Re: [gentoo-user] OpenSSH upgrade warning

[Jeff Smelser]

On Tue, Nov 10, 2015 at 11:55 AM, Michael Orlitzky  wrote:

> On 11/10/2015 01:26 PM, Alan McKinnon wrote:
> >
> > I think you are approaching this problem from the wrong viewpoint. You
> > have to assume an attacker has vastly more resources to bear on the
> > problem than you have. Thanks to Amazon and the cloud, this is now a
> > very true reality. Brute force attacking a root password is nowhere near
> > as complex as the maths would lead you to believe; for one thing they
> > are decidedly not random. The fact is that they are heavily biased,
> > mostly due to 1) you need to be able to remember it and 2) you need to
> > be able to type it.
> >
> > Humans have been proven to be very bad at coming up with passwords that
> > are truly good[1] and hard for computers to figure out. And our brains
> > and very very VERY good at convincing us that our latest dumb idea is
> > awesome. Are you really going to protect the mother lode (root password)
> > with a single system proven to be quite broken and deeply flawed by
> wetware?
> >
>
> I know all that, but I asked you to assume that I'm not an idiot and
> that it would take forever to brute-force my root password =)
>
> I'm not going to tell you what it is, so you'll have to believe me.
>
>
I guess from this your assuming that everyones passwords that have been
hacked are god, birthdays and such?

Re: [gentoo-user] OpenSSH upgrade warning

[Jeff Smelser]

I am going to stop this convo. As soon as you say it cant be brute forced,
I am going to move on.

Good luck with that.

On Tue, Nov 10, 2015 at 12:17 PM, Michael Orlitzky <m...@gentoo.org> wrote:

> On 11/10/2015 02:00 PM, Jeff Smelser wrote:
> >
> > I guess from this your assuming that everyones passwords that have been
> > hacked are god, birthdays and such?
> >
>
> Again: assume that I'm not an idiot, and that I know how to choose a
> long, random password. It cannot be brute-forced. And if it could,
> adding an SSH key encrypted with a password of the same length would
> provide no extra security.
>
>
>

Re: [gentoo-user] OpenSSH upgrade warning

[Jeff Smelser]

Again, your not understanding  that brute force is not entirely how you
think it works. As a former employee of a large tech company. They are much
more cunning how they do it these days..

If you wanted to break into an account, would you really start with a and
work your way up?

Come on.

Accounts are broken into all the time and they claimed their passwords were
awesome..

Your not an idiot, you just need to do more research on how hackers get in.

On Tue, Nov 10, 2015 at 12:31 PM, Michael Orlitzky <m...@gentoo.org> wrote:

> On 11/10/2015 02:23 PM, Stanislav Nikolov wrote:
> >
> >
> > On 11/10/2015 09:17 PM, Michael Orlitzky wrote:
> >> On 11/10/2015 02:00 PM, Jeff Smelser wrote:
> >>> I guess from this your assuming that everyones passwords that
> >>> have been hacked are god, birthdays and such?
> >>>
> >> Again: assume that I'm not an idiot, and that I know how to choose
> >> a long, random password. It cannot be brute-forced. And if it
> >> could, adding an SSH key encrypted with a password of the same
> >> length would provide no extra security.
> >>
> >>
> > Are you sure you know how such keys work? An extremely 15 character
> > password (Upper case, lower case, numbers, 8 more symbols) gives you
> > ~4747561509943000 combinations
>
>
> And since no one seems to believe me, if you could try a million
> passwords a second (over the network!), it would take you about
> 75,272,093,955,210 years to try half of those combinations.
>
>
>

Re: [gentoo-user] OpenSSH upgrade warning

[Jeff Smelser]

On Mon, Nov 9, 2015 at 6:38 PM, Michael Orlitzky  wrote:

> A major upgrade to OpenSSH is being stabilized:
>
>   https://bugs.gentoo.org/show_bug.cgi?id=18
>
> The default of PermitRootLogin for sshd in the new version is
> "prohibit-password". If you typically log in to the root account over
> SSH using a password, **IT'S GONNA BREAK**, and you won't be able to fix
> it remotely unless you have an account that can sudo to root.
>
> To maintain the current behavior, set PermitRootLogin to "yes" before
> you upgrade, and then be careful not to wipe out sshd_config.
>
>

The question is, why would you want root login? If your still using it,
your doing it wrong.

