Re: [gentoo-user] HOWTO: Freezing/unfreezing (groups of) processes

2021-02-05 Thread Walter Dnes
On Fri, Feb 05, 2021 at 04:42:26PM -0600, Matt Connell (Gmail) wrote
> On Fri, 2021-02-05 at 13:24 -0500, Walter Dnes wrote:
> >   I'll have to take that back.  It happened again, and I was not
> > fiddling with pstop/pcont.  The common element seems to be that I was
> > compiling Pale Moon 29.0 each time it crashed.  A machine with 8 gigs of
> > ram, and 598 of 905 gigs free diskspace should not have resource issues.
> 
> I contest this claim.  8GB is pretty scant for something as large and
> complex as a modern browser.  Have you built this before on the same
> machine?

  See http://www.palemoon.org/releasenotes.shtml  My previous successful
build was 28.17.0 which was released December 18th.  Note: Chrome and
Firefox seem to bump the major release number "just because".  The Pale
Moon devs use all 3 digits.  E.g. an isolated bugfix has just been
released as 29.0.1.  When the major release number on Pale Moon is
incremented, there are big changes "under the hood", so increased
requirements are a possibility going from version 28.17 to 29.0.

There's also ongoing work on "de-unifying the sources"
https://forum.palemoon.org/viewtopic.php?f=62=24296  The thread starts
off with the question "Is it expected that Pale Moon compilation time
has almost doubled after de-unifying the sources?".  To which the head
honcho replies...

> That was only de-unifying /dom -- more will follow.
> 
> And yes, if your aren't on a particularly powerful machine with
> a fast drive, it can impact your compilation time significantly.

  I have a relatively new 16-gig machine (October) that I'll try it on.

-- 
Walter Dnes 
I don't run "desktop environments"; I run useful applications



Re: [gentoo-user] HOWTO: Freezing/unfreezing (groups of) processes

2021-02-05 Thread David Haller
Hello,

On Fri, 05 Feb 2021, Walter Dnes wrote:
>On Fri, Feb 05, 2021 at 06:55:12AM -0500, Rich Freeman wrote
>> On Fri, Feb 5, 2021 at 2:45 AM Walter Dnes  wrote:
>> >   So far, so good, but running "ps -ef | grep whatever" and then
>> > typing the kill -SIGSTOP/SIGCONT command on the correct pid is grunt
>> > work, subject to typos.

It's much easier to use the '-o' option of ps, i.e.:

$ ps -eo pid,cmd

That gives you a much easier format to work with. There's a lot more
fields to use, e.g. tname or tty, args or cmd, comm, and many more see
'man ps' under "STANDARD FORMAT SPECIFIERS".

>  My reading of the "killall" man page is that it works on command
>names.  For my script, "pstop palemoon" stops all instances of Pale
>Moon.  But my script greps the entire line, so "pstop slashdot" will
>stop the process...
>
>/home/waltdnes/pm/palemoon/palemoon -new-instance -p slasdot
>
>  Does "killall" have that ability to stop a process based on any
>parameters in the command line?

The following script does:

 ~/bin/pstop && ln -s pstop ~/bin/pcont 
#!/usr/bin/gawk -f
BEGINFILE { if( FILENAME != "" ) { exit(0); } }
BEGIN {
### determine if were run as pstop or pcont
cmdlinefile = "/proc/" PROCINFO["pid"] "/cmdline" ;
getline cmdline < cmdlinefile;
n = split(cmdline, argv, "\0");
IAM=argv[3];
if( IAM ~ /pstop$/) { SIG="STOP"; } else { SIG="CONT"; };

### now to work ...
printf("%s-ing pids: ", SIG); 
bcmd = sprintf("kill -%s ", SIG);
pscmd = "ps -eo pid,cmd";

# IGNORECASE=1 ### uncomment for case insensitive matching
while ( pscmd | getline ) {
if( $1 != PROCINFO["pid"] ) { ### ignore ourself
p = $1; $1 = ""; ### save pid to p; prune pid from $0
for(i=1; i < (ARGC); i++) {
if( $0 ~ ARGV[i] ) {
printf("%s ", p);
cmd = bcmd p;
system(cmd);
}
}
}
}
}
END { printf("\n"); }


Arguments can be any number of (quoted where neccessary) regular
expressions described under 'Regular Expressions' in 'man gawk'
(basically Extended POSIX REs as in egrep, see 'man 7 regex').

