Re: mysterious/suspicious internet activity.

2020-12-03 Thread Ed Greshko
On 04/12/2020 12:59, home user wrote: On 12/3/20 8:10 PM, Ed Greshko wrote: I believe the firewall on your system is already dropping all incoming connection requests. Provide the output of sudo firewall-cmd --get-active-zones and then using the result from that command sudo firewall-c

Re: mysterious/suspicious internet activity.

2020-12-03 Thread home user
On 12/3/20 8:10 PM, Ed Greshko wrote: I believe the firewall on your system is already dropping all incoming connection requests. Provide the output of sudo firewall-cmd --get-active-zones and then using the result from that command sudo firewall-cmd --info-zone=whatever-was returned.

Re: mysterious/suspicious internet activity.

2020-12-03 Thread home user
This afternoon, I did some more experimenting.  As at first, I booted up.  I then logged in, but this time as root.  I did *not* launch Thunderbird (or any other e-mail client) or Firefox (or any other browser) or anything else that I know uses the internet.  So the workstation should be "quiet

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Samuel Sieb
On 12/3/20 5:51 PM, home user wrote: On 12/3/20 6:35 PM, Samuel Sieb wrote: On 12/3/20 5:28 PM, home user wrote: On 12/3/20 5:31 PM, Samuel Sieb wrote: You will need to add your user to the "wireshark" group: sudo usermod -a -G wireshark username Then logout and log back in.  Run wireshark. 

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Ed Greshko
On 04/12/2020 10:51, home user wrote: J. Witvliet responded to my original post, but his response showed up in the list as a new thread. I'm responding here. (on Dec. 01, 2020 at 02:35am US mountain time, J. Witvliet wrote) What puzzles me, is that you don’t refer to the firewall. It’s the fi

Re: mysterious/suspicious internet activity.

2020-12-03 Thread home user
J. Witvliet responded to my original post, but his response showed up in the list as a new thread. I'm responding here. (on Dec. 01, 2020 at 02:35am US mountain time, J. Witvliet wrote) > What puzzles me, is that you don’t refer to the firewall. > It’s the firewall responsibility to block unexpe

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Samuel Sieb
On 12/3/20 5:34 PM, home user wrote: On 12/2/20 9:11 PM, Ed Greshko wrote: I think this would be easier for you to capture network traffic at this time.. With a quite system, open a terminal and as root use the following to capture some packets tcpdump -c 500 port 22 -w cap.pcap T

Re: mysterious/suspicious internet activity.

2020-12-03 Thread home user
On 12/3/20 6:35 PM, Samuel Sieb wrote: On 12/3/20 5:28 PM, home user wrote: On 12/3/20 5:31 PM, Samuel Sieb wrote: You will need to add your user to the "wireshark" group: sudo usermod -a -G wireshark username Then logout and log back in.  Run wireshark.  There should be a list of interfaces.

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Samuel Sieb
On 12/3/20 5:28 PM, home user wrote: On 12/3/20 5:31 PM, Samuel Sieb wrote: You will need to add your user to the "wireshark" group: sudo usermod -a -G wireshark username Then logout and log back in.  Run wireshark.  There should be a list of interfaces.  Double click on your ethernet one. W

Re: mysterious/suspicious internet activity.

2020-12-03 Thread home user
On 12/2/20 9:11 PM, Ed Greshko wrote: I think this would be easier for you to capture network traffic at this time.. With a quite system, open a terminal and as root use the following to capture some packets tcpdump -c 500 port 22 -w cap.pcap This will capture 500 packets and then

Re: mysterious/suspicious internet activity.

2020-12-03 Thread home user
On 12/3/20 5:31 PM, Samuel Sieb wrote: You will need to add your user to the "wireshark" group: sudo usermod -a -G wireshark username Then logout and log back in.  Run wireshark.  There should be a list of interfaces.  Double click on your ethernet one. When I "opened" the cap.pcap that Ed se

Re: Stop GDM showing notifications?

2020-12-03 Thread Tom Horsley
On Thu, 3 Dec 2020 17:12:27 -0800 Samuel Sieb wrote: > these are the steps that worked for me on Wayland Sounds like useful info. I'll play around when I have time. Thanks. ___ users mailing list -- users@lists.fedoraproject.org To unsubscribe send an e

Re: Stop GDM showing notifications?

2020-12-03 Thread Samuel Sieb
On 12/3/20 4:32 PM, Tom Horsley wrote: Can I run dconf-editor for a different user? (user gdm), or find some other magical way to disable the notifications that pop up while logging in? If you can figure out the setting you need to change, you can add it to the dconf database in /etc/dconf. T

Stop GDM showing notifications?

