[SLUG] Offer for SLUG members

2005-04-06 Thread Chris Deigan

Greetings,

Please direct all queries to Jacinta about this. :)


- Forwarded message from Jacinta Richardson [EMAIL PROTECTED] -

Learn (more) about mod_perl
===
Stas Bekman, author of Practical mod_perl and mod_perl developer, has 
organised with Perl Training Australia to run 2 mod_perl courses for general 
enrollment during his trip to Australi in June.  If you (or your workmates) 
have been wondering about what mod_perl is, or if you're a user of mod_perl 
and want to know more about mod_perl 2.0 then you might be interested in one 
or both of these courses.

*Getting started with mod_perl* covers mod_perl basics including why
mod_perl is so popular, how you can use it to speed up your CGI
programs and lots more.

*mod_perl 2.0, the next generation* covers the improvements mod_perl 2.0
brings over the 1.xx generation.  This includes further performance gains and
memory-sharing improvements.

Further information can be found on our website: http://perltraining.com.au/

Course  Date  Cost

Getting started with mod_perl   13th June 2005 $630
mod_perl 2.0, the next generation   14th June 2005 $630

*** Course places must be booked by 29th April 2005 ***

To book on these courses visit:
http://perltraining.com.au/bookings/Sydney.html

The above table includes our user group discount of $30 per person.  To gain 
this discount you must mention SLUG as your referrer when booking on the 
course.

Other Perl courses
==
Perl Training Australia is running the following courses over the next few 
months which might be of interest.

CourseDate Cost
---
Database Programming with Perl:   9th June $630
Perl Security:   10th June $630
Object Oriented Perl: 21-22nd July$1050

Once again, please mention SLUG to obtain your discount(s)

All the best,

Jacinta
-- 
   (`-''-/).___..--''`-._  |  Jacinta Richardson |
`6_ 6  )   `-.  ( ).`-.__.`)  |  Perl Training Australia|
(_Y_.)'  ._   )  `._ `. ``-..-'   |  +61 3 9354 6001|
  _..`--'_..-_/  /--'_.' ,'   | [EMAIL PROTECTED] |
 (il),-''  (li),'  ((!.-' |   www.perltraining.com.au   |


- End forwarded message -

Cheers,
Chris.
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [SLUG] Optus Cable

2005-04-06 Thread mlh

I used Optus cable, never had any issues with it.

I don't connect my machine directly, I go via a little
box that is a dhcp client to optus and a dhcp server to
my lan.

I have no reason to think it doesn't work directly though.

Support is fine.  Extremely few dropouts. 

Matt
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


[SLUG] Connecting to a CheckPoint FW-1

2005-04-06 Thread Jesus Salvo Jr.

Anyone here connects to a data centre managed by Hostworks ... which runs 
CheckPoint FW-1 ?

The CheckPoint SecureClient software for RedHat only works with RH 7.3.

The only way I could connect to our network at the Optus data centre managed 
by Hostworks is by running RH 7.3 as a guest OS on qemu, with the host OS as 
Fedora Core 3 ( or FC1 and FC2 in the past ), and then install CheckPoint 
SecureClient on the guest OS ( RH 7.3 ). Specify the IP of the firewall, then 
specify username and password.

Works OK, but I cannot directly connect to the VPN from within the host OS. 
Thus, if I want to ssh to any of our SPARC or Dell boxes, I have to ssh first 
to the guest OS, and then ssh again to the intended host within the VPN. 
Pain ... but no other option.

I had peeked at ipsec-tools and openswan, but they all seem to be site-to-site 
interop with CheckPoint instead of client-to-server interop with CheckPoint 
FW-1.

Anyone with a better setup / interop than me ?


Regards,

John
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [SLUG] dealing with compromised machine ?

2005-04-06 Thread Anand Kumria
On Wed, Apr 06, 2005 at 11:28:47AM +1000, O Plameras wrote:
 
 And probably, as bad if not worst, your security procedures inside
 your Intranet is failing. Latest statistics indicate that about 50 percent
 of security breaches are perpetrated from inside the Intranet and still
 counting.

[snip]

 Check this site  and give your intranet and internet security the
 super-boost, if you are not already:
 
 http://web.mit.edu/kerberos/www/
 http://www.openafs.org/

Interesting - sounds like you know your stuff.

Would you be willing to give a talk on either of these?  While I've come
across them, I never had time to investigate what they are about.

Cheers,
Anand

-- 
 `When any government, or any church for that matter, undertakes to say to
  its subjects, This you may not read, this you must not see, this you are
  forbidden to know, the end result is tyranny and oppression no matter how
  holy the motives' -- Robert A Heinlein, If this goes on --


signature.asc
Description: Digital signature
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html

Re: [SLUG] Optus Cable

2005-04-06 Thread Grant Parnell
On Wed, 6 Apr 2005, john gibbons wrote:

 I can give you some feedback. I was with Optus cable broadband for 2 
 years and just recently discontinued to transfer to Unwired. Glad I did. 
 An excellent service and cheaper.
 
 Just for fun I have run Fedora 3 and other distros on Optus but also 
 experienced a lot of headaches at times getting some of them configured. 
 I never succeeded with some. Fedora 3, Red Hat 9 and Mandrake 10 gave no 
 trouble with Mandrake and Red Hat actually connecting themselves up with 
 virtually no help from me. I am still a beginner with Linux and am not a 
 text man - quite confined to GUI clicking. So you can believe me when I 
 say something is easy to set up.
 
 BUT - and here is my gripe with Optus Broadband. It is advertised at one 
 basic fee for 1 gig but they do not mention the compulsory rent for the 
 telephone line they put in and, in my case, a spare telephone I did not 
 want. So it actually cost $20 per over the quoted fee. But maybe you 
 will not get caught as I did.

Are you talking about Cable or ADSL? The subject is about cable, the stuff 
you get the TV through. I am aware that they can actually provide 
telephone over the cable though.

I've got a customer that's got 2 optus cable links at different sites, 
neither of them are a problem. The trick is if you switch ethernet cards 
or plug it into a different machine pull the plug on the cable modem to 
reset it. It will only talk to the first MAC address it sees. I spent half 
an hour figuring that out. (Same for i-burst ethernet).


-- 
---GRiP---
Electronic Hobbyist, Former Arcadia BBS nut, Occasional nudist, 
Linux Guru, SLUG President, AUUG and Linux Australia member, Sydney 
Flashmobber, Tenpin Bowler, BMX rider, Walker, Raver  rave music 
lover, Big kid that refuses to grow up. I'd make a good family pet, 
take me home today!
Some people actually read these things it seems.

-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [SLUG] Optus Cable

2005-04-06 Thread Paul Dwerryhouse
On Wed, Apr 06, 2005 at 07:08:43PM +1000, Grant Parnell wrote:
 I've got a customer that's got 2 optus cable links at different sites, 
 neither of them are a problem. The trick is if you switch ethernet cards 
 or plug it into a different machine pull the plug on the cable modem to 
 reset it. 

Yup. And it _has_ to be the plug - the reset/stanby button won't do it.

Cheers,

Paul

-- 
Paul Dwerryhouse| PGP Key ID: 0x6B91B584
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


[SLUG] Re: Speaking of wireless...

2005-04-06 Thread Ben Buxton
Michael Fox [EMAIL PROTECTED] uttered the following thing:
 Interesting article;
 
 http://www.tomsnetworking.com/Sections-article111-page1.php
 
 Extract;
 
 Millions of wireless access points are spread across the US and the
 world. About 70% percent of these access points are unprotected?wide
 open to access by anyone who happens to drive by. The other 30% are
 protected by WEP (Wired Equivalent Privacy) and a small handful are
 protected by the new WPA (Wi-Fi Protected Access) standard.

Yep I will vouch for that. Last night I was on a 1/2hr train ride with
my lappy open, and came across hundreds of APs, over half of them open.

It's quite fun to just sit and watch them roll by the screen as the
train goes past.

BB

-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [SLUG] Optus Cable

2005-04-06 Thread John Gibbons
Yes, cable. I am in a 2 story house and they put a cable into my 
upstairs room. A telstra phone line was downstairs with extensions 
upstairs. So I did not need another phone. However, a phone came with it 
and when I queried the need for
for it they told me it was a necessary part of the installation anyway. 
That added $20 to the advertised monthly cost of the service. Maybe I 
was gullible.

Anyway, when I rang and queried the whole deal 18 months later (slow of 
me, I know) I was told the handset could go but I still had to have the 
line because it serviced the modem and would have to continue to pay $10 
per month for that. This means that the advertised monthly cost of the 
broadband service was shonky and it was dearer than people were being told.

That got up my nose so I recently changed over to Unwired. Saves money, 
is an excellent service and I can take the modem elsewhere where 
reception exists and use it with my laptop. I fool around with 3 
computers, all running Windows alongside Linux and the Unwired service 
is a trouble free installation even a beginner can understand. A router 
means all 3 computers share the modem without cable swapping which I was 
doing with Optus gear.So I am in front.

I apologise for this  long reply but I warn anyone considering Optus 
Broadband to check that they are actually getting the service at the 
advertised price with no non-essential add-ons that are a disguised cost.

