KCLUG May 2005

kclug@kclug.org

33 participants
59 discussions

Commentary On Hitchhiker's Guide To The Galaxy
by Leo Mauler 02 May '05

02 May '05

Well, what you can see is the Hitchhikers movie. I've been assured from competent sources that most of the new stuff (including Arthur's love interest) are the late Douglas Adams' creations. I've seen it, and its a competent retelling of the Hitchhiker's Guide To The Galaxy mythos, plus some extras (the literal "slapstick" is also a Douglas Adams creation). The guy from Planet Magrathea wanted to see the same story again and he was rightfully disappointed, but if you think of it as a retelling rather than an attempt to tell the same story, it works rather well. My only complaints are that they overused the Vogons, and Arthur Dent acting more like an American Action Hero than a British Arthur Dent at the end of the movie. He's Arthur Dent, stuff happens to him, he doesn't happen to stuff! Watch for cameos by Simon Jones, the original Marvin body, and Douglas Adams (his head). --- "Kelsay, Brian - Kansas City, MO" <brian.kelsay(a)kcc.usda.gov> wrote: > Made me laugh: > > > Re:I don't trust him (Score:3, Funny) > > Seriously though, even if RotS is every bit as dark > and well-written > (and freakin' well-acted please!) as one could hope, > am I the only one > who is beyond giving a damn? > > Looking at the last 2 from Lucas, it would be like > having a 3-course > meal where the final dish was fantastic but the > first 2 gave you > projectile-vomiting food poisoning. No real way to > salvage the meal. > > If I do see it, it'll be the DVD rental. A $5 rental > for the entire > family is all I'm willing to risk. > > > Re:I don't trust him (Score:5, Funny) > > I'm on the verge of not downloading it... > after the Phantom Plot, > and Attack of the Cloned Wooden Actors, there's no > faint spark of hope > that RotS won't suck donkey balls. > Expect a total letdown. > Jar Jar? Check. > Hayden Cristensen? Check. > Cartoon Yoda? Check. > Yup, it's gonna suck. I pity tha fools. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

RE: OT OS issue
by Jack 02 May '05

02 May '05

--- Garrett Goebel wrote: > > If there's an OSS version of Ghost that works on > NTFS partitions without > requiring extensive reading and tweaking, please let > me know. Funny how > those proprietary OS's so often require proprietary > $$$ backup solutions. > Sorry, I don't have the reference for it, but I know there is an NTFS module/package for Linux and it's supposedly works well, even with writing. But, I haven't tested it, or used it so my knowledge on it is zero. What we really need is a Windows dll that will replace the NTFS with ext3 then we can convert all those Windows filesystems to ext3 and never worry about NTFS support again. Also, on the patching issue. Garrett's 100% correct. I should have included that inbetween steps 2 and 3 and 3 and 4. Sometimes you have to load a manufacturer patch, then the windows patch and sometimes you then have to reinstall the vendor patch. ;') Brian D. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

RE: Need help!
by Kelsay, Brian - Kansas City, MO 02 May '05

02 May '05

>-----Original Message----- >From: kclug-bounces(a)kclug.org [mailto:kclug-bounces@kclug.org] >On Behalf Of Jack >--- Frank Wiles wrote: >> On Sun, 1 May 2005 20:27:02 -0700 (PDT) >> Jack <quiet_celt(a)yahoo.com> wrote: >> Just to add to what Dave said... >> >> I have a production server that is fairly low end >> hardware that >> currently has 2952 iptables rules that block >> individual IPs, several >> /24 networks, and a handful of /16s. There is no >> noticeble impact >> on the box. >Wow! That's great news! Ok, so the plan looks rto be >to add the ipaddresses to iptables and change the port >for sshd. Other ports are being probed and attacked, >but not as frequently and not nearly as aggressively. >I'll modify my blacklist gathering script to >automatically add the new addresses to iptables and >send me an email listing the new addresses. > That would be a nice thing to post for the rest of us to look at. The script that is. And I what do you guys recommend for a group of Ips for default block, such as the Korean and Chinese blocks, or a site that lists recommendations like this. Is mapsrbl still active and valid?

