/messages?



John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: [EMAIL PROTECTED]   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list


Re: Unable to set LC_COLLATE system-wide

2008-06-05 Thread John Horne
On Tue, 2008-06-03 at 22:09 -0430, Patrick O'Callaghan wrote:
 On Tue, 2008-06-03 at 22:58 +0100, John Horne wrote:
 
  The trouble is I do not know what the login sequence is when logging
  into an X window system. As such, I cannot say what is being run between
  the first run of /etc/profile and the second.
 
 It's not only X itself, it's the whole desktop environment. In principle
 you can follow the breadcrumbs via the man pages, but this line
 (in /etc/profile etc.) will add more info to your debug comments and
 might be useful:
 
 echo This shell called from `ps -p $PPID -o comm=`, pid=$PPID  
 /tmp/BASH_DEBUG
 
Runlevel 3 shows 'login' being used; runlevel 5 shows that 'init'
calls /etc/profile first, and then 'gdm-session-worker' calls it again.

  
  Since I'm a bit stumped as to where to go from here, but it definitely
  seems that something 'odd' is going on, I think perhaps this should go
  up to bugzilla?
 
 Could be. It certainly doesn't seem to be doing what it says on the tin.
 
Bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=450052


John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: [EMAIL PROTECTED]   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list


Re: Unable to set LC_COLLATE system-wide

2008-06-04 Thread John Horne

On Wed, 2008-06-04 at 08:52 +0200, Karl-Olov Serrander wrote:
 On Tue, 3 Jun 2008, Patrick O'Callaghan wrote:
 
  On Tue, 2008-06-03 at 22:58 +0100, John Horne wrote:
 
  The trouble is I do not know what the login sequence is when logging
  into an X window system. As such, I cannot say what is being run between
  the first run of /etc/profile and the second.
 
  It's not only X itself, it's the whole desktop environment. In principle
  you can follow the breadcrumbs via the man pages, but this line
  (in /etc/profile etc.) will add more info to your debug comments and
  might be useful:
 
  echo This shell called from `ps -p $PPID -o comm=`, pid=$PPID  
  /tmp/BASH_DEBUG
 
  At runlevel 5, if I switch to a virtual console and log in, then both
  variables are set correctly.
 
  Since I'm a bit stumped as to where to go from here, but it definitely
  seems that something 'odd' is going on, I think perhaps this should go
  up to bugzilla?
 
  Could be. It certainly doesn't seem to be doing what it says on the tin.
 
  poc
 
 Are you running gnome ? Have you set Run command as a login shell in your
 profile for gnome-terminal ?
 
No, I use KDE.


John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: [EMAIL PROTECTED]   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list


Unable to set LC_COLLATE system-wide

2008-06-03 Thread John Horne
Hello,

I have noticed that despite setting both LC_COLLATE and LANG in
the /etc/sysconfig/i18n file, it seems that the LC_COLLATE does not get
set for normal users, but does get set for root.

The file contains:

  #LANG=en_US.UTF-8
  SYSFONT=latarcyrheb-sun16
  LANG=en_GB
  LC_COLLATE=C

but checking it seems that LC_COLLATE is not exported:

  {john}11: echo $LANG
  en_GB
  {john}12: echo $LC_COLLATE

  {john}13:

For root though:

  [EMAIL PROTECTED] ~]# echo $LANG
  en_GB
  [EMAIL PROTECTED] ~]# echo $LC_COLLATE
  C
  [EMAIL PROTECTED] ~]#


Anyone know how I can get LC_COLLATE set on a system-wide basis for
ordinary users?
I have checked on an F9, F8 and FC7 system, and it is not set on any of
them (for ordinary users), but LANG is. Ironically on an RHEL3 (update
9) and RHEL4 (update 6) system, both variables are set and exported for
all users.


Thanks,

John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: [EMAIL PROTECTED]   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list


Re: End of Support for F8?