Re: [gentoo-user] !!!!

[Jeff Smelser]

What did you update? Nothing I remember recently came out to break like
this.

On Tue, Aug 18, 2015 at 2:52 PM, Alan Grimes alonz...@verizon.net wrote:

 Like a stupid dumbfuck, I tried to update my machine today

 tortoise ~ # revdep-rebuild
 /bin/bash: error while loading shared libraries: libtinfo.so.5: cannot
 open shared object file: No such file or directory
 tortoise ~ # ufed
 sh: error while loading shared libraries: libtinfo.so.5: cannot open
 shared object file: No such file or directory
 sh: error while loading shared libraries: libtinfo.so.5: cannot open
 shared object file: No such file or directory
 sh: error while loading shared libraries: libtinfo.so.5: cannot open
 shared object file: No such file or directory
 sh: error while loading shared libraries: libtinfo.so.5: cannot open
 shared object file: No such file or directory
 sh: error while loading shared libraries: libtinfo.so.5: cannot open
 shared object file: No such file or directory
 sh: error while loading shared libraries: libtinfo.so.5: cannot open
 shared object file: No such file or directory

 Couldn't determine EPREFIX and PORTDIR from Portage
 INIT failed--call queue aborted.
 tortoise ~ #

 

 GOOD JOB, PENGUINS!!!
 I won't even be able to reboot my machine!!!

 A+ configuration management


 --
 IQ is a measure of how stupid you feel.

 Powers are not rights.

Re: [gentoo-user] compiling via distcc

[Jeff Smelser]

People do it all the time. You have to set up the amd64's to cross compile.

https://wiki.gentoo.org/wiki/Distcc/Cross-Compiling

On Wed, Feb 11, 2015 at 4:51 PM, Joseph syscon...@gmail.com wrote:

 I have an old eeepc 1GB ram and would like to install Gentoo on it as
 Xubuntu and Fedora both failed providing the programs I need.

 Since the eeepc is VERY slow, is it possible to setup distcc to do
 complete compiling on a faster machine.  (eeepc is x86, my faster boxes are
 amd64).

 --
 Joseph

Re: [gentoo-user] Update a portage package

[Jeff Smelser]

Looks like they have a couple people taking care of it:
http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/media-libs/glyr/ChangeLog?view=markup

On Sun, Sep 14, 2014 at 11:05 AM, Henrique Lengler 
henriquel...@openmailbox.org wrote:

 On Sun, Sep 14, 2014 at 05:56:48PM +0200, Alan McKinnon wrote:
  Ask the ebuild maintainer.

 How can I find a maintainer of an ebuild?
 --
 Henrique Lengler

 https://gitorious.org/~henriqueleng

 Skype: No way! That's nonfree (freedom-denying) software.
 Wanna talk with me? Ask me for my TOX ID.

Re: [gentoo-user] NdoUtils Wont Load module in nagios

[Jeff Smelser]

On Mon, Sep 8, 2014 at 7:02 AM, J. Roeleveld jo...@antarean.org wrote:

 What is the result of the following:

 # ls -lsah /usr/bin/ndomod.o

 ?


--()-[0s)# ls -lsah /usr/bin/ndomod.o
76K -rwxr-xr-x 1 nagios nagios 75K Sep  7 19:26 /usr/bin/ndomod.o

Re: [gentoo-user] NdoUtils Wont Load module in nagios

[Jeff Smelser]

Thanks, I saw that one.

If I am reading it right, he was missing the broker_command= which I have:

broker_module=/usr/bin/ndomod.o config_file=/etc/nagios/ndomod.cfg

Then when he add's it, its loading he just doesnt have it config'd
correctly:

[18-12-2012 17:39:07] Finished daemonizing... (New PID=10105)
[18-12-2012 17:39:07] Event broker module '/usr/local/nagios/bin/ndomod.o'
initialized successfully.
[18-12-2012 17:39:07] ndomod: Could not open data sink! I'll keep trying,
but some output may get lost...
[18-12-2012 17:39:07] ndomod: NDOMOD 1.5.2 (06-08-2012) Copyright (c) 2009
Nagios Core Development Team and Community Contributors
[18-12-2012 17:39:07] LOG VERSION: 2.0
[

Let me know if I missed something.