Maybe the pricing is more transparent now - I hope so.
John.

Grant Parnell wrote:
On Wed, 6 Apr 2005, john gibbons wrote:
 

I can give you some feedback. I was with Optus cable broadband for 2 
years and just recently discontinued to transfer to Unwired. Glad I did. 
An excellent service and cheaper.

Just for fun I have run Fedora 3 and other distros on Optus but also 
experienced a lot of headaches at times getting some of them configured. 
I never succeeded with some. Fedora 3, Red Hat 9 and Mandrake 10 gave no 
trouble with Mandrake and Red Hat actually connecting themselves up with 
virtually no help from me. I am still a beginner with Linux and am not a 
text man - quite confined to GUI clicking. So you can believe me when I 
say something is easy to set up.

BUT - and here is my gripe with Optus Broadband. It is advertised at one 
basic fee for 1 gig but they do not mention the compulsory rent for the 
telephone line they put in and, in my case, a spare telephone I did not 
want. So it actually cost $20 per over the quoted fee. But maybe you 
will not get caught as I did.
   

Are you talking about Cable or ADSL? The subject is about cable, the stuff 
you get the TV through. I am aware that they can actually provide 
telephone over the cable though.

I've got a customer that's got 2 optus cable links at different sites, 
neither of them are a problem. The trick is if you switch ethernet cards 
or plug it into a different machine pull the plug on the cable modem to 
reset it. It will only talk to the first MAC address it sees. I spent half 
an hour figuring that out. (Same for i-burst ethernet).

 

--
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [SLUG] Optus Cable

2005-04-06 Thread Paul Dwerryhouse
On Wed, Apr 06, 2005 at 08:00:15PM +1200, John Gibbons wrote:
 Anyway, when I rang and queried the whole deal 18 months later (slow of 
 me, I know) I was told the handset could go but I still had to have the 
 line because it serviced the modem and would have to continue to pay $10 
 per month for that. 

Que? Geez, their helldesk people really haven't been touched by the
cluestick.

As far as I was aware, the $10 was a discount that you got for having
both services.

Back when they started charging for it, the line by itself was $20 per
month.  Having just cable internet was ~$60 (I can't remember what I was
actually paying back then). If you had them together, then it was only
$70 all up.

 I apologise for this  long reply but I warn anyone considering Optus 
 Broadband to check that they are actually getting the service at the 
 advertised price with no non-essential add-ons that are a disguised
 cost.

Ah well, I've never had a problem with them, other than that nasty thing
they did by capping their unlimited plans. Still with them after three
and a half years...

Cheers,

Paul

-- 
Paul Dwerryhouse| PGP Key ID: 0x6B91B584
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [SLUG] RHEL 3 ? hardware req ?

2005-04-06 Thread Voytek

quote who=Mike MacCana
 Voytek wrote:


 RHEL 3 support will be available till 2010.

 RHEL 3 also currently has more applications certified for it then RHEL 4
 does, but that depends on what apps you use - if you're setting up
 network infrastructure etc. then I'd go for RHEL 4. It also has other

Mike, thanks,

nope, it's just for AMP .. or it PAM? MPA ? web and mail server thing


what are realistic hardware/RAM requirements for EL ?

in the past, I've tried to install on a system with 256MB, and, the
installer told me I was short of RAM, and, wouldn't proceed


 The machine didn't have integarted video did it? RHEL 3 wants 256 MB or
 RAM for use by the system - if the video card takes 8 of that, you'll
 get a warning.

not sure, but, yes, 1 or 2 MB got taken by something else, and, the system
was just a little shy of 'full' 256
if I recall, I was able to ignore, but, not able to succeed.

so, to run a web/sql/mail server with RHEL : 1GHz CPU and 1GB RAM should
be enough ?

-- 
Voytek
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


[SLUG] UNSW Compsoc Installfest

2005-04-06 Thread Phoebe Goh
(x-posted to slug-chat)

Howdy,

I'm the organiser of the UNSW Computing Society Installfest that is
held usually twice a year.

The first Installfest for this year is being held this Saturday at
UNSW.  We generally install Debian/Fedora/Mandrake and this year
we're looking at doing some Ubuntu installs too.

In the past, SLUG folks have come down to lend a hand (thanks!) so I'm
hoping some of you might be able to volunteer your Saturday for a Good
Cause. 

Details are:
This Saturday, April 9
10:30 - 4:30
at UNSW Oboe lab.  I'll try to put some signs up, but otherwise, it's
the building next to the gigantic sphere at the top of the University
Walk.  For those of you who have been before, it's the same lab as
always. :)

If you're interested, reply to me via email to tell me you're coming -
I'll also answer any queries thru' email.

Cheers,

Phoebe
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [SLUG] UNSW Compsoc Installfest

2005-04-06 Thread Menno Schaaf
ah, i guess i can try to drag my self away from work for a bit to help out

On Apr 6, 2005 9:28 PM, Phoebe Goh [EMAIL PROTECTED] wrote:
 (x-posted to slug-chat)
 
 Howdy,
 
 I'm the organiser of the UNSW Computing Society Installfest that is
 held usually twice a year.
 
 The first Installfest for this year is being held this Saturday at
 UNSW.  We generally install Debian/Fedora/Mandrake and this year
 we're looking at doing some Ubuntu installs too.
 
 In the past, SLUG folks have come down to lend a hand (thanks!) so I'm
 hoping some of you might be able to volunteer your Saturday for a Good
 Cause.
 
 Details are:
 This Saturday, April 9
 10:30 - 4:30
 at UNSW Oboe lab.  I'll try to put some signs up, but otherwise, it's
 the building next to the gigantic sphere at the top of the University
 Walk.  For those of you who have been before, it's the same lab as
 always. :)
 
 If you're interested, reply to me via email to tell me you're coming -
 I'll also answer any queries thru' email.
 
 Cheers,
 
 Phoebe
 --
 SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
 Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html
 


-- 
Menno Schaaf aka ginji
irc.austnet.org #gentoo #linux-help
irc.ifirc.net #linux
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [SLUG] argh! printer not workiong on ubuntu :(

2005-04-06 Thread Taryn East
sigh

of course - five minutes after having sent this (throwing my hands up in
disgust) I removed it, reinstalled it and now it works :P

oh well... murphy's law is still firmly in operation ;)

Still, I'm not complaining too loudly! :)

Cheers,
Taryn

* Taryn East [EMAIL PROTECTED] spake thus:
 ok, I've had enough - I really want my printer working and I just can't
 seem ot get it to. :(
 
 I run ubuntu (hoary) and it seems to detect it's there just fine, but it
 keeps telling me parallel port busy will try again - of course it's a
 USB printer and I keep changing it to either use detected printer or
 even USB port #1 (after checking that it actually is a) plugged into
 said port and b) turned on).
 
 it still won't actually print me up a test page
 
 this is really annoying as it was working fine when I had it on Warty.
 :(
 
 
 is anyone able to help me figure out what's going wrong here? :(
 
 Thanks in advance,
 Taryn
 
 
 -- 
 This .sig temporarily out-of-order.
 We apologise for any inconvenience
 - The Management
 -- 
 SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
 Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html
 
-- 
This .sig temporarily out-of-order.
We apologise for any inconvenience
- The Management
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [SLUG] UNSW Compsoc Installfest

2005-04-06 Thread Simon Brown
On 6 Apr 2005, at 21:28, Phoebe Goh wrote:
In the past, SLUG folks have come down to lend a hand (thanks!) so I'm
hoping some of you might be able to volunteer your Saturday for a Good
Cause.
Will compsoc be providing the traditional pizza for the volunteers? :P
-s
--
Simon Brown [EMAIL PROTECTED]
--
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [SLUG] argh! printer not workiong on ubuntu :(

2005-04-06 Thread Taryn East
ok, striek that... it prints the test page just fine, but when I try to
actually print a pdf it just prints, well, you coudl say it prints with
invisible ink... though there's a lot of printing going on for a
completely blank page :P


Anyone have any idea what might be going on?

Cheers,
Taryn

 
-- 
This .sig temporarily out-of-order.
We apologise for any inconvenience
- The Management
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [SLUG] dealing with compromised machine ?

2005-04-06 Thread telford
These suggestions are for next time, I suspect it is too late
to take any of these on board in this particular situation.

On Wed, Apr 06, 2005 at 08:16:14AM +1000, Voytek wrote:
 I have a compromised RH73 machine, until such time as I can pull it down,
 what can I do to identify and shut down any rogue processes/backdoors ?

First thing I would suggest is some network dumping. Consider either
ethereal or tcpdump, get an old, dumb hub and drop it into the ethernet
connection to that machine, be quick so it doesn't lose connectivity for
more than a few seconds. Then put a temporary machine on the same hub,
bring up an interface (but give that interface no IP number) and start
dumping to hard drive. Don't use a switch! Old 10Meg ethernet hubs are
best but you can still get 100Meg hubs if you search.

Save those dumps for when you talk to the police (of course you are
going to do the right thing and report this) they will find the dumps
very useful. Hopefully whoever broke in will make some contact with
the broken box and might reveal something about themselves.