Example use:

$ pstop palemoon firefox slashdot 'chrom(e|ium)'

(and the same for pcont)

HTH,
-dnh

-- 
Love your enemies: they'll go crazy trying to figure out what you're up
to. -- BSD fortune file



Re: [gentoo-user] HOWTO: Freezing/unfreezing (groups of) processes

2021-02-05 Thread Matt Connell (Gmail)
On Fri, 2021-02-05 at 13:24 -0500, Walter Dnes wrote:
>   I'll have to take that back.  It happened again, and I was not
> fiddling with pstop/pcont.  The common element seems to be that I was
> compiling Pale Moon 29.0 each time it crashed.  A machine with 8 gigs of
> ram, and 598 of 905 gigs free diskspace should not have resource issues.

I contest this claim.  8GB is pretty scant for something as large and
complex as a modern browser.  Have you built this before on the same
machine?




Re: [gentoo-user] HOWTO: Freezing/unfreezing (groups of) processes

2021-02-05 Thread Walter Dnes
On Fri, Feb 05, 2021 at 02:00:05PM -0500, Walter Dnes wrote
> 
>   In the course of experimentation, I've made versions that killed
> critical processes, requiring a reboot. {ALT}{SYSRQ} to the rescue .
> I'll stick with stuff that works.

  I'll have to take that back.  It happened again, and I was not
fiddling with pstop/pcont.  The common element seems to be that I was
compiling Pale Moon 29.0 each time it crashed.  A machine with 8 gigs of
ram, and 598 of 905 gigs free diskspace should not have resource issues.

-- 
Walter Dnes 
I don't run "desktop environments"; I run useful applications



Re: [gentoo-user] spam - different IP's

2021-02-05 Thread Grant Taylor

On 2/5/21 6:57 AM, William Kenworthy wrote:

Use fail2ban to target active abusers using your logs. (recommended)


I've had extremely good luck using Fail2Ban in a distributed 
configuration* such that when one of my servers bans an IP, my other 
servers also (almost) immediately ban the same IP.


*I'm using Fail2Ban's (null / reject) "route" option.  I have BGP 
sessions between my servers synchronizing the banned routes.


Leverage the cloud with something like: 
http://iplists.firehol.org/?ipset=firehol_level1 (loaded to shorewall 
with ipset:hash) to preemptively ban via blacklists - recommended. 
There are many good blacklists out there - this one is a meta-list 
and has fast and responsive updates.


That's an option.

I personally have some trouble swallowing the pill that is other 
people's ban lists.  --  It's one thing with adding to a spam score. 
It's another when IPs are out and out blocked.


Aside:  Make use of Fail2Ban's ignore feature to white list (or ignore 
problems from) known good IPs.


Snort (in IDS mode triggering a fail2ban rule) is a bit heavier 
resource-wise but quite useful.  Snort in IPS mode is better, but it 
can impact throughput. (if you are commercial, consider a licence to 
get the latest rules as soon as they are created/needed.)


Another option in the same vein is to use the IPTables variants of the 
Snort rules.




--
Grant. . . .
unix || die



Re: [gentoo-user] Re: Gentoo as NAS

2021-02-05 Thread Matt Connell (Gmail)
On Fri, 2021-02-05 at 09:36 +, Michael wrote:
> Wouldn't a binary distro, potentially purpose built as a NAS and/or HTPC 
> offering, make more sense?  I don't see what advantage the maintenance burden 
> of a Gentoo system has to offer in this use case, other than repurposing with 
> little effort an existing Gentoo installation.  :-/

Running Gentoo on my home server makes the maintenance burden *lower*
for me because I can use all the same tools I'm used to.  Besides,
portage is the pinnacle of package managers IMHO.  Using a GNU+Linux
system without USE flags and such feels like I'm stuck in a hallway,
with someone else's idea of how software should be configured and
deployed.

