KCLUG

kclug@kclug.org

5 participants
3240 discussions

Crack attempt
by Brian Densmore 29 Oct '04

29 Oct '04

FYI. This guy spent two hours Thursday, 3am-5am, trying to break into my server's root account. 168.68.129.127 Dig says: ; <<>> DiG 2.1 <<>> @dns1.menandmice.is 168.68.129.127 A ; (1 server found) ;; res options: init recurs defnam dnsrch ;; got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 10 ;; flags: qr rd ra; Ques: 1, Ans: 0, Auth: 1, Addit: 0 ;; QUESTIONS: ;; 168.68.129.127, type = A, class = IN ;; AUTHORITY RECORDS: . 300 SOA A.ROOT-SERVERS.NET. NSTLD.VERISIGN-GRS.COM. ( 2004102900 serial 1800 refresh (30 mins) 900 retry (15 mins) 604800 expire (7 days) 86400 ) minimum (1 day) ;; Total query time: 2 msec ;; FROM: us.mirror.menandmice.com to SERVER: default -- 0.0.0.0 ;; WHEN: Fri Oct 29 09:09:57 2004 ;; MSG SIZE sent: 32 rcvd: 107 *********************************************************8 ARIN says: OrgName: USDA Office of Operations OrgID: UOO-2 Address: Suite 133, Building A Address: 2150 Centre Ave City: Fort Collins StateProv: CO PostalCode: 80526 Country: US NetRange: 168.68.0.0 - 168.68.255.255 CIDR: 168.68.0.0/16 NetName: PPQ NetHandle: NET-168-68-0-0-1 Parent: NET-168-0-0-0-0 NetType: Direct Assignment NameServer: NS1.USDA.GOV NameServer: NS2.USDA.GOV NameServer: NS3.USDA.GOV Comment: RegDate: 1994-01-26 Updated: 2003-04-30 OrgAbuseHandle: ZU20-ARIN OrgAbuseName: USDA - Office of the ChiefInformation Officer OrgAbusePhone: +1-970-295-5277 OrgAbuseEmail: Network.Operations(a)usda.gov OrgNOCHandle: ZU20-ARIN OrgNOCName: USDA - Office of the ChiefInformation Officer OrgNOCPhone: +1-970-295-5277 OrgNOCEmail: Network.Operations(a)usda.gov OrgTechHandle: ZU20-ARIN OrgTechName: USDA - Office of the ChiefInformation Officer OrgTechPhone: +1-970-295-5277 OrgTechEmail: Network.Operations(a)usda.gov # ARIN WHOIS database, last updated 2004-10-28 19:10 # Enter ? for additional hints on searching ARIN's WHOIS database.

3 3

RE: Crack attempt
by Brian Densmore 29 Oct '04

29 Oct '04

> -----Original Message----- > From: Dustin Decker > > Immediately after I replied to your earlier post, I thought > to myself, "I > really aught to ask Brian what the traffic looked like." If > it's UDP, I'd > almost wholesale expect it is spoofed. Same applies to ICMP, > but if you're > looking at genuine TCP traffic, with an established > three-way-handshake, > it's a different story. (If you're working solely on the > basis of what you > find in syslog and the like, you might not be able to answer > the question > either. [Insert soapbox about logging all packets that > traverse the border > here.]) > Should definitely be TCP traffic. Attempts to log in via ssh from various ports. I don't think there's a port over 1024 on my system he/she left untouched. There may have been other ports/ services that were attempted, but they would have been dropped as part of the firewall rules. Not sure if I'm logging all the various ports/services such as ftp,etc. Don't want to open my server up to too easy of a DOS attack, so I basically ignore the impossible services.