On Mon, Sep 8, 2014 at 10:02 AM, Alan McKinnon alan.mckin...@gmail.com
wrote:

 On 08/09/2014 02:32, Jeff Smelser wrote:
  I have been racking my head trying to figure out why this module wont
  load. All the privs are correct as far as I can see.
 
  Sep  7 19:22:32 kyle nagios: Nagios 3.5.1 starting... (PID=32513)
  Sep  7 19:22:32 kyle nagios: Local time is Sun Sep 07 19:22:32 CDT 2014
  Sep  7 19:22:32 kyle nagios: LOG VERSION: 2.0
  Sep  7 19:22:32 kyle nagios: Error: Could not load module
  '/usr/bin/ndomod.o' - file not found
 
  I cant even figure out how to get more debugging from the startup. :(
 
  Thanks,
  Jeff


 This post seems relevant:

 http://support.nagios.com/forum/viewtopic.php?t=8678p=41799



 Also, selinux and such things might be interfering. Are you running
 selinux?

 --
 Alan McKinnon
 alan.mckin...@gmail.com

Re: [gentoo-user] NdoUtils Wont Load module in nagios

[Jeff Smelser]

On Mon, Sep 8, 2014 at 12:52 PM, J. Roeleveld jo...@antarean.org wrote:

 Assuming nagios runs as user 'nagios', can you run:
 # ldd /usr/bin/ndomod.o


--()-[78s)# sudo su - nagios
nagios@kyle ~ $  ldd /usr/bin/ndomod.o
linux-vdso.so.1 (0x7fff6e1c7000)
libc.so.6 = /lib64/libc.so.6 (0x7f9dee041000)
/lib64/ld-linux-x86-64.so.2 (0x7f9dee608000)

Re: [gentoo-user] NdoUtils Wont Load module in nagios

[Jeff Smelser]

On Mon, Sep 8, 2014 at 5:04 PM, Alan McKinnon alan.mckin...@gmail.com
wrote:

 Looks like your problem is not the same. I'm just starting  myself to
 come to grips with this part of nagios, so I don't know how much further
 hhelp I can be.

 One thing that does stick out though is the taken literally, your error
 output cannot be correct. The file cannot possibly be not found when
 it quite obviously is right there on the disk :-)

 So one must now think further out the box. Either the error is
 completely wrong and the error handling code is buggy, or the message is
 incomplete somehow (eg maybe it's not the module that is not found but
 rather a file it references - or something like that).

 I recommend your next stop is the nagios user lists.
 Sorry I couldn;t assist more.


I would agree. I just dont know how to get more info from it. I will head
over there.

Thanks for the help so far,
Jeff

[gentoo-user] NdoUtils Wont Load module in nagios

[Jeff Smelser]

I have been racking my head trying to figure out why this module wont load.
All the privs are correct as far as I can see.

Sep  7 19:22:32 kyle nagios: Nagios 3.5.1 starting... (PID=32513)
Sep  7 19:22:32 kyle nagios: Local time is Sun Sep 07 19:22:32 CDT 2014
Sep  7 19:22:32 kyle nagios: LOG VERSION: 2.0
Sep  7 19:22:32 kyle nagios: Error: Could not load module
'/usr/bin/ndomod.o' - file not found

I cant even figure out how to get more debugging from the startup. :(

Thanks,
Jeff

Re: [gentoo-user] Is Gentoo still on the right path?

[Jeff Smelser]

On Wednesday 16 November 2005 02:50 pm, Derek Tracy wrote:

 That is what I was  thinking when I switched to stable.  From what I am
 seeing either my computer doesn't like stable code or stable does not mean
 stable anymore.

But thats not what you said. I Quote: 

In the past I have always leaned toward ~x86 (I love bleeding edge).  But 
since this was going to be a new install I decided to do the preferred method 
and set all ~x86 flags via /etc/portage/package.keywords for specific 
packages.  

This means your MIXING the two and is only recommended once the system is up. 
During an install, you should do one or the other, not start mixing and 
matching. HOWEVER, if you did set all to x86, and havent touched 
package.keyword, read the next paragraph.