tl;dr I like Gentoo




Re: [gentoo-user] HOWTO: Freezing/unfreezing (groups of) processes

2021-02-05 Thread Neil Bothwick
On Fri, 5 Feb 2021 14:07:39 -0500, Walter Dnes wrote:

> > man killall  
> 
>   My reading of the "killall" man page is that it works on command
> names.  For my script, "pstop palemoon" stops all instances of Pale
> Moon.  But my script greps the entire line, so "pstop slashdot" will
> stop the process...
> 
> /home/waltdnes/pm/palemoon/palemoon -new-instance -p slasdot
> 
>   Does "killall" have that ability to stop a process based on any
> parameters in the command line?

No, but you could look at using pgrep to avoid some of the awkery.


-- 
Neil Bothwick

Velilind's Laws of Experimentation:
1. If reproducibility may be a problem, conduct the test only once.
2. If a straight line fit is required, obtain only two data points.


pgpjRh3VFJSr4.pgp
Description: OpenPGP digital signature


[gentoo-user] Re: Gentoo as NAS

2021-02-05 Thread Grant Edwards
On 2021-02-05, Michael  wrote:
> On Friday, 5 February 2021 03:34:12 GMT Matt Connell (Gmail) wrote:
>
>> I am using plex-media-server from this overlay without systemd.  It is
>> not required.

Indeed it's not. I added the overlay with 'eselect reository', did a
sync+upate, and it installed and worked with zero fuss.

> Wouldn't a binary distro, potentially purpose built as a NAS and/or HTPC 
> offering, make more sense?  I don't see what advantage the maintenance burden 
> of a Gentoo system has to offer in this use case, other than repurposing with 
> little effort an existing Gentoo installation.  :-/

Perhaps, but my plex-meida-server isn't running on an HTPC. It runs on
my normal desktop machine with which I do software development and
other day-to-day stuff.

--
Grant






Re: [gentoo-user] HOWTO: Freezing/unfreezing (groups of) processes

2021-02-05 Thread Rich Freeman
On Fri, Feb 5, 2021 at 2:07 PM Walter Dnes  wrote:
>
> On Fri, Feb 05, 2021 at 06:55:12AM -0500, Rich Freeman wrote
> > On Fri, Feb 5, 2021 at 2:45 AM Walter Dnes  wrote:
> > >
> > >   So far, so good, but running "ps -ef | grep whatever" and then
> > > typing the kill -SIGSTOP/SIGCONT command on the correct pid is grunt
> > > work, subject to typos.
> >
> > man killall
>
>   My reading of the "killall" man page is that it works on command
> names.  For my script, "pstop palemoon" stops all instances of Pale
> Moon.  But my script greps the entire line, so "pstop slashdot" will
> stop the process...

Yeah, that is fair enough.  If you want to use other elements of the
command line/etc then you'd need to do something more along the lines
of your script.  Just wanted to make people aware.

-- 
Rich



Re: [gentoo-user] HOWTO: Freezing/unfreezing (groups of) processes

2021-02-05 Thread Walter Dnes
On Fri, Feb 05, 2021 at 06:55:12AM -0500, Rich Freeman wrote
> On Fri, Feb 5, 2021 at 2:45 AM Walter Dnes  wrote:
> >
> >   So far, so good, but running "ps -ef | grep whatever" and then
> > typing the kill -SIGSTOP/SIGCONT command on the correct pid is grunt
> > work, subject to typos.
> 
> man killall

  My reading of the "killall" man page is that it works on command
names.  For my script, "pstop palemoon" stops all instances of Pale
Moon.  But my script greps the entire line, so "pstop slashdot" will
stop the process...

/home/waltdnes/pm/palemoon/palemoon -new-instance -p slasdot

  Does "killall" have that ability to stop a process based on any
parameters in the command line?