1 0

RE: Crack attempt
by Brian Densmore 29 Oct '04

29 Oct '04

Interesting thing is this address is also a frequent visitor to West Virginia University. Possibly taking classes there? I've emailed the abuse department, have not heard back yet. <tinfoil hat> Could it be related to my complaint about beef inspection? Maybe they are confusing me with my cousin who is a cattle rustler? (just kidding all you secret policemen out there) Hey Doesn't Brian K. work for these people? ;') </tinfoil hat> It could also be a friend of mine playing a joke on me. He investigates cattle rustling and such stuff for the USDA people. Yeah, cattle rustling is big business in the US, it just doesn't make headlines much. I don't put much stock in this theory though. He's got better things to do at 3am. My bet is the ip is spoofed somehow, or one of the USDAs networks has been compromised. In any event, I'd recommend anyone who has a PC visible to the net to block this address. So far it's the only one in that block I've seen. I've got 24 entries in my blacklist. > -----Original Message----- > From: Jeremy Turner > > > On Fri, October 29, 2004 10:17 am, Brian Densmore said: > > OrgTechHandle: ZU20-ARIN > > OrgTechName: USDA - Office of the ChiefInformation Officer > > OrgTechPhone: +1-970-295-5277 > > OrgTechEmail: Network.Operations(a)usda.gov > > So they really are out to get you? =) > > That or some cracker is using zombie software to do the dirty work. > > Jeremy

2 1

RE: really cheap domain name sale
by Brian Kelsay 29 Oct '04

29 Oct '04

Whoops. You're right. It's .info. I guess the one I read before that one was .name. I was confoosed. To get the $1.00 deal, see the info below. Find your .INFO Domain Now! http://registrar.godaddy.com/default.asp?isc=gdf100781&tld=%2EINFO Prefer to order by phone? Call 1-480-505-8821 to order. Please be sure to mention offer code gdf100781 when calling. As an aside, you can opt-out of the promo mail/spam from them, but then you miss out on deals like this. Up to you. Brian Kelsay >>> "Gene Dascher" <gedascher(a)multiservice.com> 10/15/04 10:47AM >>> Hmmm, did you get an email about this? I just checked a few minutes ago and saw the special on the .biz domains, but not on the .name domains. They did have a $1.95 special on .info domains however.

3 3

here is a paragraph from the microsoft 2004 annual report
by David Nicol 29 Oct '04

29 Oct '04

http://www.davidnicol.com/October2004/microsoft_challenged.htm -- David L Nicol transportation infrastructure technology contracting since 2002

8 10

RE: OT RE: long sig
by Brian Kelsay 29 Oct '04

29 Oct '04

Brian, there was a reenactment of the invasion of Morocco in that movie I mentioned. They killed pretty much the whole Moroccan army in that battle. The US Marines swarmed into the palace and took the king/sultan into custody. I didn't watch the whole movie, so I'm a bit fuzzy on the why and the outcome. Something to do with the taking of some American hostages (women and children) by the king/sultan's brother (played by Sean Connery) on the mainland in Tangiers. This was also at the time Teddy was running for reelection, I think. He was also preparing to start the Panama Canal or it was just underway. The first machine gun had been invented (similar to Gatling gun) and it had a part in the invasion on both sides. The king/sultan had a prototype delivered just prior to the attack, but it jammed or ran out of ammo at some point. Brian Kelsay >>> "Brian Densmore" <> 10/26/04 02:59PM >>> I think you're thinking of Teddy's Rough Riders and the charge up San Juan Hill. He wasn't president then. It was however one of the greatest acts of stu<bs><bs><bs>bravery the current age has seen. > -----Original Message----- > From: Jonathan Hutchins > > Didn't we invade Morocco or something like that?