NB: at this stage you do NOT want to do anything abnormal that might
make it clear that you are paying great attention to this machine.
The sniffer machine can be completely self contained with no contact
to the outside world other than silently sniffing. Don't even think
about trying to sniff on the same machine that is broken.

 I've removed all the baddies, but, I expect there will be some open ports ?
 is there a way to shut them in the interim period till I can get to the
 machine ?

There is a big problem with leaving a compromised machine active and
also removing stuff while it is live. It is a much more dangerous
thing than just leaving the compromised machine alone. Whoever has
broken your machine has (approximately) the following priorities:

[1] Remain undetected
[2] Keep the machine active and stable
[3] Collect information
[4] Use the machine to break other machines

Once they know they have been detected the above priorities go out
the window and they really only have one thing that matters anymore
which is destroying evidence and cleaning up their tracks as much
as possible. By poking around and removing this and that you are
spelling it out to whoever is on the other end of the line that they
should think about filling your partitions with random numbers.

So you sort of have to operate in two distinct modes... BEFORE you
let them know they have been detected you are trying to watch from the
sidelines and make notes... when you decide that enough is enough,
then you have to pull the network plug clean, type sync a few times
and just turn it off. There's no half-way.

After you do turn it off, boot off a CDROM and take a full hard drive
image which the police will also find useful. The rootkits are quite
often customised and may contain links to websites, other compromised
machines and bits of forensic evidence that might make it to court.
Some people leave bash history behind, others leave temporary files
and all sorts of stuff. They spend all day filtering through this junk
putting clues together, often from multiple sites. You are paying for
this, might as well keep them busy and get something for your money.

By the way, in NSW the investigation of computer related crimes
is the job of the fraud squad, see http://www.police.nsw.gov.au/

- Tel  ( http://bespoke.homelinux.net/ )
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


[SLUG] USB HD mounting ?

2005-04-06 Thread Voytek
I'm trying to mount USB IDE HD

I can mount OK an USB RAM with:
mount /dev/sda1 /mnt/usbhd

when I try the same with a 40GB IDE/USB HD, I get:

# mount /dev/sda1 /mnt/usbhd
/dev/sda1: Input/output error
mount: you must specify the filesystem type

# mount /dev/sda1 /mnt/usbhd -t auto
/dev/sda1: Input/output error
mount: you must specify the filesystem type
# mount /dev/sda1 /mnt/usbhd -t fat
mount: fs type fat not supported by kernel
# mount /dev/sda1 /mnt/usbhd -t vfat
mount: wrong fs type, bad option, bad superblock on /dev/sda1,
   or too many mounted file systems
# mount /dev/sda1 /mnt/usbhd -t mdos
mount: fs type mdos not supported by kernel
# mount /dev/sda1 /mnt/usbhd -t msdos
mount: wrong fs type, bad option, bad superblock on /dev/sda1,
   or too many mounted file systems

what do I need ?
even though the drive is 'IDE' the interface is /dev/sd??, yes ?
-- 
Voytek
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [SLUG] USB HD mounting ?

2005-04-06 Thread mlh
On Wed, Apr 06, 2005 at 11:34:13PM +1000, Voytek wrote:
 I'm trying to mount USB IDE HD
 
 I can mount OK an USB RAM with:
 mount /dev/sda1 /mnt/usbhd
 
 when I try the same with a 40GB IDE/USB HD, I get:
 
 # mount /dev/sda1 /mnt/usbhd
 /dev/sda1: Input/output error
 mount: you must specify the filesystem type


 # mount /dev/sda1 /mnt/usbhd -t vfat
 mount: wrong fs type, bad option, bad superblock on /dev/sda1,
or too many mounted file systems

Put the options before the files.  This goes for pretty much
any unix/linux command:

mount -t vfat /dev/sda1 /mnt/usbhd


-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


[SLUG] Possible hacker Attempt

2005-04-06 Thread Phill








Ive been searching through my system logs and found what
appears to be hacking attempts through apache. 



Unfortunately I am pretty green when it comes to this sort
of thing. So, Im sure I have what would seem to be very basic questions
to some. 



I do have system logs, ip addresses, and times so if it is
warranted, the cops will be notified



Can somebody tell me what the hacker is doing here:



GET /default.ida?X(lots
of Xs)X %u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u%u00=a
HTTP/1.0 404 300 - -



and similarly



SEARCH /\x90\x02\xb1\.. (x02\xb1\
repeats hundreds of times) .\ x02\xb1\x90\...(repeats hundreds of times)...\x90\x90\x90\x90\x90\x90
414 341 - -



These appear to be the two types of attempts



How do I know if my system has been compromised? (apart from
logs obviously and changes to files)



What do the end messages mean ie u%u00=a
HTTP/1.0 404 300 - - or  414 341
- - or  400 300 - -









Regards,

Phill 










smime.p7s
Description: S/MIME cryptographic signature
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html

Re: [SLUG] Possible hacker Attempt

2005-04-06 Thread Gottfried Szing
hi

 GET /default.ida?X...(lots of X's)...X
 %u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u
 9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u%u00=a HTTP/1.0
 404 300 - -

isn't that the code red worm? still in the wild?

 SEARCH /\x90\x02\xb1\.. (x02\xb1\ repeats hundreds of times)
 .\ x02\xb1\x90\...(repeats hundreds of
 times)...\x90\x90\x90\x90\x90\x90 414 341 - -

AFAIR this is an request that uses an exploit of the IIS and webdav
component (unchecked buffer).

but as long as you don't have IIS and windows running, nothing to fear
about. both attacks works with IIS only and can be ignored on apache. they
are just annoying (messing up the logs) but they cannot compromise the
system.

cu

-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


FW: [SLUG] Possible hacker Attempt

2005-04-06 Thread Phill
What is AFAIR

Regards,
Phill


-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf
Of Gottfried Szing
Sent: Thursday, 7 April 2005 1:39 AM
To: slug@slug.org.au
Subject: Re: [SLUG] Possible hacker Attempt

hi

 GET /default.ida?X...(lots of X's)...X

%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u
 9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u%u00=a
HTTP/1.0
 404 300 - -

isn't that the code red worm? still in the wild?

 SEARCH /\x90\x02\xb1\.. (x02\xb1\ repeats hundreds of times)
 .\ x02\xb1\x90\...(repeats hundreds of
 times)...\x90\x90\x90\x90\x90\x90 414 341 - -

AFAIR this is an request that uses an exploit of the IIS and webdav
component (unchecked buffer).

but as long as you don't have IIS and windows running, nothing to fear
about. both attacks works with IIS only and can be ignored on apache. they
are just annoying (messing up the logs) but they cannot compromise the
system.

cu

--
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


smime.p7s
Description: S/MIME cryptographic signature
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html

FW: [SLUG] Possible hacker Attempt

2005-04-06 Thread Phill
I am also curious. How does this attack work? I understand the idea of
filling up a buffer with junk but then

Regards,
Phill


-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf
Of Gottfried Szing
Sent: Thursday, 7 April 2005 1:39 AM
To: slug@slug.org.au
Subject: Re: [SLUG] Possible hacker Attempt

hi

 GET /default.ida?X...(lots of X's)...X

%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u
 9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u%u00=a
HTTP/1.0
 404 300 - -

isn't that the code red worm? still in the wild?

 SEARCH /\x90\x02\xb1\.. (x02\xb1\ repeats hundreds of times)
 .\ x02\xb1\x90\...(repeats hundreds of
 times)...\x90\x90\x90\x90\x90\x90 414 341 - -

AFAIR this is an request that uses an exploit of the IIS and webdav
component (unchecked buffer).

but as long as you don't have IIS and windows running, nothing to fear
about. both attacks works with IIS only and can be ignored on apache. they
are just annoying (messing up the logs) but they cannot compromise the
system.

cu

--
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


smime.p7s
Description: S/MIME cryptographic signature
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html

Re: FW: [SLUG] Possible hacker Attempt

2005-04-06 Thread Howard Lowndes

Phill wrote:
I am also curious. How does this attack work? I understand the idea of
filling up a buffer with junk but then
As Gottfried said, on Linux it doesn't work, but on IIS it causes a 
buffer overflow which then allows uncontrolled access for the exploit - 
or something like that - I don't pay btoo much attention to Microsoft 
type problems.

Regards,
Phill
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf
Of Gottfried Szing
Sent: Thursday, 7 April 2005 1:39 AM
To: slug@slug.org.au
Subject: Re: [SLUG] Possible hacker Attempt
hi

GET /default.ida?X...(lots of X's)...X
%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u
9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u%u00=a
HTTP/1.0
404 300 - -

isn't that the code red worm? still in the wild?