-- 
Walter Dnes 
I don't run "desktop environments"; I run useful applications



Re: [gentoo-user] HOWTO: Freezing/unfreezing (groups of) processes

2021-02-05 Thread Walter Dnes
On Fri, Feb 05, 2021 at 03:46:45AM -0500, Andrew Udvare wrote
> 
> > On 2021-02-05, at 02:45, Walter Dnes  wrote:
> > 
> > done < /dev/shm/temp.txt
> 
> You don't need to write a temporary file. You can pipe this directly into the 
> while loop:
> 
> while read
> do
> ...
> done < <(ps -ef | grep ${1} | grep -v "grep ${1}" | grep -v pstop)

  I wasn't aware of the "< <" construct. Nice

> Also to avoid the second grep in Bash at least:
> 
> grep "[${1:0:1}]${1:1}"

  That causes some feedback about backgrounded processes.

  In addition to your avoiding-the-temp-file trick, I also realized that
if I read the first 3 items of each line, I can use the 2nd parameter
directly without an intermediate assignment to an array.  The latest
version of my scripts are...

=== pstop ===
while read userid pid rest_of_line
do
   kill -SIGSTOP ${pid}
done < <(ps -ef | grep ${1} | grep -v "grep ${1}" | grep -v pstop)

=== pcont ===
#!/bin/bash
while read userid pid rest_of_line
do
   kill -SIGCONT ${pid}
done < <(ps -ef | grep ${1} | grep -v "grep ${1}" | grep -v pcont)

=

  In the course of experimentation, I've made versions that killed
critical processes, requiring a reboot. {ALT}{SYSRQ} to the rescue .
I'll stick with stuff that works.

-- 
Walter Dnes 
I don't run "desktop environments"; I run useful applications



Re: [gentoo-user] spam - different IP's

2021-02-05 Thread William Kenworthy


On 5/2/21 6:10 pm, Michael wrote:
> On Friday, 5 February 2021 01:48:09 GMT Adam Carter wrote:
>> On Thu, Feb 4, 2021 at 6:07 PM Adam Carter  wrote:
>>> On Thursday, February 4, 2021,  wrote:
 I'm perplex with this entry in apache log.
 I'm sure it was done by same person as the timing is very sequential and
 same file-name request, but how they were able to lunch an attack from a
 different IP's different geographical locations.
 Can they spoof an IP?
>>> Probably just different instances of the same bot scanning for
>>> vulnerabilities. I imagine you will keep seeing that log from many
>>> different ips
>> FWIW i'm seeing the same traffic. Here's some numbers;
>>
>> $ zgrep -ic wlwmanifest.xml access.log*
>> access.log:16
>> access.log-20210110.gz:0
>> access.log-20210117.gz:0
>> access.log-20210124.gz:34
>> access.log-20210131.gz:0
> Bot herders have acquired many geographically dispersed IP addresses to run 
...
> Depending on your server's IP address featuring on some target list, the 
> volume of calls can become quite high.  Trying to manually block the bots is 
> a 
> tedious and ineffective task, because the professionals will add yet one more 
> compromised IP address to their herd faster than you can block them.  A 
> scripted honeypot to automatically block typical mass scans, e.g. for 
> wordpress installations, would be more effective.

Use fail2ban to target active abusers using your logs. (recommended)

Leverage the cloud with something like:
http://iplists.firehol.org/?ipset=firehol_level1 (loaded to shorewall
with ipset:hash) to preemptively ban via blacklists - recommended. 
There are many good blacklists out there - this one is a meta-list and
has fast and responsive updates.

Snort (in IDS mode triggering a fail2ban rule) is a bit heavier
resource-wise but quite useful.  Snort in IPS mode is better, but it can
impact throughput. (if you are commercial, consider a licence to get the
latest rules as soon as they are created/needed.)

or use all of them at the same time :)

BillK





Re: [gentoo-user] segfault from C stack overflow

2021-02-05 Thread Joshua M. Murphy
On Fri, Feb 5, 2021 at 8:44 AM  wrote:
>
> When emerging R, I got:
>
> ...
> ** R
> ** data
> *** moving datasets to lazyload DB
> ** demo
> ** inst
> ** byte-compile and prepare package for lazy loading
> Error: segfault from C stack overflow
> ...
>
> Since linux automatically grows the stack, doesn't this mean
> that I'm out of memory.
>
> Btw.
> # prlimit -s
> RESOURCE DESCRIPTION   SOFT  HARD UNITS
> STACKmax stack size 8388608 unlimited bytes
>
> and prlimit --stack=-1:-1 doesn't change the soft limit.
>
> Regards,
> /Karl Hammar

No, a stack overflow isn't a failure to allocate more space on the
stack, it's writing more data to a variable on the stack than what had
been allocated for it. For example, if you declare an array for 10
characters, then write 30 characters to it, it's a stack overflow
(because the variable's on the stack, and you overflowed the
boundaries of it).