6 5

RE: Cron
by Brian Densmore 28 Oct '04

28 Oct '04

Ok thanks everyone for the responses. Some questions and clarifications. Where is the cron log? I don't see one specifically for cron. How would I add logging to the script? According to the way I read the crontab entry, the script should be called by the run-parts script as root. If this is the case then it should have rights to write to the file. Yes, I'm still rather new at scripting and cron. I'm only using cat grep and awk in the script and all paths are fully qualified. The file that the script is writing to is set up exactly like the log files in /var/log. I had considered making it world writtable for debugging, but that wouldn't solve my problem, because I want to lock it down. So I guess I need to figure out "who" is running cron jobs, although I thought it was root. ------------------------------------------------------------ /etc/crontab # /etc/crontab: system-wide crontab # Unlike any other crontab you don't have to run the `crontab' # command to install the new version when you edit this file. # This file also has a username field, that none of the other crontabs do. SHELL=/bin/sh PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin # m h dom mon dow user command 25 6 * * * root test -e /usr/sbin/anacron || run-parts --report /etc/cron.daily 47 6 * * 7 root test -e /usr/sbin/anacron || run-parts --report /etc/cron.weekly 52 6 1 * * root test -e /usr/sbin/anacron || run-parts --report /etc/cron.monthly # ---------------------------------------------------- My holding blacklist file particulars of import rw-r--r-- root.adm /etc/illegalips.txt > -----Original Message----- > From: Jonathan Hutchins > > May I suggest you develop some logging or error reporting > that shows you if > the script is getting called? > -----Original Message----- > From: Dan > > Just a guess, but cron doesn't know about your $PATH > -----Original Message----- > From: John M Geiger > > what is the setting in your /etc/crontab file for running daily > jobs? I have to believe the script is being kicked off by cron but, > as someone else has noted, may have a PATH problem or other > environmental variable problem of some sort. > > Or, just to make sure, the ID that your blacklist script runs > under does have permission to update the blacklist hold file, right?

5 4

RE: HDTV cards for Linux
by Brian Densmore 28 Oct '04

28 Oct '04

Ok, now I'm confused. Isn't the HD-3000 a HD video capture card? Doesn't it have the proper connectors going into the card? If not what would be the point of the card? I see two connectors that *look* like coax connectors on the card, one of which is specifically designated as an antenna connector. Not that I care, I won't be buying one, I have no use for a HD card in my Linux machine. Unless it is useful for doing 3D modeling, but a good 21" monitor and a decent graphics card is all that is really needed there. I would suspect most VGA monitors are natively capable of HDTV? Or am I wrong on that one? > -----Original Message----- > From: Jason Clinton > > Brian Densmore wrote: > > Elaborate please. I thought some cable companies were > > ... > > ... arrives at the cable box, it's decoded and given to the TV > for display > (480i/p, 720i/p, 1020i/p, DVI -- all standards). You could > receive the > signal from the cable box and do something with it if you had > the right > connectors but, other than that, you won't be decoding the > data stream > from the cable company yourself. > > > I'm not sure what all the hubbub is about anyway. > > Well, as an owner of a 1080i CRT TV, I can attest to the great > improvement in quality offered by HD signals. Ok. I hadn't noticed any problem with current selections. I guess you have be an aficionado to appreciate. Kind of like high end stereo systems capable of blowing the windows out of one's house. I have an old friend that had one of those systems, he's deaf now and his $10,000 (1978 dollars) stereo is useless to him. I'm sure HD is great to look at, kind of like Ferrari's. I'm perfectly happy with my old beat up Chevy though.

3 5

Network Engineer
by Dustin Decker 28 Oct '04

28 Oct '04

Howdy All, Saw this SAIC opportunity on Dice.com. http://seeker.dice.com/seeker.epl?rel_code=1102&op=5&type=14&dockey=xml/4/0/ 40e5993fb0b2e3505af11e6502e93315@activejobs0&source=2 Here's a snippet: Desired Skills: Familiarity with traffic sensors, serial and discrete interfaces and association with equipment capable of operating in extreme outdoor environments. Demonstrated problem solving skills, ability to work in a dynamic environment and balance multiple tasks, deadlines and customers. I wonder what they're up to now? D.

2 1

Re: Video quality Re: HDTV cards for Linux
by Jason Clinton 28 Oct '04

28 Oct '04

Jeff Martin wrote: > What kind of output does the cable box have for the HDTV? > If you display HDTV on a computer monitor do you think it would be the > same quality as a dedicated HDTV monitor? IIRC, the TW Cable box supports composite out in 480i/p and 1080i and DVI (which is autonegotiated). Audio is AC3 optical or RCA stereo. I'm using the DVI connector for my CRT TV.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

KCLUG