SEARCH /\x90\x02\xb1\.. (x02\xb1\ repeats hundreds of times)
.\ x02\xb1\x90\...(repeats hundreds of
times)...\x90\x90\x90\x90\x90\x90 414 341 - -

AFAIR this is an request that uses an exploit of the IIS and webdav
component (unchecked buffer).
but as long as you don't have IIS and windows running, nothing to fear
about. both attacks works with IIS only and can be ignored on apache. they
are just annoying (messing up the logs) but they cannot compromise the
system.
cu
--
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html
--
Howard.
LANNet Computing Associates - Your Linux people http://lannet.com.au
--
When you just want a system that works, you choose Linux;
When you want a system that just works, you choose Microsoft.
--
Flatter government, not fatter government;
Get rid of the Australian states.
begin:vcard
fn:Howard Lowndes
n:Lowndes;Howard
org:LANNet Computing Associates
adr:;;PO Box 1174;Lavington;NSW;2641;Australia
email;internet:howard [AT] lowndes [DOT] name
tel;work:02 6040 0222
tel;fax:02 6040 0222
tel;cell:0419 464 430
note:I am heartily sick and tired of telemarketers, therefore I do not answer phone calls which do not present Caller Line Identification, they get flicked to voicemail.  I apologise if this inconveniences you, and I respect your right to not identify yourself, but I also ask that you respect my right to not answer your call if you choose not to identify yourself.  Try dialing 1832 (#32# from mobiles) before the number, to present Caller Line Identification.
x-mozilla-html:FALSE
url:http://www.lannet.com.au
version:2.1
end:vcard

-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html

Re: [SLUG] USB HD mounting ?

2005-04-06 Thread Voytek

quote who=[EMAIL PROTECTED]
 On Wed, Apr 06, 2005 at 11:34:13PM +1000, Voytek wrote:
 I'm trying to mount USB IDE HD

 Put the options before the files.  This goes for pretty much
 any unix/linux command:

   mount -t vfat /dev/sda1 /mnt/usbhd


already tried, returns same errors
whatever 't' option I've tried
what 't' option for an unformatted HD ?


-- 
Voytek
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [SLUG] USB HD mounting ?

2005-04-06 Thread Rob Sharp
Hi,

Surely if it's unformatted you don't want to mount it? Perhaps you
want to make a filesystem on it using mkreiserfs or similar , passing
/dev/sda as the drive to format...

IIRC sda1 is the first partition on the sda device, and wont work if
theres no partitions (i.e. unformatted).

Rob.

On Apr 7, 2005 8:17 AM, Voytek [EMAIL PROTECTED] wrote:
 
 quote who=[EMAIL PROTECTED]
  On Wed, Apr 06, 2005 at 11:34:13PM +1000, Voytek wrote:
  I'm trying to mount USB IDE HD
 
  Put the options before the files.  This goes for pretty much
  any unix/linux command:
 
mount -t vfat /dev/sda1 /mnt/usbhd
 
 already tried, returns same errors
 whatever 't' option I've tried
 what 't' option for an unformatted HD ?
 
 --
 Voytek
 --
 SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
 Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html
 


-- 
Rob Sharp
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


[SLUG] Python Interest Group

2005-04-06 Thread Richard Hayes
Dear list,
Is pig.slug doing anything?
If not, is there any other python group having meetings?
--
Richard Hayes
Nada Marketing
PO Box 12 Gordon NSW Australia 2074
Tel: +(61-2) 9412 4367 Fax: +(61-2) 9412 4920 Mob: +(61) 0414 618 425
www.nada.com.au
begin:vcard
fn:Richard Hayes
n:Hayes;Richard
org:Nada Marketing
adr:;;PO Box 12;Gordon;NSW;2072;Australia
email;internet:[EMAIL PROTECTED]
title:Director
tel;work:+(61-2) 9412 4367
tel;fax:+(61-2) 9412 4920
tel;cell:+(61) 0414 618 425
url:http://www.nada.com.au
version:2.1
end:vcard

No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.308 / Virus Database: 266.9.3 - Release Date: 5/04/2005
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html

FW: [SLUG] Possible hacker Attempt

2005-04-06 Thread Phill
OK. I did a bit of reading on the subject. Linux can be vulnerable to
buffer overrun attacks can't it? If not, why not?

Regards,
Phill


-Original Message-
From: Howard Lowndes [mailto:[EMAIL PROTECTED]
Sent: Thursday, 7 April 2005 7:30 AM
To: Phill
Cc: slug@slug.org.au
Subject: Re: FW: [SLUG] Possible hacker Attempt



Phill wrote:
 I am also curious. How does this attack work? I understand the idea of
 filling up a buffer with junk but then

As Gottfried said, on Linux it doesn't work, but on IIS it causes a
buffer overflow which then allows uncontrolled access for the exploit -
or something like that - I don't pay btoo much attention to Microsoft
type problems.


 Regards,
 Phill


 -Original Message-
 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
Behalf
 Of Gottfried Szing
 Sent: Thursday, 7 April 2005 1:39 AM
 To: slug@slug.org.au
 Subject: Re: [SLUG] Possible hacker Attempt

 hi


GET /default.ida?X...(lots of X's)...X



%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u

9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u%u00=a

 HTTP/1.0

404 300 - -


 isn't that the code red worm? still in the wild?


SEARCH /\x90\x02\xb1\.. (x02\xb1\ repeats hundreds of times)
.\ x02\xb1\x90\...(repeats hundreds of
times)...\x90\x90\x90\x90\x90\x90 414 341 - -


 AFAIR this is an request that uses an exploit of the IIS and webdav
 component (unchecked buffer).

 but as long as you don't have IIS and windows running, nothing to fear
 about. both attacks works with IIS only and can be ignored on apache.
they
 are just annoying (messing up the logs) but they cannot compromise the
 system.

 cu

 --
 SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
 Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


--
Howard.
LANNet Computing Associates - Your Linux people http://lannet.com.au
--
When you just want a system that works, you choose Linux;
When you want a system that just works, you choose Microsoft.
--
Flatter government, not fatter government;
Get rid of the Australian states.


smime.p7s
Description: S/MIME cryptographic signature
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html

FW: FW: [SLUG] Possible hacker Attempt

2005-04-06 Thread Phill
Thanks Martin!! Very helpful

Regards,
Phill

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf
Of Visser, Martin
Sent: Thursday, 7 April 2005 9:19 AM
Cc: slug@slug.org.au
Subject: RE: FW: [SLUG] Possible hacker Attempt

Unfortunately a buffer-overflow is not only a Microsoft problem.

In simple terms, it occurs where an attacker is able to exploit a
programming flaw that allows a program to accept more data then it is
really designed for. Most programs that accept input from the network
(or other input device) will prepare a buffer, some memory space, to
accept that input. If the program is written correctly it should
validate the input or use other some mechnanism to ensure the input does
not exceed the size of the allocated buffer. However, in certain program
architectures, data that is accepted which is more than the buffer can
handle could overwrite existing program data. If this excess data is
craftily designed,  the program can be tricked to then execute this
excess data (which is now not just data, but now part of the compromised
programs instructions) and will run with the priveleges of the exploited
program. The excess data is a small chunk of compiled code specifically
designed to run on the target platform - it is usually caused by
inserting a jump in the normal code instructions.

In the Code Red example below the attacker is sending a GET request to a
web server. In a vulnerable IIS web server, the URL specified in the
request is much larger than it expected. This data ends up in the web
servers running program space, and is executed by the target system.
The Code Red worm can then do it's job to continue to seek and replicate
itself.  Code Red of course only can affect unpatched vulnerable IIS
servers.

Of course, there have been plenty of buffer overflows identified in
Linux based applications, Microsoft-based systems are just a bigger (and
presumably more lucrative) target. Most program development projects
actively check their code for the possibility of buffer-overflows -
hopefully they find the holes before potential attackers do. There is
also work being done on various hardware and software architectures that
limit the ability of unauthorised code to execute on a platform.

 For the average user, provided you limit your internet facing profile
using a firewall configured to only let necessary traffic in , and are
vigilant in patching your systems, you are as safe as you can be.



-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
Behalf Of Howard Lowndes
Sent: Thursday, 7 April 2005 7:30 AM
To: Phill
Cc: slug@slug.org.au
Subject: Re: FW: [SLUG] Possible hacker Attempt



Phill wrote:
 I am also curious. How does this attack work? I understand the idea of

 filling up a buffer with junk but then

As Gottfried said, on Linux it doesn't work, but on IIS it causes a
buffer overflow which then allows uncontrolled access for the exploit -
or something like that - I don't pay btoo much attention to Microsoft
type problems.


 Regards,
 Phill


 -Original Message-
 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
Behalf
 Of Gottfried Szing
 Sent: Thursday, 7 April 2005 1:39 AM
 To: slug@slug.org.au
 Subject: Re: [SLUG] Possible hacker Attempt

 hi


GET /default.ida?X...(lots of X's)...X



%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801
%u

9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u%u00=a

 HTTP/1.0

404 300 - -


 isn't that the code red worm? still in the wild?


SEARCH /\x90\x02\xb1\.. (x02\xb1\ repeats hundreds of times)
.\ x02\xb1\x90\...(repeats hundreds of
times)...\x90\x90\x90\x90\x90\x90 414 341 - -


 AFAIR this is an request that uses an exploit of the IIS and webdav
 component (unchecked buffer).

 but as long as you don't have IIS and windows running, nothing to fear
 about. both attacks works with IIS only and can be ignored on apache.
they
 are just annoying (messing up the logs) but they cannot compromise the
 system.

 cu

 --
 SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
 Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


--
Howard.
LANNet Computing Associates - Your Linux people http://lannet.com.au
--
When you just want a system that works, you choose Linux;
When you want a system that just works, you choose Microsoft.
--
Flatter government, not fatter government;
Get rid of the Australian states.
--
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


smime.p7s
Description: S/MIME cryptographic signature
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html

Re: [SLUG] USB HD mounting ?

