KCLUG

kclug@kclug.org

2 participants
3242 discussions

Costa Rica May Criminalize VoIP
by Brian Kelsay 01 Mar '05

01 Mar '05

http://yro.slashdot.org/article.pl?sid=05/02/28/2231247&tid=215&tid=95&tid=… Is Greg Kedrovsky still there or amI confused and it's Puerto Rico and someone else in the group? I really should sleep more. Brian Kelsay

2 1

eight pounds two ounces twentytwo inches
by David Nicol 01 Mar '05

01 Mar '05

Aurora Nicol is here!

1 0

Sir Dork
by Brian Kelsay 01 Mar '05

01 Mar '05

http://slashdot.org/article.pl?sid=05/03/01/1731228&tid=109 Brian Kelsay

1 0

Re: Server Fundraiser
by Brian Kelsay 01 Mar '05

01 Mar '05

Those could also be mailed to Bill. He posted his address in here a week or two ago. Brian Kelsay >>> Dave Hull <> 03/01/05 03:55PM >>> Quoting Brian Kelsay <>: > At the regularly scheduled KCLUG Meeting tomorrow I will collect more funds > for the LUG server upgrades. Anyone from Lawrence attending the meeting tomorrow and willing to ferry a check? -- Dave Hull

1 0

Server Fundraiser
by Brian Kelsay 01 Mar '05

01 Mar '05

At the regularly scheduled KCLUG Meeting tomorrow I will collect more funds for the LUG server upgrades. I believe we are about $60 from our goal so that bigger, better drives and a controller can be purchased. Chris Bier will not be present at the meeting and I'm not sure about Bill C., so I will make sure the funds get to one of them in time for the hardware purchase. Only give if you are able. Checks can be made out to Bill Cavalieri w/ a ref. to KCLUG Server Fund in the memo. Brian Kelsay

3 2

Re: Trojan Found
by Brian Kelsay 28 Feb '05

28 Feb '05

Do these 2 tools work with the standard .debs I grab when I update my PC? Still figuring some intricacies of Debian out. Brian Kelsay >>> Chris Bier <chris.bier(a)cymor.com> 02/28/05 01:22PM >>> | | On this note, other than CRC checking and MD5 checksum options, | | is there any kind of an equivalent with Debian for this type of | | check? I'm guessing no | <snip /> | | debsig-verify | | http://www.linuxmafia.com/faq/Debian/package-signing.html | also dpkg-sig

1 0

RE: Trojan Found
by Brian Densmore 28 Feb '05

28 Feb '05

> -----Original Message----- > From: Jonathan Hutchins > > ... I did a CRC check against ALL of the system files. They're > fine. I checked > RPM before I used it to check the rest of the system. > > RPM's a great tool for a lot of things, including verifying > system integrity. ... > > It's VERY hard to hack an RPM system in such a way as to > conceal tampering > with files within the packages. Not impossible, but hard in > a way that the > low-level simplicity of rootedoor tends to contraindicate. > On this note, other than CRC checking and MD5 checksum options, is there any kind of an equivalent with Debian for this type of check? I'm guessing no. Although, it might be possible to build an rpm database of installed software on a Debian box and then use that as an additional check. Of course there's nothing, stopping a cunning cracker from building an RPM database, setting the timestamp and copying it onto the cracked system. Something possible with Jonathon's box too. Jonathon, was your check done with a local copy of the RPM database, or an archived known good copy? Certainly, if I were a cracker, installing a new copy of the RPM database would be part of my initial and every subsequent loading of software onto a cracked system. After all, to be successful at cracking it best to remain undetected. Brian

3 3

RE: Trojan Found
by Charles, Joshua Micah (UMKC-Student) 28 Feb '05

28 Feb '05

>Tucson, in fact. The manager at the ISP down there mounted the drive in a "spare" server running RH9 on VMWare, and gave me ssh access to it. I >reformatted the partitions and used rsync to reinstall. It took many hours, >even though it was only about 2.5G of data. I could have filtered it a >little better and used compression to speed it up some, but with the low >upstream bandwidth from RR it was just slow. I'm a niave person that has absolutely no knowledge of how to administer a server. That said, what is the possibiliy that the machine you rsync'd from has been compromised?

2 1

Re: CPAN
by Brian Kelsay 28 Feb '05

28 Feb '05

Yeah, you can update RH or Fedora with apt-get or YUM once you set up the program and point to the repositories. Apt4RPM is a bit easier than using RH update manager. I was always getting timeouts from the official RH mirrors during the day. Late at night would sometimes work. Brian Kelsay >>> Jonathan <djgoku(a)gmail.com> 02/28/05 10:12AM >>> Brian Kelsay wrote: >Wouldn't this be a good time to upgrade then? > >Brian Kelsay > I would sure hope so, maybe to a FC3? Then keeping up to do wouldn't be so hard if you were using the debian package management. Doesn't FC3 us something like that to update? I have never actually used FC yet. Thanks, Jonathan

3 2

RE: Trojan Found
by Brian Densmore 28 Feb '05

28 Feb '05

At the risk of sounding foolish, I'll jump in with my opinion. I' m no security expert either, but have learned something about security. I think your terminology for "rooted" is shall we say "creative". The fact the all of your files were wiped from the disk, and you seem to have ruled out hardware failure, the logical conclusion is that some process/user with root-level authority deleted all the files. The fact you discovered rootedoor after reinstalling doesn't preclude the possibility that it *was not* there before. I don't know the specifics of your machine and you certainly seem to know what you are doing, and I'm not suggesting you wipe your machine. I don't know if/why any of your clients have root level access, so if they do then it is certainly possible that one of them did it by accident, as you seem to think. I find it unlikely that some arbitrary process did this, and if it did then you need to seriously look at the uids that these processes run as. There is no reason for most programs and I see no reason for any web program to run with root privileges. I am curious though how the re-install was accomplished, seeing as how you live here in the KC Metro and the machine is 1000+ miles away in AZ, IIRC. I'd also like to say, that it appears by your numerous replies on this these threads that you take pretty good care of security, which makes finding out what might have happened more important. Since a successful hack might indicate a zero-day exploit, while it could also be highly likely that a local user's account has been compromised. Brian

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

KCLUG