Stable is fine.. I really dont understand how some modules have ANY thing to 
do with being x86 or ~x86..  Modules are always finicky, no matter what linux 
distro you use.. You probably are just forgetting to compile in the kernel 
options you had before, that you do not now have. (Guessing of course). 

Sounds to me you just re-installed before making sure you had all your ducks 
in a row and blaming it on gentoo. I havent seen anything in your message 
that I can say, gentoo did it, and you didnt do it yourself.. It all really 
just sounds like configuration issues, that happens on all new install, no 
matter the distro, x86/~x86, or otherwise.

Jeff


pgpSicLjtDkbI.pgp
Description: PGP signature

Re: [gentoo-user] Is Gentoo still on the right path?

[Jeff Smelser]

On Wednesday 16 November 2005 02:55 pm, Benjamin Martin wrote:

 True that the installations become identical very soon. But what if I set
 up server using stage 1 and an up-to-date portage tree. After the
 installation is finished it'll sit around doing whatever it's supposed to
 do and I don't really touch it except for security related updates.
 Just an example where stage 1 was a nice option. Taking away such an option
 doesn't sound all too much like the gentoo way to me.

They are not taking it away. They just dont support it, big difference..

We just went through all this not a few weeks ago, why are we going through 
this again?

Jeff


pgpgThL66IHyN.pgp
Description: PGP signature

Re: [gentoo-user] amaroK launching Kmail = virus?

[Jeff Smelser]

On Wednesday 16 November 2005 03:37 pm, abhay wrote:

 I nailed it on my system. I had some free time so installed gdb and ran
 amarok. Looks like if Retrieve similar artists is checked under Last.fm,
 it crashes amaroK. I unchecked the option and now it runs flawlessly. Check
 it in your case as well.

Make sense why I never saw it. I would run that by the amarok folk so they can 
fix it.. 

Jeff


pgp8PhiuHAsLj.pgp
Description: PGP signature

Re: [gentoo-user] amaroK launching Kmail = virus?

[Jeff Smelser]

On Tuesday 15 November 2005 09:42 am, Fernando Meira wrote:

 been using amaroK for a long time now, and just few days ago, something
 weird started to happen.
 At some point, when changing song, I get an error message saying that
 amaroK was unable to launch Kmail.
 I do not have Kmail, so I understand the problem.. but why amaroK wants to
 use Kmail?
 Can this be a symptom a virus or worm trying to spread?

Interesting.. Did the program error out? I do know it tries to send a stack 
trace when it errors out.

Jeff


pgpg58G543gvG.pgp
Description: PGP signature

Re: [gentoo-user] amaroK launching Kmail = virus?

[Jeff Smelser]

On Tuesday 15 November 2005 12:02 pm, abhay wrote:

 Same problem here as well but since I use KMail, I know what is happening.
 Amarok is crashing weirdly. Amarok crashes and tries to send a bug report
 using KMail but interestingly it keeps on playing music and does what it is
 supposed to but it still says that it has crashed.

 Doesn't make sense, does it?

I am using 1.3.6 and i havent had problem with crashes unless I start messing 
with the cover manager..

I would upgrade.. If your using the newest copy, then i am not hitting those 
for some reason.

Jeff


pgpFByMWKIwb8.pgp
Description: PGP signature

Re: [gentoo-user] portage: fixed or not???

[Jeff Smelser]

On Monday 07 November 2005 02:04 pm, Jarry wrote:
  Which you are not doing, and frankly, you're pretty lucky that something
  hasn't blown up up to now.

 That might happen, sooner o later. But still I think it is still better
 than leaving some hole for uninvited visitors.
 Thanks for your constructive explanation.

Yeah, but your not restarting anything anyway, so your point is moot.. The 
service is still running with a big fat hole in it regardless..

Jeff


pgpr1tHRlSmXt.pgp
Description: PGP signature

Re: [gentoo-user] portage: fixed or not???

[Jeff Smelser]

On Monday 07 November 2005 03:52 pm, Holly Bostick wrote:
 No, no, Jeff, that is apparently where you are wrong:

Heh, I missed this tidbit..