2005-04-06 Thread James Gray
On Thu, 7 Apr 2005 08:17 am, Voytek wrote:
 quote who=[EMAIL PROTECTED]

  On Wed, Apr 06, 2005 at 11:34:13PM +1000, Voytek wrote:
  I'm trying to mount USB IDE HD
 
  Put the options before the files.  This goes for pretty much
  any unix/linux command:
 
  mount -t vfat /dev/sda1 /mnt/usbhd

 already tried, returns same errors
 whatever 't' option I've tried
 what 't' option for an unformatted HD ?

You can't mount an unformatted file system.  First, make sure the disk is 
partitioned.  Below is my lappy - it has 3 partitions, 2 reiserfs, 1 swap.  
Your USB drive will be different, but this shows you the sort of output a 
partitioned drive has:

(either sudo or su to root then fdisk)
$ sudo fdisk -l /dev/hda

Disk /dev/hda: 10.0 GB, 10056130560 bytes
16 heads, 63 sectors/track, 19485 cylinders
Units = cylinders of 1008 * 512 = 516096 bytes

   Device Boot  Start End  Blocks   Id  System
/dev/hda1   *   1   15604 7864384+  83  Linux
/dev/hda2   15605   16125  262584   82  Linux swap
/dev/hda3   16126   19485 1693440   83  Linux
/dev/hda4   1   1 395+   0  Empty
Partition 4 does not end on cylinder boundary.

If your /dev/sda is NOT partitioned, then partition it first with 
parted/fdisk/gui-based-whatever. man fdisk, man parted etc.

Once you've got it partitioned, format the partition(s) with whatever you 
like.  FAT32 is evil but it will work on anything, reiserfs/ext3 aren't 
particaularly great (performance-wise) over slow links like USB1, but are 
fine on FireWire/IEE1394/iLink and USB2.

Once you've formatted the drive, mount it:
mount -t fstype /dev/sda1 /mnt/usbhd

fstype = vfat/reiserfs/ext2/etc3/xfs etc.

HTH

James
-- 
Captain Penny's Law:
You can fool all of the people some of the time, and some of
the people all of the time, but you Can't Fool Mom.
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


RE: FW: [SLUG] Possible hacker Attempt

2005-04-06 Thread Visser, Martin
BTW you can have finding the known vulnerabilities in your favourite
software from various sites - eg
http://secunia.com/search/?search=apache+buffer+overflow 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
Behalf Of Phill
Sent: Thursday, 7 April 2005 9:32 AM
To: slug@slug.org.au
Subject: FW: FW: [SLUG] Possible hacker Attempt

Thanks Martin!! Very helpful

Regards,
Phill

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
Behalf Of Visser, Martin
Sent: Thursday, 7 April 2005 9:19 AM
Cc: slug@slug.org.au
Subject: RE: FW: [SLUG] Possible hacker Attempt

Unfortunately a buffer-overflow is not only a Microsoft problem.

In simple terms, it occurs where an attacker is able to exploit a
programming flaw that allows a program to accept more data then it is
really designed for. Most programs that accept input from the network
(or other input device) will prepare a buffer, some memory space, to
accept that input. If the program is written correctly it should
validate the input or use other some mechnanism to ensure the input does
not exceed the size of the allocated buffer. However, in certain program
architectures, data that is accepted which is more than the buffer can
handle could overwrite existing program data. If this excess data is
craftily designed,  the program can be tricked to then execute this
excess data (which is now not just data, but now part of the compromised
programs instructions) and will run with the priveleges of the exploited
program. The excess data is a small chunk of compiled code specifically
designed to run on the target platform - it is usually caused by
inserting a jump in the normal code instructions.

In the Code Red example below the attacker is sending a GET request to a
web server. In a vulnerable IIS web server, the URL specified in the
request is much larger than it expected. This data ends up in the web
servers running program space, and is executed by the target system.
The Code Red worm can then do it's job to continue to seek and replicate
itself.  Code Red of course only can affect unpatched vulnerable IIS
servers.

Of course, there have been plenty of buffer overflows identified in
Linux based applications, Microsoft-based systems are just a bigger (and
presumably more lucrative) target. Most program development projects
actively check their code for the possibility of buffer-overflows -
hopefully they find the holes before potential attackers do. There is
also work being done on various hardware and software architectures that
limit the ability of unauthorised code to execute on a platform.

 For the average user, provided you limit your internet facing profile
using a firewall configured to only let necessary traffic in , and are
vigilant in patching your systems, you are as safe as you can be.



-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
Behalf Of Howard Lowndes
Sent: Thursday, 7 April 2005 7:30 AM
To: Phill
Cc: slug@slug.org.au
Subject: Re: FW: [SLUG] Possible hacker Attempt



Phill wrote:
 I am also curious. How does this attack work? I understand the idea of

 filling up a buffer with junk but then

As Gottfried said, on Linux it doesn't work, but on IIS it causes a
buffer overflow which then allows uncontrolled access for the exploit -
or something like that - I don't pay btoo much attention to Microsoft
type problems.


 Regards,
 Phill


 -Original Message-
 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
Behalf
 Of Gottfried Szing
 Sent: Thursday, 7 April 2005 1:39 AM
 To: slug@slug.org.au
 Subject: Re: [SLUG] Possible hacker Attempt

 hi


GET /default.ida?X...(lots of X's)...X



%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801
%u

9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u%u00=a

 HTTP/1.0

404 300 - -


 isn't that the code red worm? still in the wild?


SEARCH /\x90\x02\xb1\.. (x02\xb1\ repeats hundreds of times) 
.\ x02\xb1\x90\...(repeats hundreds of 
times)...\x90\x90\x90\x90\x90\x90 414 341 - -


 AFAIR this is an request that uses an exploit of the IIS and webdav 
 component (unchecked buffer).

 but as long as you don't have IIS and windows running, nothing to fear

 about. both attacks works with IIS only and can be ignored on apache.
they
 are just annoying (messing up the logs) but they cannot compromise the

 system.

 cu

 --
 SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/ 
 Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


--
Howard.
LANNet Computing Associates - Your Linux people http://lannet.com.au
--
When you just want a system that works, you choose Linux; When you want
a system that just works, you choose Microsoft.
--
Flatter government, not fatter government; Get rid of the Australian
states.
--
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: 

[SLUG] Ubuntu launches into command line only

2005-04-06 Thread linley caetan
running Ubuntu warty in i386
after some recent updates  using apt (for alsa related items)
Ubuntu reboots in CLI mode , no graphic login screen.
Launching X from CLI  gives a grey screen with X cursor and nothing 
else. There is no way to proceed except restarting the machine.

--
Linley Caetan
www.lovelsretreat.com
Phone: 95211226
Mobile: 0409 831 404
--
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: FW: [SLUG] Possible hacker Attempt

2005-04-06 Thread Howard Lowndes
My bad.  Of course Linux apps can be just as badly written as M$ apps 
and can have buffer overflows.

What I should have said is that this attempt at a buffer over flow does 
not affect Apache.

Phill wrote:
OK. I did a bit of reading on the subject. Linux can be vulnerable to
buffer overrun attacks can't it? If not, why not?
Regards,
Phill
-Original Message-
From: Howard Lowndes [mailto:[EMAIL PROTECTED]
Sent: Thursday, 7 April 2005 7:30 AM
To: Phill
Cc: slug@slug.org.au
Subject: Re: FW: [SLUG] Possible hacker Attempt

Phill wrote:
I am also curious. How does this attack work? I understand the idea of
filling up a buffer with junk but then

As Gottfried said, on Linux it doesn't work, but on IIS it causes a
buffer overflow which then allows uncontrolled access for the exploit -
or something like that - I don't pay btoo much attention to Microsoft
type problems.

Regards,
Phill
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
Behalf
Of Gottfried Szing
Sent: Thursday, 7 April 2005 1:39 AM
To: slug@slug.org.au
Subject: Re: [SLUG] Possible hacker Attempt
hi

GET /default.ida?X...(lots of X's)...X

%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u
9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u%u00=a
HTTP/1.0

404 300 - -

isn't that the code red worm? still in the wild?