2008-06-03 Thread John Horne
On Tue, 2008-06-03 at 10:43 -0400, Henok Mikre wrote:
 Does anyone know the end of support date for Fedora 8? I could only
 find the one for FC6 at
 http://poelstra.fedorapeople.org/schedules/f-9/f-9-all-tasks.html
 which is set for Fri 2007-12-07. 
 
A look at http://fedoraproject.org/wiki/LifeCycle

indicates that end of life will be one month after the release of Fedora
10. And the F10 schedule is at
http://fedoraproject.org/wiki/Releases/10/Schedule

which indicates release on 28 October 2008. So, F8 end of life will be
about December 2008 (if things go on schedule!).


John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: [EMAIL PROTECTED]   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list


Re: Unable to set LC_COLLATE system-wide

2008-06-03 Thread John Horne
On Tue, 2008-06-03 at 07:52 -0700, gerrynix wrote:
   On Tue, 2008-06-03 at 13:41 +0100, John Horne wrote:
I have noticed that despite setting both LC_COLLATE and LANG in
the /etc/sysconfig/i18n file, it seems that the LC_COLLATE does
 not
get set for normal users, but does get set for root.
   
   Did you reboot?
   
  Yup.
 
 OK, just checking.
 
 The action appears to be in the file /etc/profile.d/lang.sh, where there
 is a check for $HOME/.i18n. If this exists it's sourced, except that
 $LANG is preserved. Then there's a bunch of other special cases which
 you would need to pore over. Of course if the user doesn't have a
 $HOME/.i18n file it just sets some standard defaults.
 
 I don't know if any of this explains what you're seeing.
 
 poc
 
 Not sure if this will fill your needs, but you will have no further
 probs... Place the assignments in the /etc/profile. Of course, they
 are then set into the environment on a per login basis. If you have
 *csh users, also place the assignments in the /etc/csh.login. 

Okay, thanks for the replies.

I'm still a bit confused though. On my F9 system I have
an /etc/sysconfig/i18n file, but no '$HOME/.i18n'. So according to
the /etc/profile.d/i18n file, it should execute:

  for langfile in /etc/sysconfig/i18n $HOME/.i18n ; do
[ -f $langfile ]  . $langfile  sourced=1
  done

Then a bit further on we have:

  [ -n $LC_COLLATE ]  export LC_COLLATE || unset LC_COLLATE

Since I have set LC_COLLATE=C in /etc/sysconfig/i18n, then LC_COLLATE
should be exported.

Perhaps I need to test a little bit more.


John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: [EMAIL PROTECTED]   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list


Re: Unable to set LC_COLLATE system-wide

2008-06-03 Thread John Horne
On Tue, 2008-06-03 at 09:46 -0430, Patrick O'Callaghan wrote:
 On Tue, 2008-06-03 at 13:41 +0100, John Horne wrote:
  I have noticed that despite setting both LC_COLLATE and LANG in
  the /etc/sysconfig/i18n file, it seems that the LC_COLLATE does not
  get set for normal users, but does get set for root.
 
 Did you reboot?
 
Yup.


John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: [EMAIL PROTECTED]   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list


Re: F9 - DPMS not working

2008-06-01 Thread John Horne
On Thu, 2008-05-29 at 18:29 +0100, John Horne wrote:

 Using F9, with KDE 4.0.4 desktop, my LCD display never seems to enter
 power-saving mode. I have a screensaver configured to kick in after 5
 mins, and that works fine. The Xorg log file shows that DPMS is enabled,
 as does 'xset -q'. Running 'xset dpms force off' (or standy/suspend) and
 the screen turns off, so it can do it. I have left the system for nearly
 an hour, but the monitor is still on. This occurred under the vesa
 driver, but I have today installed the latest Nvidia drivers and the
 problem still exists. F8, using the same hardware, had no such problem.
 
Upon further investigation, the problem *only* occurs if the Start
automatically option is set when configuring a screensaver. Disable the
option, and DPMS works as expected. Most odd. Bugzilla'd at
https://bugzilla.redhat.com/show_bug.cgi?id=449280

This is not a graphics card driver problem.


John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: [EMAIL PROTECTED]   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list


Re: nvidia drivers now available from livna - has anyone tried?