2020-12-03 Thread Tom Horsley
Can I run dconf-editor for a different user? (user gdm), or find some other magical way to disable the notifications that pop up while logging in? In particular there is a persistently annoying notification that my mouse battery is low. I'm fairly certain it is really the keyboard battery it is ta

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Samuel Sieb
On 11/30/20 3:47 PM, home user wrote: I've installed wireshark.  The man page is thousands of lines long.  Is there a good beginner-level tutorial for that?! You will need to add your user to the "wireshark" group: sudo usermod -a -G wireshark username Then logout and log back in. Run wireshar

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Samuel Sieb
On 12/3/20 2:01 PM, Ed Greshko wrote: On 04/12/2020 05:04, Samuel Sieb wrote: Is your computer's IP address in the 192.168.* or 10.* ranges?  If not, then you're directly connected.  Since you mentioned seeing login attempts before, you most likely are. You forgot the less common 172.16.0.0

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Samuel Sieb
On 12/3/20 4:01 PM, home user wrote: In gnome, I click the little network? symbol in the upper right corner of the display, just left of the speaker symbol. In the little box that comes up, from top to bottom, there is * "Wired Settings". I pick "Wired Settings". Here are the results: "https:

Re: mysterious/suspicious internet activity.

2020-12-03 Thread home user
In gnome, I click the little network? symbol in the upper right corner of the display, just left of the speaker symbol. In the little box that comes up, from top to bottom, there is * a volume slider, * "Wired Connected >", * "Settings >", and * "Power Off / Log Out >". I click the "Wired Connec

Re: mysterious/suspicious internet activity.

2020-12-03 Thread home user
> On 2020-12-03 19:40, home user wrote: > > > Yellow? Is that safe? (Joke.) I could use a good laugh these days. I 'm missing the joke. Please explain it. > Sometimes what users think is just a "modem" also contains a small > router > and enough of a firewall to do NAT. Sometimes (as with

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Jeremy Nicoll - ml fedora
On 2020-12-03 19:40, home user wrote: I was asked about this system. * comcast(my ISP) connected via metal wire cable to Arris phone modem connected via ethernet cable (yellow) to the workstation tower port. Yellow? Is that safe? (Joke.) Sometimes what users think is just a "modem" also con

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Ed Greshko
On 04/12/2020 05:04, Samuel Sieb wrote: Is your computer's IP address in the 192.168.* or 10.* ranges?  If not, then you're directly connected.  Since you mentioned seeing login attempts before, you most likely are. You forgot the less common 172.16.0.0 – 172.31.255.255 range. --- The key to g

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Samuel Sieb
On 12/3/20 11:40 AM, home user wrote: I did not fully understand them, but I got the sense that I should get help and not try to tackle this on my own. Finding and removing cryptominers can be very difficult. It's also extremely unlikely that you have something like that. I was asked about

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Samuel Sieb
On 12/3/20 1:11 AM, Tim via users wrote: Tim: All normal stuff, although they're listening to any address, rather than only listening to local addresses. That could be tightened up for some things, at least. I see no reason for CUPS to listen outside of your LAN, for instance. Samuel Sieb:

Re: Dragora bollixed?

2020-12-03 Thread Steven Usdansky via users
F33 Mate with dnfdragora-updater removed (rpm -e dnfdragora-updater) because I found it annoying. I have a launcher for dnfdragora in my panel; right-click on the panel then Add to Panel->Application Launcher->Administration->dnfdragora. I click on the panel icon, and, using the default Gtk inte

Re: Discover

2020-12-03 Thread Jonathan Billings
On Thu, Dec 03, 2020 at 11:08:00AM +0200, Kostas Sfakiotakis wrote: > Well can't pretend that am a Flatpak expert myself either . The only > question that remains is . > Since i was using rpms , is there a way to check the integrity of > the RPM Database ( theoretically it should be done automatica

Re: mysterious/suspicious internet activity.

2020-12-03 Thread home user
My posts to this list were apparently not reaching the list for a couple of days. This was fedora infrastructure issue 9509. It's fixed. Since the fix, I've been buried in personal business. I now have some time to get back to this problem. Prior to opening this thread, I did try digging in

Re: Dragora bollixed?

2020-12-03 Thread Beartooth
On Tue, 01 Dec 2020 04:15:09 +0800, Ed Greshko wrote: >> My bad. There is no drop-down. The whole display is greyed out, >> except for the colored line at the bottom showing its progress; and >> when that finishes, the only thing not greyed out is "quit". > > You will see that greyed out con

Re: Discover

2020-12-03 Thread Kostas Sfakiotakis
Στις 3/12/20 1:59 μ.μ., ο/η Ed Greshko έγραψε: On 03/12/2020 17:08, Kostas Sfakiotakis wrote: Well can't pretend that am a Flatpak expert myself either . The only question that remains is . Since i was using rpms , is there a way to check the integrity of the RPM Database ( theoretically it sh

Re: F33 setting search domain permanently

2020-12-03 Thread Tim via users
On Thu, 2020-12-03 at 12:58 +0100, p...@uni-bremen.de wrote: > In F33 the name resolution is done via systems-resolved by default, > not NetworkManager (and systemd-resolve was the origin of this > thread, if I remember correctly). And /etc/resolve.conf is now a > symbolic link managed by systemd.