SEARCH /\x90\x02\xb1\.. (x02\xb1\ repeats hundreds of times)
.\ x02\xb1\x90\...(repeats hundreds of
times)...\x90\x90\x90\x90\x90\x90 414 341 - -

AFAIR this is an request that uses an exploit of the IIS and webdav
component (unchecked buffer).
but as long as you don't have IIS and windows running, nothing to fear
about. both attacks works with IIS only and can be ignored on apache.
they
are just annoying (messing up the logs) but they cannot compromise the
system.
cu
--
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html

--
Howard.
LANNet Computing Associates - Your Linux people http://lannet.com.au
--
When you just want a system that works, you choose Linux;
When you want a system that just works, you choose Microsoft.
--
Flatter government, not fatter government;
Get rid of the Australian states.
--
Howard.
LANNet Computing Associates - Your Linux people http://lannet.com.au
--
When you just want a system that works, you choose Linux;
When you want a system that just works, you choose Microsoft.
--
Flatter government, not fatter government;
Get rid of the Australian states.
begin:vcard
fn:Howard Lowndes
n:Lowndes;Howard
org:LANNet Computing Associates
adr:;;PO Box 1174;Lavington;NSW;2641;Australia
email;internet:howard [AT] lowndes [DOT] name
tel;work:02 6040 0222
tel;fax:02 6040 0222
tel;cell:0419 464 430
note:I am heartily sick and tired of telemarketers, therefore I do not answer phone calls which do not present Caller Line Identification, they get flicked to voicemail.  I apologise if this inconveniences you, and I respect your right to not identify yourself, but I also ask that you respect my right to not answer your call if you choose not to identify yourself.  Try dialing 1832 (#32# from mobiles) before the number, to present Caller Line Identification.
x-mozilla-html:FALSE
url:http://www.lannet.com.au
version:2.1
end:vcard

-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html

Re: [SLUG] Virtual hosting with VMWare

2005-04-06 Thread Michael Fox
On Apr 6, 2005 11:29 AM, Rowling, Jill [EMAIL PROTECTED] wrote:
 Thanks for that! I see VMWare company is now part of EMC. Since I suspect we
 are going to be using an EMC SAN system, I think that will be OK.
 VMWare ESX seems to only support up to RHEL3 as a guest OS. By that I mean
 officially support, in practice all sorts of things would probably work.

Yeah EMC owns VMWare (it surprised me too). I never really took much
notice. Only realised after I started with EMC that we had purchased
them sometime before I started.

In any case, our Sydney Lab uses several Dell servers running VMWare
ESX to run several virtual machines for lab testing and stuff. Works
great. I've been a big fan of VMWare from the earlier days, since it
just worked so well.
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


[SLUG] Re: USB HD mounting ?

2005-04-06 Thread jam
Hi

 quote who=[EMAIL PROTECTED]
  On Wed, Apr 06, 2005 at 11:34:13PM +1000, Voytek wrote:
  I'm trying to mount USB IDE HD
 
  Put the options before the files.  This goes for pretty much
  any unix/linux command:
 
  mount -t vfat /dev/sda1 /mnt/usbhd
 
 
 already tried, returns same errors
 whatever 't' option I've tried
 what 't' option for an unformatted HD ?

You don't give any meat re the problem:

1) Did you modprobe usb-storage
2) Are you using subfs which stops you mounting like this, instead gives
   something like /media/usb/longsillyname automatically

In general if mount asks for the type, you've already lost, it's not
going to work.

James
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


[SLUG] Re: Python Interest Group

2005-04-06 Thread Mary Gardiner
In article [EMAIL PROTECTED], Richard Hayes wrote:
 Dear list,
 
 Is pig.slug doing anything?

No. It hasn't met since early 2003 afaik. I updated http://pig.slug.org.au/ to
that effect a few months ago, and now I've put it in red, since people missed
it :)

 If not, is there any other python group having meetings?

Alan Green is organising Sydney Python Meetups through meetup.com:
http://python.meetup.com/96/events/ . If you're not willing to sign up through
the meetup.com site, the python-au list is probably the best way to hear about
them: http://starship.python.net/mailman/listinfo/python-au

If anyone wants to take over the organisation of the PIG let me know, although
the best way to do it would probably be just to hold meetings with the Meetup
people.

-Mary

-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


[SLUG] The NT1 PlusII modem

2005-04-06 Thread Dr Tony Young
Dear Sydney Linux Users Group,

Attached are two files.  One is an OO file detailing how to get the NT1 PlusII 
modem running under Mandrake 10.1 and SuSE 9, 9.1 and 9.2.  There is also a 
second file called kppp which is critical to the setup for SuSE 9.1 and 9.2

Have a look at itI assure you, this all works because I have done it, and 
I use the NT1 routinely as my internet connection.  SuSE is incredible with 
the problems...but I like SuSE as a distro..hence my determination to make it 
work.

Hope it is of use.  I'd appreciate a reply indicating you got this email and 
whether you can use it.

Regards

Tony Young
-- 

Dr Tony Young
100 Langton Road
Blackbutt  Qld  4306
Australia
ph (07) 4163 0395
fax as above

To mess up a Linux PC,
you need to work at it;
To mess up your Windows PC,
you just need to work on it.
Scott Granneman







plugin passwordfd.so



Kppp.sxw
Description: OpenOffice Writer document
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html

Re: FW: [SLUG] Possible hacker Attempt

2005-04-06 Thread telford
On Thu, Apr 07, 2005 at 09:48:48AM +1000, Howard Lowndes wrote:
 My bad.  Of course Linux apps can be just as badly written as M$ apps 
 and can have buffer overflows.
 
 What I should have said is that this attempt at a buffer over flow does 
 not affect Apache.


Whilst Linux apps can be badly written, there are a few reasons why
Microsoft apps tend to be worse. Consider that most of the people who
program for Linux have also tried working with Microsoft products and
they chose Linux because they wanted to do things the right way. This
has a filtering effect that pulls the strongest programmers away from
MS and toward either Linux or one of the *BSD variations. People who
care about money first and producing a good product second will tend
to go to the Microsoft camp, people who think that a good product
should be first priority and then look at money as a secondary
consideration usually gravitate in a free-software direction. Its
a difference of emphasis rather than a completely different approach
but it does make a difference.

Then there are the Microsoft customers who have not (until recently)
been willing to get nasty about software quality. With market forces
at work, if there is no demand for high security, high quality software
there will also be no supply. When Microsoft had a total monopoly
they just didn't have to care one way or the other... now that their
monopoly is weakening and some customers are getting aggressive they
are forced to care so they are making more of an effort.

As a practical example to all those C programmers out there, this is
the common idiom (since early KR days):

int myfunc( char *stuff )
{
char buf[ 100 ];

sprintf( buf, My stuff is %s, stuff );
/* do something with buf here */
}

Of course this is exactly what will sting you if you can't be sure
what stuff might contain (in technical terms we say that stuff
is tainted so we can't trust it). The trick is that the C compiler
puts the buf variable on the stack and also puts the function
return address on the SAME stack AFTER buf when it calls sprintf().
Using the same stack for variables and code pointers is a good
optimisation for speed but it is bad for security because when
the stuff is too big it wipes over the return address. With some
care, it can replace the return address with a pointer into itself
which sets to program running onto a completely new chunk of code.

Now redhat (and others) have a few tricks to make that more difficult,
the first is to limit the executable sections of memory and make
it illegal for executable code to exist inside stack buffers. It is
interesting that Microsoft were talking about how important this
feature is and how they would have it real-soon-now at the same time
that Redhat were shipping with it enabled. The second is using a
randomised offset for various memory chunks in the program to make
it much more difficult to figure out what return address to load
into stuff to make it do what you want -- then the hacked program
merely crashes rather than opening a back door. Redhat also ships
with that feature.

The easiest source-code fix is to use the snprintf() function so
that the buffer size is known to the formatter like so:

int myfunc( char *stuff )
{
char buf[ 100 ];

snprintf( buf, 100, My stuff is %s, stuff );
/* do something with buf here */
}

But the snprintf() call is not POSIX, it is from BSD (and now adopted
by Linux) and last I looked Microsoft C did NOT provide that function.
Of course there are lots of other ways to protect yourself but the
Microsoft programmers are forced to do it the hard way.

Worse... when porting code from Linux and BSD onto Microsoft, the people
doing the port find there is no snprintf() so they knock up a quick
compatibility library that just ignores the buffer length and calls
sprintf() resulting in a nasty vulnerability but only in the Microsoft
version. Note that early Linux implementations (libc 4) had the same
hasty hack but it got fixed and I doubt that there are too many of
those old Linux boxes running on the Internet these days.


So yes, anyone can write bad code but in practical terms Microsoft
still has a bit of catching up to do.


- Tel  ( http://bespoke.homlinux.net/ )
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: FW: [SLUG] Possible hacker Attempt

2005-04-06 Thread Howard Lowndes
Tks Tel, that is a brilliant explanation for someone like me who doesn't 
know C from Z :)

[EMAIL PROTECTED] wrote:
On Thu, Apr 07, 2005 at 09:48:48AM +1000, Howard Lowndes wrote:
My bad.  Of course Linux apps can be just as badly written as M$ apps 
and can have buffer overflows.

What I should have said is that this attempt at a buffer over flow does 
not affect Apache.