-- 
Poison [BLX]
Joshua M. Murphy



[gentoo-user] segfault from C stack overflow

2021-02-05 Thread karl
When emerging R, I got:

...
** R
** data
*** moving datasets to lazyload DB
** demo
** inst
** byte-compile and prepare package for lazy loading
Error: segfault from C stack overflow
...

Since linux automatically grows the stack, doesn't this mean
that I'm out of memory.

Btw. 
# prlimit -s
RESOURCE DESCRIPTION   SOFT  HARD UNITS
STACKmax stack size 8388608 unlimited bytes

and prlimit --stack=-1:-1 doesn't change the soft limit.

Regards,
/Karl Hammar





Re: [gentoo-user] HOWTO: Freezing/unfreezing (groups of) processes

2021-02-05 Thread Ramon Fischer

Awesome stuff!

It might be unrelated, but I would like to mention a script[1] here, 
which I have written in Bash to analyse process signals. It is called 
"psig", which mimics some of the behaviour of Solaris' "psig" binary:


   $ psig 23024

   PID: 23024
   Name: chrome
   Queued: 0/63858
   Signals caught:
   ---
   Signal 17: SIGCHLD
   Signal 15: SIGTERM
   Signal 2: SIGINT
   Signal 1: SIGHUP
   Hexadecimal:  0 0 0 0 0 0 0 1 8
   0 0 1 4 0 0 3
   Binary:                0001  1000 
       0001  0100      0011

   Signals pending (process):
   --
   No signals found.

   Signals pending (thread):
   -
   No signals found.

   Signals blocked:
   
   No signals found.

   Signals ignored:
   
   Signal 13: SIGPIPE
   Hexadecimal:  0 0 0 0 0 0 0 0 0
   0 0 0 1 0 0 0
   Binary:                   
         0001      

-Ramon

[1] https://github.com/keks24/psig


On 05/02/2021 08:45, Walter Dnes wrote:

   Thanks for all the help over the years fellow Gentoo'ers.  Maybe I can
return the favour.  So you've got a bunch of programs like Gnumeric or
QEMU or Pale Moon ( or Firefox or Chrome or Opera ) sessions open, that
are chewing up cpu and ram.  You need those resouces for another
program, but you don't want to shut those programs down and lose your
place.  If the programs could be frozen, cpu usage would go away, and
memory could be swapped out.  Here's a real-life example subset of a
"ps -ef" output on my system.  Replace "palemoon" with "firefox" or
"chrome" or whatever browser you're using.

waltdnes  4025  3173  0 Jan20 ?01:54:21 
/home/waltdnes/pm/palemoon/palemoon -new-instance -p palemoon
waltdnes  7580  3173  4 Jan21 ?17:45:11 
/home/waltdnes/pm/palemoon/palemoon -new-instance -p dslr
waltdnes  9813  3173  4 Jan21 ?16:24:23 
/home/waltdnes/pm/palemoon/palemoon -new-instance -p wxforum
waltdnes 22455  3173 58 01:31 ?00:08:29 
/home/waltdnes/pm/palemoon/palemoon -new-instance -p slashdot
waltdnes 22523  3173  0 01:31 ?00:00:05 
/home/waltdnes/pm/palemoon/palemoon -new-instance -p youtube
waltdnes 22660  3173 12 01:45 ?00:00:04 /usr/bin/gnumeric 
/home/waltdnes/worldtemps/temperatures/temperatures.gnumeric
waltdnes 20346 20345  4 Jan28 ?08:10:50 /usr/bin/qemu-system-x86_64 
-enable-kvm -runas waltdnes -cpu host -monitor vc -display gtk -drive 
file=arcac.img,format=raw -netdev user,id=mynetwork -device 
e1000,netdev=mynetwork -rtc base=localtime,clock=host -m 1024 -name ArcaOS VM 
-vga std -parallel none