2008-05-30 Thread John Horne
On Fri, 2008-05-30 at 12:17 -0400, Eric Mesa wrote:

 So I have two questions:
 1) Has anyone tried this?  Does it in fact work with Fedora 9's
 pre-release Xorg 7.4?  I don't use Compiz, but I do use 3D
 acceleration for games and Blender

I'm using the 64-bit drivers with no major problems (see previous email
that dpms does not seem to work though). I ran some of the GL
screensavers, and glxgears and they all ran fine.

 2) If I were to go the preupgrade route, do I first install the livna
 Fedora 9 repo package and then preupgrade?  (I have some other livna
 packages installed)  Do I preupgrade and then install the latest livna
 repo package?  Does preupgrade fail with this type of situation?
 Should I just do yum upgrade again?
 
Absolutely no idea :-)


John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: [EMAIL PROTECTED]   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list


F9 - DPMS not working

2008-05-29 Thread John Horne
Hello,

Using F9, with KDE 4.0.4 desktop, my LCD display never seems to enter
power-saving mode. I have a screensaver configured to kick in after 5
mins, and that works fine. The Xorg log file shows that DPMS is enabled,
as does 'xset -q'. Running 'xset dpms force off' (or standy/suspend) and
the screen turns off, so it can do it. I have left the system for nearly
an hour, but the monitor is still on. This occurred under the vesa
driver, but I have today installed the latest Nvidia drivers and the
problem still exists. F8, using the same hardware, had no such problem.

Any ideas, suggestions?


Thanks,

John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: [EMAIL PROTECTED]   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list


Re: F9 - DPMS not working

2008-05-29 Thread John Horne
On Thu, 2008-05-29 at 18:30 +, Matthew Saltzman wrote:
 On Thu, 2008-05-29 at 18:29 +0100, John Horne wrote:
  Hello,
  
  Using F9, with KDE 4.0.4 desktop, my LCD display never seems to enter
  power-saving mode. I have a screensaver configured to kick in after 5
  mins, and that works fine. The Xorg log file shows that DPMS is enabled,
  as does 'xset -q'. Running 'xset dpms force off' (or standy/suspend) and
  the screen turns off, so it can do it. I have left the system for nearly
  an hour, but the monitor is still on. This occurred under the vesa
  driver, but I have today installed the latest Nvidia drivers and the
  problem still exists. F8, using the same hardware, had no such problem.
  
  Any ideas, suggestions?
 
 Generate some traffic here:
 
 https://bugzilla.redhat.com/show_bug.cgi?id=351661
 
 and let's see if we can't get some action on the vesa driver.  If you
 can, update the version to 9, otherwise, include the fact that it is F9
 in your comment.
 
Not sure that will help. Now that I have installed the nvidia stuff, if
I run vesa again it reports as coming from nvidia, not from the Fedora
supplied one. I suspect the Fedora people will not accept that.


John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: [EMAIL PROTECTED]   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list


Re: F9: evolution mail with URL

2008-05-28 Thread John Horne
On Tue, 2008-05-27 at 16:45 +0100, John Horne wrote:
 
 I have noticed with F9, using Evolution mail client, that if a message
 contains a web URL and I click on it (the URL), Firefox is started up
 but remains 'minimised' in the taskbar. That is, it doesn't open up and
 show me the web page until I click on the Firefox icon in the taskbar.
 
 Since I clicked on the URL in the mail message, I would have thought it
 somewhat obvious that I want to look at the web page :-) I could see no
 options in Evolution or Firefox about this.
 
Well, what can I say? With cap in hand, I have to apologise about this.
I have just returned to work, and my F8 PC, only to find that it
(Evolution/Firefox) does exactly the same thing as under F9! I installed
F9 on my home PC, and have been going through it these past few days to
see what has changed. I *thought* that the above behaviour was different
from F8. Apparently it is not, and, in fact, Evolution/FF are doing what
they did before.


Apologies, but thanks for the replies,

John.

-- 
---
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: [EMAIL PROTECTED]   Fax: +44 (0)1752 587001

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list