Whilst Linux apps can be badly written, there are a few reasons why
Microsoft apps tend to be worse. Consider that most of the people who
program for Linux have also tried working with Microsoft products and
they chose Linux because they wanted to do things the right way. This
has a filtering effect that pulls the strongest programmers away from
MS and toward either Linux or one of the *BSD variations. People who
care about money first and producing a good product second will tend
to go to the Microsoft camp, people who think that a good product
should be first priority and then look at money as a secondary
consideration usually gravitate in a free-software direction. Its
a difference of emphasis rather than a completely different approach
but it does make a difference.
Then there are the Microsoft customers who have not (until recently)
been willing to get nasty about software quality. With market forces
at work, if there is no demand for high security, high quality software
there will also be no supply. When Microsoft had a total monopoly
they just didn't have to care one way or the other... now that their
monopoly is weakening and some customers are getting aggressive they
are forced to care so they are making more of an effort.
As a practical example to all those C programmers out there, this is
the common idiom (since early KR days):
int myfunc( char *stuff )
{
char buf[ 100 ];

sprintf( buf, My stuff is %s, stuff );
/* do something with buf here */
}
Of course this is exactly what will sting you if you can't be sure
what stuff might contain (in technical terms we say that stuff
is tainted so we can't trust it). The trick is that the C compiler
puts the buf variable on the stack and also puts the function
return address on the SAME stack AFTER buf when it calls sprintf().
Using the same stack for variables and code pointers is a good
optimisation for speed but it is bad for security because when
the stuff is too big it wipes over the return address. With some
care, it can replace the return address with a pointer into itself
which sets to program running onto a completely new chunk of code.
Now redhat (and others) have a few tricks to make that more difficult,
the first is to limit the executable sections of memory and make
it illegal for executable code to exist inside stack buffers. It is
interesting that Microsoft were talking about how important this
feature is and how they would have it real-soon-now at the same time
that Redhat were shipping with it enabled. The second is using a
randomised offset for various memory chunks in the program to make
it much more difficult to figure out what return address to load
into stuff to make it do what you want -- then the hacked program
merely crashes rather than opening a back door. Redhat also ships
with that feature.
The easiest source-code fix is to use the snprintf() function so
that the buffer size is known to the formatter like so:
int myfunc( char *stuff )
{
char buf[ 100 ];

snprintf( buf, 100, My stuff is %s, stuff );
/* do something with buf here */
}
But the snprintf() call is not POSIX, it is from BSD (and now adopted
by Linux) and last I looked Microsoft C did NOT provide that function.
Of course there are lots of other ways to protect yourself but the
Microsoft programmers are forced to do it the hard way.
Worse... when porting code from Linux and BSD onto Microsoft, the people
doing the port find there is no snprintf() so they knock up a quick
compatibility library that just ignores the buffer length and calls
sprintf() resulting in a nasty vulnerability but only in the Microsoft
version. Note that early Linux implementations (libc 4) had the same
hasty hack but it got fixed and I doubt that there are too many of
those old Linux boxes running on the Internet these days.
So yes, anyone can write bad code but in practical terms Microsoft
still has a bit of catching up to do.
	- Tel  ( http://bespoke.homlinux.net/ )
--
Howard.
LANNet Computing Associates - Your Linux people http://lannet.com.au
--
When you just want a system that works, you choose Linux;
When you want a system that just works, you choose Microsoft.
--
Flatter government, not fatter government;
Get rid of the Australian states.
begin:vcard
fn:Howard Lowndes
n:Lowndes;Howard
org:LANNet Computing Associates
adr:;;PO Box 1174;Lavington;NSW;2641;Australia
email;internet:howard [AT] lowndes [DOT] name
tel;work:02 6040 0222
tel;fax:02 6040 0222
tel;cell:0419 464 430
note:I am heartily sick and tired of telemarketers, therefore I do not answer phone 

Re: [SLUG] USB HD mounting ?

2005-04-06 Thread Voytek
James,

thanks. Initially, when I tried, it was partitioned and formatted;
that's when I send the original mssg

when I couldn't mount it, and, as I wasn't sure what's there, I connected
it on another system and 'unpartitioned' existing stuff

anyhow, thanks for the help:

so far so good:

Disk /dev/sda: 64 heads, 32 sectors, 38166 cylinders
Units = cylinders of 2048 * 512 bytes

   Device BootStart   EndBlocks   Id  System
/dev/sda1 1 38166  390819685  Extended


 Once you've got it partitioned, format the partition(s) with whatever you
 like.  FAT32 is evil but it will work on anything, reiserfs/ext3 aren't

   You can fool all of the people some of the time, and some of
 the people all of the time, but you Can't Fool Mom.


to get the evil fat32, what do I use:
# mkfs.vfat /dev/sda1
mkfs.vfat 2.8 (28 Feb 2001)
mkfs.vfat: Attempting to create a too large file system
# mkfs.msdos /dev/sda1
mkfs.msdos 2.8 (28 Feb 2001)
mkfs.msdos: Attempting to create a too large file system




-- 
Voytek
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


[SLUG] RH 'system-switch-mail' ?

2005-04-06 Thread Voytek
I'm trying to switch from Sendmail to Postfix on RH;

in the X desktop (that I do NOT have) there is an icon that toggles
bewteen the two;

according to docs I've looked up, I'm supposed to run 'system-switch-mail'
I don;t seem to have such, and
'yum install system-switch-mail'
says: 'Cannot find a package matching system-switch-mail'

neither can I find it on the CDs

any thoughts how to find it, or, what it's called ..?


-- 
Voytek
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


solved: [SLUG] RH 'system-switch-mail' ?

2005-04-06 Thread Voytek
OK, found it, it was called:
'redhat-switchmail'

sorry, should kept looking a little longer

quote who=Voytek

 'yum install system-switch-mail'
 says: 'Cannot find a package matching system-switch-mail'

 neither can I find it on the CDs

 any thoughts how to find it, or, what it's called ..?


-- 
Voytek
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


[SLUG] The NT1 PlusII modem/addendum

2005-04-06 Thread Dr Tony Young
Dear Sydney Linux Users Group,

Just a couple of items I nearly forgot.  This method of using the NT1 PlusII 
modem will ONLY run one line.  Apparently in Windows, the software allows you 
to duplex the two lines the NT1 establishes and therefore double your data 
transfer speeds to about 128K or possibly a little more according to my 
readings.  However, I have never bothered trying to duplex the NT1 because we 
prefer the convenience of always having a data line and a telephone line at 
the same time.

Also, if the scheme I have outlined works on Mandrake and SuSE, I am sure it 
will work on RedHat or any other rpm distribution.  I have absolutely no idea 
as to what a Debian distribution would do, but if Kppp is there in a Debian 
distribution (which it almost certainly is) then a bit of moving and shaking 
should get a Debian distribution running.  \

You can add these comments to the previous email.

Regards

Tony Young
-- 

Dr Tony Young
100 Langton Road
Blackbutt  Qld  4306
Australia
ph (07) 4163 0395
fax as above

To mess up a Linux PC,
you need to work at it;
To mess up your Windows PC,
you just need to work on it.
Scott Granneman










-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [SLUG] UNSW Compsoc Installfest

2005-04-06 Thread Phoebe Goh
Sadly no.  I'll try to organise something though, since you guys ARE
volunteering :)

Phoebe

On Apr 6, 2005 10:07 PM, Simon Brown [EMAIL PROTECTED] wrote:
 On 6 Apr 2005, at 21:28, Phoebe Goh wrote:
  In the past, SLUG folks have come down to lend a hand (thanks!) so I'm
  hoping some of you might be able to volunteer your Saturday for a Good
  Cause.
 
 Will compsoc be providing the traditional pizza for the volunteers? :P
 
 -s
 --
 Simon Brown [EMAIL PROTECTED]
 
 


-- 
Nobody listens to techno...
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [SLUG] The NT1 PlusII modem/addendum

2005-04-06 Thread John Clarke
On Thu, Apr 07, 2005 at 01:31:47 +1000, Dr Tony Young wrote:

 Just a couple of items I nearly forgot.  This method of using the NT1 PlusII 
 modem will ONLY run one line.  Apparently in Windows, the software allows you 
 to duplex the two lines the NT1 establishes and therefore double your data 

This is done in the NT1+ itself, and is enabled by an AT command.  I
don't have the docs handy, but it's somewhere in this dial command:
AT!Z=9!T0=0!T1=0!T2=1!T4=1Dxxx.

I set this one up on a RH7.3 system a couple of years ago and it works
perfectly, using pppd just like any other modem.  The difference is that
you use e.g. /dev/input/ttyACM0 instead of /dec/ttyS0.  You also need
the appropriate usb modules listed in /etc/modules.conf.

 However, I have never bothered trying to duplex the NT1 because we
 prefer the convenience of always having a data line and a telephone line
 at the same time.

You always have both available.  The NT1+ automatically switches
between one and two lines as necessary.  It runs at 128k until a call
comes in, or you pick up your handset to make a call, then it drops back
to 64k until the call is over.


Cheers,

John
-- 
Hm, imagine the demoralising effect of being hit hard in the face by a
live, puking mouse, then getting sprayed with a mist of mouse vomit.
-- Lionel Lauer
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [SLUG] UNSW Compsoc Installfest

2005-04-06 Thread Peter Hardy
Perhaps SLUG would like to provide refreshments?

On Thu, 2005-04-07 at 14:15, Phoebe Goh wrote:
 Sadly no.  I'll try to organise something though, since you guys ARE
 volunteering :)
 
 Phoebe
 
 On Apr 6, 2005 10:07 PM, Simon Brown [EMAIL PROTECTED] wrote:
  On 6 Apr 2005, at 21:28, Phoebe Goh wrote:
   In the past, SLUG folks have come down to lend a hand (thanks!) so I'm
   hoping some of you might be able to volunteer your Saturday for a Good
   Cause.
  