   You might want to RTFM on the "kill" command if you're skeptical.  It
does a lot more than kill programs.  "kill -L" will give you a nicely
formatted list of available signals.  For this discussion we're
interested in just "SIGCONT" and "SIGSTOP" ( *NOT* "SIGSTP" ).  If I
want to freeze the Slashdot session, I can run "kill -SIGSTOP 22455". To
unfreeze it, I can run "kill -SIGCONT 22455".  You can "SIGSTOP" on a
pid multiple times consecutively without problems; ditto for "SIGCONT".

   So far, so good, but running "ps -ef | grep whatever" and then
typing the kill -SIGSTOP/SIGCONT command on the correct pid is grunt
work, subject to typos. I've set up a couple of scripts in ~/bin to
stop/continue processes, or groups thereof.  The following scripts do a
"dumb grep" of "ps -ef" output, redirecting to /dev/shm/temp.txt.  That
file is then read, and the second element of each line is the pid, which
is fed to the "kill" command.  I store the scripts as ~/bin/pstop and
~/bin/pcont.

== pstop (process stop) script ==
#!/bin/bash
ps -ef | grep ${1} | grep -v "grep ${1}" | grep -v pstop > /dev/shm/temp.txt
while read
do
inputarray=(${REPLY})
kill -SIGSTOP ${inputarray[1]}
done < /dev/shm/temp.txt

 pcont (process continue) script 
#!/bin/bash
ps -ef | grep ${1} | grep -v "grep ${1}" | grep -v pcont > /dev/shm/temp.txt
while read
do
inputarray=(${REPLY})
kill -SIGCONT ${inputarray[1]}
done < /dev/shm/temp.txt

=

   To stop all Pale Moon instances, execute "pstop palemoon".  To stop
only the Slashdot session, run "pstop slashdot".  Ditto for the pcont
command.  I hope people find this useful.



--
GPG public key: 5983 98DA 5F4D A464 38FD CF87 155B E264 13E6 99BF




OpenPGP_signature
Description: OpenPGP digital signature


Re: [gentoo-user] HOWTO: Freezing/unfreezing (groups of) processes

2021-02-05 Thread Rich Freeman
On Fri, Feb 5, 2021 at 2:45 AM Walter Dnes  wrote:
>
>   So far, so good, but running "ps -ef | grep whatever" and then
> typing the kill -SIGSTOP/SIGCONT command on the correct pid is grunt
> work, subject to typos.

man killall


-- 
Rich



[gentoo-user] binary server's decisions arbitrary?

2021-02-05 Thread n952162

Hi,

I'm updating my vbox's via a binary server on the host.

I'm disappointed to see that the client is going to want to build
firefox, even though the version it wants is the same as offered by the
hosts and the USE flags are the same.  What factor am I missing?


The client:

   [ebuild   R    ] www-client/firefox-78.6.0:0/*esr78*::gentoo 
   USE="clang dbus* gmp-autoupdate openh264 system-av1 system-harfbuzz
   system-icu system-jpeg system-libevent system-libvpx system-webp
   -debug -eme-free -geckodriver -hardened -hwaccel -jack -lto -pgo
   -pulseaudio (-screencast) (-selinux) -wayland -wifi" L10N="-ach -af
   -an -ar -ast -az -be -bg -bn -br -bs -ca -ca-valencia -cak -cs -cy
   -da -de -dsb -el -en-CA -en-GB -eo -es-AR -es-CL -es-ES -es-MX -et
   -eu -fa -ff -fi -fr -fy -ga -gd -gl -gn -gu -he -hi -hr -hsb -hu -hy
   -ia -id -is -it -ja -ka -kab -kk -km -kn -ko -lij -lt -lv -mk -mr
   -ms -my -nb -ne -nl -nn -oc -pa -pl -pt-BR -pt-PT -rm -ro -ru -si
   -sk -sl -son -sq -sr -sv -ta -te -th -tl -tr -trs -uk -ur -uz -vi
   -xh -zh-CN -zh-TW" 0 KiB

 $ cd /etc/portage/package.use
 $ grep firefox *
 www-client/firefox dbus

If it's that "esr78", why am getting that?