 Jarry schreef:
  Well, this will be probably criticised, but after every upgrade
  (independently of what was really updated) I restart sshd, named,
  sendmail and apache, even with old config-files. I thought that way
  not only my system is updated, but also new versions of those daemons
   are running. Rest (I thought) is not important...

 So you see, the mail server, ssh server and web server *are* restarted.

 Whether or not they were the services actually updated (or needing
 update), and without regard to
 whether the change required an updated *configuration* file, which--
 since etc-update was not run-- did not take place. But we all know that
 fixing a security hole never has any relationship to the application's
 config files, ever. Don't we? And of course restarting those four
 servers, even with old config files, constitutes a full and complet
 update, patching all relevant security holes covered by the emerge -uDN
 world. *Ob*viously. Because *ob*viously, emerge -uDNworld updates to the
 version of whatever containing the patch for the hole. No matter what
 your ACCEPT_KEYWORDS is set to, no matter what USE flags are enabled.

 I mean, *really*, Jeff. What *are* you thinking? Why on earth should we
 need to pay attention to any of that stuff? Don't you know Gentoo
 manages your server(s) for you? (Wonder why it takes two days to a week
 to install, if it does all this automatic management so well?!)

Heh, well, I stand corrected. I am sure we should all be doing this, because 
its obviously the right thing to do..

Well, i have been bitten on upgrades I was watching, he will be bit 
eventually, then he will come crying here.

Jff


pgpv0blZH9zF9.pgp
Description: PGP signature

Re: [gentoo-user] portage: fixed or not???

[Jeff Smelser]

On Monday 07 November 2005 03:38 pm, Jarry wrote:

 As I said previously: fixing errors later is my problem. But if I do
 not close some security leak, it would be then problem for me and maybe
 someone else too. There are too many unpatched and vulnerable computers
 on the net, I did not want to cotribute to it...

 But there is definitely something in what you are saying. Maybe I will
 think over it again...

I am curious, what program recently has been biting you that your so worried 
about remote attackers? 

Besides that, if you have your firewall and so forth set right, this should 
keep the problem pretty limited.. Considering its a play machine, what would 
you really need open to the entire world?

Jeff


pgpdUjWcyjwj8.pgp
Description: PGP signature

Re: [gentoo-user] MySQL issue

[Jeff Smelser]

On Thursday 03 November 2005 07:49 am, C. Beamer wrote:

 ERROR 2002 (HY000): Can't connect to local MySQL server through socket
 '/var/run/mysqld/mysqld.sock' (111)

 I googled for this and gather that it has something to do with the
 placement of the mysqld.sock file.

 The problem is the only post that I found that was specific to Gentoo
 was in German.  Since I don't want to screw things up any more than they
 already are, I'm turning here for help.

 I do have the file /var/run/mysqld/mysqld.sock

Thats a connection refused message.. Make sure the proper mysql files are 
there, and you may need to restart it to load your versions of the grant 
tables.

Jeff


pgp3M4iHLSFhN.pgp
Description: PGP signature

Re: [gentoo-user] MySQL Upgrade

[Jeff Smelser]

On Tuesday 01 November 2005 04:58 pm, C. Beamer wrote:

 A better description would have been that the restore worked.  However,
 the only database that was restored was the test database.  The database
 that I had created by creating a directory that was named after the
 database that I had created when using FC4 and then copying my database
 related files into it, did not back up.  Hence my assumption that
 because the database was *not* created in MySQL under Gentoo, perhaps
 this was the reason that the backup did not pick up (for lack of a
 better description) this database.

How were you backing/restoring it from, if you were not using mysqldump then? 
I have done the above several times, and its always backed it up. 

Trying to figure out what went wrong here..

Jeff


pgpkOmlu9v1bI.pgp
Description: PGP signature

Re: [gentoo-user] MySQL Upgrade

[Jeff Smelser]

On Wednesday 02 November 2005 12:52 pm, C. Beamer wrote:

 Up until now, what I needed to do in MySQL, I could do just fine and
 never even knew about mysqldump until recently.  As I previously stated,
 I've only been using Gentoo since September.  When I used to use FC4,
 all I ever did was make a copy of the database files that had the
 extensions of .MYI, .MYD and .frm and then when I needed to because of
 an upgrade where I wiped my system, I would just create a directory in
 the appropriate place that was named after the database and then copy
 these files back into the directory.  Then, all I would have to do was
 set up the appropriate permissions for access and I could use the
 database.  This is how I did it to get the database into Gentoo
 originally as well.