Re: F33 setting search domain permanently

2020-12-03 Thread Kevin Becker
On Thu, 2020-12-03 at 12:58 +0100, p...@uni-bremen.de wrote: > In F33 the name resolution is done via systems-resolved by default, > not NetworkManager (and systemd-resolve was the origin of this > thread, if I remember correctly). And /etc/resolve.conf is now a > symbolic link managed by systemd.

Re: Discover

2020-12-03 Thread Ed Greshko
On 03/12/2020 17:08, Kostas Sfakiotakis wrote: Well can't pretend that am a Flatpak expert myself either . The only question  that remains is . Since i was using rpms , is there a way to check the integrity of the RPM  Database ( theoretically it should be done automatically but ok ) . Also i thi

Re: F33 setting search domain permanently

2020-12-03 Thread pboy
In F33 the name resolution is done via systems-resolved by default, not NetworkManager (and systemd-resolve was the origin of this thread, if I remember correctly). And /etc/resolve.conf is now a symbolic link managed by systemd. systemd-resolved is configured in /etc/systemd/resolved.conf. The

Re: Lutris Currently Uninstallable

2020-12-03 Thread Grumpey
On Thu, Dec 3, 2020 at 5:38 AM Christopher Ross wrote: > > > For days I have been getting the error "nothing provides > python3.8dist(python-magic)" when attempting a DNF update, and from > googling it seems I'm not alone in that. I have now uninstalled lutris > (the culprit) so that the update ca

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Ed Greshko
On 03/12/2020 12:16, Samuel Sieb wrote: Also, the capture file could contain some information that shouldn't be publicly shared. OK  Let me try to make it "easier" for the OP to use this particular "process of elimination". Meaning, eliminate brute force ssh attacks as the source of "myst

Lutris Currently Uninstallable

2020-12-03 Thread Christopher Ross
For days I have been getting the error "nothing provides python3.8dist(python-magic)" when attempting a DNF update, and from googling it seems I'm not alone in that. I have now uninstalled lutris (the culprit) so that the update can proceed. Where should I look for news on when this might be

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Ed Greshko
On 03/12/2020 12:16, Samuel Sieb wrote: Also, the capture file could contain some information that shouldn't be publicly shared. OK  Let me try to make it "easier" for the OP to use this particular "process of elimination". Meaning, eliminate brute force ssh attacks as the source of "myst

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Ed Greshko
On 03/12/2020 17:14, Tim via users wrote: On Thu, 2020-12-03 at 12:53 +0800, Ed Greshko wrote: I suppose if one is paranoid about posting their ip addresses they may be concerned. I tend to avoid that, because it just invites some people to have a go. However, in most posts to a mailing list yo

Re: F33 setting search domain permanently

2020-12-03 Thread Tim via users
On Thu, 2020-12-03 at 07:42 +, Jouk wrote: > Unfortunately for the VLAN om which my servers reside my university > does not provide a DHCP server, so this is not an option for me. How do you get an IP then? The network manager connection editor mentioned in the other post is probably going t

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Tim via users
On Thu, 2020-12-03 at 12:53 +0800, Ed Greshko wrote: > I suppose if one is paranoid about posting their ip addresses they > may be concerned. I tend to avoid that, because it just invites some people to have a go. However, in most posts to a mailing list your IP is in the mail headers. I remember

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Tim via users
Tim: >> All normal stuff, although they're listening to any address, rather >> than only listening to local addresses. That could be tightened up >> for some things, at least. I see no reason for CUPS to listen >> outside of your LAN, for instance. Samuel Sieb: > I assume you're referring to the

Re: Discover

2020-12-03 Thread Kostas Sfakiotakis
Στις 3/12/20 12:35 π.μ., ο/η Ed Greshko έγραψε: On 03/12/2020 05:29, Kostas Sfakiotakis wrote: Greetings , As am browsing the internet category ( for example ) looking if there is anything interesting ( usually there are a lot  ) i find that programs like Viber,Skype, Anydesk are offered to b

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Tim via users
On Thu, 2020-12-03 at 08:59 +0800, Ed Greshko wrote: > [egreshko@meimei etc]$ host no-mans-land.m247.com > Host no-mans-land.m247.com not found: 3(NXDOMAIN) > > So, what is the real IP address of that hostname? m247.com comes up with a general cloud service website, perhaps the no- mans-land pref