2 1

Re: Need help!
by Jack 02 May '05

02 May '05

--- Frank Wiles wrote: > On Sun, 1 May 2005 20:27:02 -0700 (PDT) > Jack <quiet_celt(a)yahoo.com> wrote: > > > I have about half of the addresses blocked, but > what > > is > > the impact of adding 150 ip addresses to iptables > with > > potentially hundreds more over time? At what point > > will iptables eat up all my bandwidth in blocking > > addresses? > > Just to add to what Dave said... > > I have a production server that is fairly low end > hardware that > currently has 2952 iptables rules that block > individual IPs, several > /24 networks, and a handful of /16s. There is no > noticeble impact > on the box. Wow! That's great news! Ok, so the plan looks rto be to add the ipaddresses to iptables and change the port for sshd. Other ports are being probed and attacked, but not as frequently and not nearly as aggressively. I'll modify my blacklist gathering script to automatically add the new addresses to iptables and send me an email listing the new addresses. Thanks everyone! Brian __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

RE: Meeting dates
by Kelsay, Brian - Kansas City, MO 02 May '05

02 May '05

>-----Original Message----- >From: kclug-bounces(a)kclug.org >On Behalf Of Jared > >The meeting dates on the website are not >right... I'm looking forward to going to my >first meeting in over a year this Wednesday, >please correct me if I'm wrong. > >-Jared The rule is: First Wed. of the month and 3rd Tues. unless the meeting date falls on a typical holiday. Then it is only changed by group consensus on the list or in IRC and then announced/discussed on the list. So yes, this Wed. is the 1st Wed. of the month and we'll be there. Don't forget Mother's Day this weekend all you geeks. Get your mom something nice or take her to lunch. It'll help your situation when you need to move back in later. You did move out didn't you?

1 0

Re: Need help!
by Jack 02 May '05

02 May '05

--- Frank Wiles wrote: > On Sat, 30 Apr 2005 21:52:02 -0700 (PDT) > Jack <quiet_celt(a)yahoo.com> wrote: > > > ... I'm looking > for > > solution to reduce the attacks. The box is a "busy > > box", that is running several services. It runs > the > > ... > > The best way to lock out these attackers is to > simply use > iptables to block their IPs from accessing your > system. It > doesn't prevent a DoS on your available bandwidth, > but it keeps > them from bugging your system. I'm not sure why > this hasn't > been suggested before. I have about half of the addresses blocked, but what is the impact of adding 150 ip addresses to iptables with potentially hundreds more over time? At what point will iptables eat up all my bandwidth in blocking addresses? Thanks everyone for the suggestions. Brian D. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

3 2

Meeting dates
by Jared 02 May '05

02 May '05

The meeting dates on the website are not right... I'm looking forward to going to my first meeting in over a year this Wednesday, please correct me if I'm wrong. -Jared

1 0

Re: Need help!
by Jack 02 May '05

02 May '05

--- "D. Hageman" wrote: > On Sat, 30 Apr 2005, Jack wrote: > > > > Taking the box offline would take down my mail > server. > > I use this yahoo account for kclug, but I get all > my > > regular mail through accounts on my mail server. I > > didn't say the box has been compromised, I just > want > > advice on blocking these attacks as much as > possible. > > But I don't want to bring my box to a crawl to do > it. > > > > You should consider getting a secondary MX server. > There will be times > where you just can't avoid having the box be > inaccessible. If you had a > secondary MX this would be a non-issue. > I would like to add a secondary MX box. It's on my wish list. However, I don't see how that would make it a non-issue. If I take one box down, then the second one would become the attack target. I'm looking for solution to reduce the attacks. The box is a "busy box", that is running several services. It runs the firewall, webserver, mail server and of course is also hosting ssh access. The primary attack is focused on the sshd. The system is running stable with one or two services apt-pinned to testing and has the latest patches. I've analysed the system remotely a little and didn't see any indications of the system actually getting cracked. I'm primarily looking for techniques and suggesstions on ways to further lock out these crackers, without bogging down the box. Also on the remote checking of the system, what are some favorite tools for this? Thanks, Brian __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

5 4

reminder: trim posts
by Jason Clinton 01 May '05

01 May '05

Just a friendly reminder that the only KCLUG posting policy that everyone agrees on is that all posts should have the quoted section of the message you are replying to trimmed down to only that part which is relevant.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

KCLUG May 2005