  Will compsoc be providing the traditional pizza for the volunteers? :P
  
  -s
  --
  Simon Brown [EMAIL PROTECTED]

-- 
Pete

-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [SLUG] RHEL 3 ? hardware req ?

2005-04-06 Thread mlh
On Thu, Apr 07, 2005 at 09:41:40AM +1000, Mike MacCana wrote:
 In that case, I'd go with RHEL 4, for no other reason than it'll be 

Other things being equal, I'd also go RHEL4.   A very important consideration
is that it will have selinux which goes a good way towards stopping or
minimising the damage caused by application software security bugs.

Matt
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


[SLUG] Date of installation of Fedora update

2005-04-06 Thread Leslie Katz
I'm using Fedora Core 3. Using yum, I've recently updated all packages that 
I installed from my installation cds. That's been a process that's taken 
some days, because the computer has only dial-up access. Yesterday, I 
downloaded and installed the last of the updates. Shortly thereafter, I 
re-booted and was told during that process that I had removed my soundcard. 
Well, I hadn't. I suspect that one of the last few updates I installed 
caused the problem.

Is there a way I can see in chronological order all the updates I've 
downloaded and installed, so that I can get a better idea of which update 
may have caused my problem?

--
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: FW: [SLUG] Possible hacker Attempt

2005-04-06 Thread Grant Parnell - slug
On Thu, 7 Apr 2005, Phill wrote:

 I am also curious. How does this attack work? I understand the idea of
 filling up a buffer with junk but then

Basically a snapshot of a bit of memory might look like this after 
processing the URL http://localhost/cgi-bin/?HELLO-WORLD

byte:   content:
:   H E L L O - W O R L D nul nul nul nul nul
0016:   program code

If the bit after the '?' character in the GET URL is inserted at byte 00 
by apache for which it has only allocated 16 bytes then by adding more 
bytes you overwrite some code which at some point probably gets run. Key 
difference, under Linux it's only going to run as the user the original 
program was running as (eg www or apache). 

eg 
http://localhost/cgi-bin/?code_bytesnoopnoopnoopnoop
noopjump_to_code
It sometimes doesen't matter precisely where the buffer finishes, there's 
a reasonable chance that one of the noop bits actually get run (no 
operation, skip to next byte for instruction) and eventually the 
jump_to_code which goes back to the part of the buffer where the payload 
of the exploit is.

These sort of buffer overflow exploits are not only very CPU specific but
often operating system specific as it's making great assumptions about
things like valid CPU op-codes and library calls.

These bugs are often introduced by the use of the C function fgets() and
similar which receives a sting from an input stream and puts it into a 
buffer without regard to length of the buffer. It's so frequent that gcc 
warns you about it's use now. Typically you specify a maximum number of 
characters to accept which presumably is less than or equal to the size of 
the buffer you allocated.

-- 
---GRiP--- 
Grant Parnell - SLUG President
EverythingLinux services - the consultant's backup  tech support.
Web: http://www.elx.com.au/support.php
We're also busybits.com.au and linuxhelp.com.au and everythinglinux.com.au.
Phone 02 8756 3522 to book service or discuss your needs 
or email us at paidsupport at elx.com.au

ELX or its employees participate in the following:-
OSIA (Open Source Industry Australia) - http://www.osia.net.au
AUUG (Australian Unix Users Group) - http://www.auug.org.au
SLUG (Sydney Linux Users Group) - http://www.slug.org.au
LA (Linux Australia) - http://www.linux.org.au

-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


[SLUG] excrypting fs

2005-04-06 Thread Kevin Saenz
Hi all,

I would like to encrypt /home and my shared directories on my boxes.
Would I have to reformat them with an encrypt option? What is the over
head with encrypted FS? Is it advisable to share encrypted fs using
samba or would there be too much of an over head? Do I have to do a
lot of house keeping on the file systems?

Thanks

Kevin
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [SLUG] excrypting fs

2005-04-06 Thread Howard Lowndes

Kevin Saenz wrote:
Hi all,
I would like to encrypt /home and my shared directories on my boxes.
Would I have to reformat them with an encrypt option? What is the over
head with encrypted FS? Is it advisable to share encrypted fs using
samba or would there be too much of an over head? Do I have to do a
lot of house keeping on the file systems?
Probably a stronger front door if the boys in blue come knocking with 
heavy hammers because they suspect that you have something to hide :)

Thanks
Kevin
--
Howard.
LANNet Computing Associates - Your Linux people http://lannet.com.au
--
When you just want a system that works, you choose Linux;
When you want a system that just works, you choose Microsoft.
--
Flatter government, not fatter government;
Get rid of the Australian states.
begin:vcard
fn:Howard Lowndes
n:Lowndes;Howard
org:LANNet Computing Associates
adr:;;PO Box 1174;Lavington;NSW;2641;Australia
email;internet:howard [AT] lowndes [DOT] name
tel;work:02 6040 0222
tel;fax:02 6040 0222
tel;cell:0419 464 430
note:I am heartily sick and tired of telemarketers, therefore I do not answer phone calls which do not present Caller Line Identification, they get flicked to voicemail.  I apologise if this inconveniences you, and I respect your right to not identify yourself, but I also ask that you respect my right to not answer your call if you choose not to identify yourself.  Try dialing 1832 (#32# from mobiles) before the number, to present Caller Line Identification.
x-mozilla-html:FALSE
url:http://www.lannet.com.au
version:2.1
end:vcard

-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html

Re: [SLUG] Date of installation of Fedora update

2005-04-06 Thread Dave Airlie

 Is there a way I can see in chronological order all the updates I've
 downloaded and installed, so that I can get a better idea of which update may
 have caused my problem?

at a guess the kernel ... second guess alsa-*... I'd try booting the old
kernel and ssee if it works.. you do still have the old kernel?? :-)

Dave.



-- 
David Airlie, Software Engineer
http://www.skynet.ie/~airlied / airlied at skynet.ie
Linux kernel - DRI, VAX / pam_smb / ILUG

-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


[SLUG] Groupware

2005-04-06 Thread Howard Lowndes
I'm looking for a web based multi-user calendar function that is web 
based, PHP and preferably Postgresql (but will accept MySQL).

What are your recommendations?
--
Howard.
LANNet Computing Associates - Your Linux people http://lannet.com.au
--
When you just want a system that works, you choose Linux;
When you want a system that just works, you choose Microsoft.
--
Flatter government, not fatter government;
Get rid of the Australian states.
begin:vcard
fn:Howard Lowndes
n:Lowndes;Howard
org:LANNet Computing Associates
adr:;;PO Box 1174;Lavington;NSW;2641;Australia
email;internet:howard [AT] lowndes [DOT] name
tel;work:02 6040 0222
tel;fax:02 6040 0222
tel;cell:0419 464 430
note:I am heartily sick and tired of telemarketers, therefore I do not answer phone calls which do not present Caller Line Identification, they get flicked to voicemail.  I apologise if this inconveniences you, and I respect your right to not identify yourself, but I also ask that you respect my right to not answer your call if you choose not to identify yourself.  Try dialing 1832 (#32# from mobiles) before the number, to present Caller Line Identification.
x-mozilla-html:FALSE
url:http://www.lannet.com.au
version:2.1
end:vcard

-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html

Re: [SLUG] excrypting fs

2005-04-06 Thread Michael Fox
On Apr 7, 2005 3:36 PM, Howard Lowndes [EMAIL PROTECTED] wrote:
 Probably a stronger front door if the boys in blue come knocking with
 heavy hammers because they suspect that you have something to hide :)

Hahaha..

And if anyone comes knocking it will probably be the AFP considering
Kevin lives in Canberra ;)

*jokes aside*

I am curious about the question thought. Sounds heaps interesting. OSX
offers such a service on your home directory and what not. I've never
enabled it at this stage, but I guess its similar to the
implementation on linux.
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [SLUG] Optus Cable

2005-04-06 Thread Ken Wilson
Paul Dwerryhouse wrote:

I apologise for this  long reply but I warn anyone considering Optus 
Broadband to check that they are actually getting the service at the 
advertised price with no non-essential add-ons that are a disguised
cost.
   

Ah well, I've never had a problem with them, other than that nasty thing
they did by capping their unlimited plans. Still with them after three
and a half years...
Cheers,
Paul
 

When I started with optus the phone line was free but after a while it 
developed a $25 a month charge, and soon after that a flatmate had a use 
for it so it has stayed.
Ken
--
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


[SLUG] argh! printer not workiong on ubuntu :(

2005-04-06 Thread Taryn East
ok, I've had enough - I really want my printer working and I just can't
seem ot get it to. :(

I run ubuntu (hoary) and it seems to detect it's there just fine, but it
keeps telling me parallel port busy will try again - of course it's a
USB printer and I keep changing it to either use detected printer or
even USB port #1 (after checking that it actually is a) plugged into
said port and b) turned on).

it still won't actually print me up a test page

this is really annoying as it was working fine when I had it on Warty.
:(


is anyone able to help me figure out what's going wrong here? :(

Thanks in advance,
Taryn


-- 
This .sig temporarily out-of-order.
We apologise for any inconvenience
- The Management
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html