Well, this works for myisam, and few other, but not innodb.. Obviously you 
dont have it then..

 This works and is not a big deal.  As I said, I'm just curious if there
 is a way to fix things so that my database will be backed up properly
 with the mysqldump process that is run when upgrading.  As I also
 stated, I haven't had the chance to try dumping the existing database
 alone using mysqldump.

Well, then you would be more interested in mysqlhotcopy.. That pretty much 
does what your doing..

Mysql INC has yet to make a real backup/restore procedure for mysql. So 
mysqldump or mysqlhotcopy is pretty much it. If you use innodb, I would go 
after ibbackup. (not free).

I have been on a few developers about it, just doesnt seem high priority to 
them. (or I am not talking to the right ones).   

Jeff


pgpF373NhEI4Y.pgp
Description: PGP signature

Re: [gentoo-user] MySQL Upgrade

[Jeff Smelser]

On Wednesday 02 November 2005 02:23 pm, kashani wrote:

   Because once you start caring about your db that much it's usually
 easier to setup a crap box that replicates off your master. Then you can
 lock the whole db on your slave and do a mysqldump without causing
 issues on your main db regardless of which table type you're using. You
 also get the added benefit of a hot backup and no I/O hits on the main db.

No, thats unfeasable.. Your talking about little DB's.. I have a 300+ gig 
dbs's here and replication isnt the answer. Specially considering it is 
statement level over row level. 

   I'm managing five fairly busy Mysql servers so my tactics might not be
 those of the average user making the above a bit of overkill. I was very
 excited about Mysql's instance manager. However if your database has
 known periods of time when it isn't being used, ie you're using it as an
 Access replacement. Lock the tables, do the dump, free the tables, and
 save your cash for flaming Tiki drinks.

Heh, my server is never NOT being used.. Its really idiotic to have to do 
full's all the time, instead of being able to just do an incremental..

Like I said, your talking about these small db's.. doing a mysqldump takes 
over 3-5 hours.. I am not locking all my tables for up to 5 hours..

Jeff


pgpmNqm9RDTwG.pgp
Description: PGP signature

Re: [gentoo-user] PANIC !!!!

[Jeff Smelser]

On Friday 21 October 2005 02:24 pm, Hemmann, Volker Armin wrote:

 what do you mean 'crashed'?

 does revdep-rebuilt still works?

 but at least now you know why you should not use --deep.

Why not? I use it here and I never get crashes.. One doesnt mean the other.

Jeff
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] PANIC !!!!

[Jeff Smelser]

On Friday 21 October 2005 03:30 pm, Allan Spagnol Comar wrote:
 sorry by the way I put it Jeff I got to angry when All my services
 stop working after an ( what should be simple ) update .

Actually, I wasn't referring to your email, I was referring to Hemmann's.

Jeff
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] PANIC !!!!

[Jeff Smelser]

On Friday 21 October 2005 07:21 pm, Hemmann, Volker Armin wrote:

 which a) does not catch all the cases
 and b) would not be needed at all, if you don't do '--deep' updates.

Your trolling, arnt you? Are you really so naive that you think not having 
--deep solves all your problems? You do realize what --deep does right?

Jeff
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] HyperThreading won't activate

[Jeff Smelser]

On Wednesday 19 October 2005 10:55 pm, Statux wrote:

 I've got a 3.0GHz P4 with HyperThreading (Intel 531 processor for those
 of you who know of the Intel Processor Numbers) - kernel 2.6.13. I've
 enabled SMP and the HT scheduling option in the kernel config along with
 ACPI as I was told that it's a requirement in order to get HT to work.
 Yes, HT is enabled in BIOS. After compiling, installing, rebooting, etc,
 I don't see any changes. This is what /proc/cpuinfo shows:

This sounds kinda dumb, but I would pull out a gentoo live CD and see if it 
detects it. If it doesnt, there is something bios/hardware wise wrong with 
your setup, if it does, we can start going through kernel wise.. 

It always helps to eliminate things.

Jeff


pgp722CM8jrZO.pgp
Description: PGP signature