The host:

   /var/cache/binpkgs/www-client/firefox-78.6.0.tbz2

   $ cd /etc/portage/package.use
   $ grep firefox *
   firefox:www-client/firefox dbus




Re: [gentoo-user] spam - different IP's

2021-02-05 Thread Michael
On Friday, 5 February 2021 01:48:09 GMT Adam Carter wrote:
> On Thu, Feb 4, 2021 at 6:07 PM Adam Carter  wrote:
> > On Thursday, February 4, 2021,  wrote:
> >> I'm perplex with this entry in apache log.
> >> I'm sure it was done by same person as the timing is very sequential and
> >> same file-name request, but how they were able to lunch an attack from a
> >> different IP's different geographical locations.
> >> Can they spoof an IP?
> > 
> > Probably just different instances of the same bot scanning for
> > vulnerabilities. I imagine you will keep seeing that log from many
> > different ips
> 
> FWIW i'm seeing the same traffic. Here's some numbers;
> 
> $ zgrep -ic wlwmanifest.xml access.log*
> access.log:16
> access.log-20210110.gz:0
> access.log-20210117.gz:0
> access.log-20210124.gz:34
> access.log-20210131.gz:0

Bot herders have acquired many geographically dispersed IP addresses to run 
their reconnaissance scripts from.  When you block one subnet or ISP block, 
they will usually popup in the logs almost immediately from another ISP in the 
same or different country.  Their calls seem to coordinate with evening or day 
time hours in their respective countries of origin.

Script kiddies tend to use mobile IPs, indicating they're using their phone or 
SIM as a modem.  When you block them they don't come back at least until their 
PAYG phone contract runs out.

There may also be state agents, but I would think it unlikely you'll find 
their fingerprints on your apache logs. :p

Depending on your server's IP address featuring on some target list, the 
volume of calls can become quite high.  Trying to manually block the bots is a 
tedious and ineffective task, because the professionals will add yet one more 
compromised IP address to their herd faster than you can block them.  A 
scripted honeypot to automatically block typical mass scans, e.g. for 
wordpress installations, would be more effective.

signature.asc
Description: This is a digitally signed message part.


Re: [gentoo-user] Re: Gentoo as NAS

2021-02-05 Thread Michael
On Friday, 5 February 2021 03:34:12 GMT Matt Connell (Gmail) wrote:
> On Fri, 2021-02-05 at 01:06 +, Grant Edwards wrote:
> > > The plex-server ebuild appears to require systemd, but it isn't listed
> > > as a dependency. Am I missing something?
> > 
> > Apparently so. The presence of the command systemd_newunit in the .ebuild
> > 
> > doesn't mean that systemd is required.
> 
> I am using plex-media-server from this overlay without systemd.  It is
> not required.

Wouldn't a binary distro, potentially purpose built as a NAS and/or HTPC 
offering, make more sense?  I don't see what advantage the maintenance burden 
of a Gentoo system has to offer in this use case, other than repurposing with 
little effort an existing Gentoo installation.  :-/


signature.asc
Description: This is a digitally signed message part.


Re: [gentoo-user] HOWTO: Freezing/unfreezing (groups of) processes

2021-02-05 Thread Andrew Udvare


> On 2021-02-05, at 02:45, Walter Dnes  wrote:
> 
> done < /dev/shm/temp.txt

You don't need to write a temporary file. You can pipe this directly into the 
while loop:

while read
do
...
done < <(ps -ef | grep ${1} | grep -v "grep ${1}" | grep -v pstop)

Also to avoid the second grep in Bash at least:

grep "[${1:0:1}]${1:1}"

 $ ps -ef | grep '[l]vmetad'
root 965   1  0 Jan31 ?00:00:00 /sbin/lvmetad -f

^ No grep in output.

--
Andrew