KCLUG

kclug@kclug.org

10 participants
3253 discussions

OT: Entry level Sprint job
by Paul Taylor 30 Oct '04

30 Oct '04

If anyone is interested in an entry level position at Sprint within Corporate Security. Starting pay is around $30,000 per year (more if you have experience, but 99.99% sure nobody will) and it's an hourly wage job so overtime may be available based on business needs. http://careers.sprint.com/joblist.html Job list 187197 The *Electronic Surveillance Analyst I* is responsible for implementing, troubleshooting and maintaining court-ordered electronic surveillance, call record delivery, handset location tracking and overall support to law enforcement. The Electronic Surveillance Analyst will also provide law enforcement assistance for surveillance system outages and in emergency situations involving Sprint communication services. Based on seniority, the Analyst will require either weekend, evening or overnight shift coverage to provide 24-hour support to law enforcement agencies.

1 0

pictures
by mike＠handuma.com 30 Oct '04

30 Oct '04

Pictures from itech and the hospital. http://www.handuma.com/itech/hospital.jpg http://www.handuma.com/itech/itech.jpg http://www.handuma.com/itech/itech1.jpg http://www.handuma.com/itech/itech2.jpg http://www.handuma.com/itech/itech3.jpg http://www.handuma.com/itech/itech4.jpg http://www.handuma.com/itech/itech5.jpg http://www.handuma.com/itech/itech6.jpg handuma http://www.handuma.com

6 8

Graphic for CD Labels from last year's ITEC
by Chris Bier 30 Oct '04

30 Oct '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Who had the nice graphic for CD Labels from last year's ITEC? Chris - -- I digitally sign my emails. If you see an attachment with .asc, then that means your email client doesn't support PGP digital signatures. http://www.gnupg.org/(en)/documentation/faqs.html#q1.1 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBeCfrE5xXU3JS1mQRAjKwAKDSt3/nNrLgl6/woar0ccrgRBu0sgCgxB2E wfXHTlAWeR/cPpiikDaVxSY= =+p5n -----END PGP SIGNATURE-----

10 29

Crack attempt
by Brian Densmore 29 Oct '04

29 Oct '04

FYI. This guy spent two hours Thursday, 3am-5am, trying to break into my server's root account. 168.68.129.127 Dig says: ; <<>> DiG 2.1 <<>> @dns1.menandmice.is 168.68.129.127 A ; (1 server found) ;; res options: init recurs defnam dnsrch ;; got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 10 ;; flags: qr rd ra; Ques: 1, Ans: 0, Auth: 1, Addit: 0 ;; QUESTIONS: ;; 168.68.129.127, type = A, class = IN ;; AUTHORITY RECORDS: . 300 SOA A.ROOT-SERVERS.NET. NSTLD.VERISIGN-GRS.COM. ( 2004102900 serial 1800 refresh (30 mins) 900 retry (15 mins) 604800 expire (7 days) 86400 ) minimum (1 day) ;; Total query time: 2 msec ;; FROM: us.mirror.menandmice.com to SERVER: default -- 0.0.0.0 ;; WHEN: Fri Oct 29 09:09:57 2004 ;; MSG SIZE sent: 32 rcvd: 107 *********************************************************8 ARIN says: OrgName: USDA Office of Operations OrgID: UOO-2 Address: Suite 133, Building A Address: 2150 Centre Ave City: Fort Collins StateProv: CO PostalCode: 80526 Country: US NetRange: 168.68.0.0 - 168.68.255.255 CIDR: 168.68.0.0/16 NetName: PPQ NetHandle: NET-168-68-0-0-1 Parent: NET-168-0-0-0-0 NetType: Direct Assignment NameServer: NS1.USDA.GOV NameServer: NS2.USDA.GOV NameServer: NS3.USDA.GOV Comment: RegDate: 1994-01-26 Updated: 2003-04-30 OrgAbuseHandle: ZU20-ARIN OrgAbuseName: USDA - Office of the ChiefInformation Officer OrgAbusePhone: +1-970-295-5277 OrgAbuseEmail: Network.Operations(a)usda.gov OrgNOCHandle: ZU20-ARIN OrgNOCName: USDA - Office of the ChiefInformation Officer OrgNOCPhone: +1-970-295-5277 OrgNOCEmail: Network.Operations(a)usda.gov OrgTechHandle: ZU20-ARIN OrgTechName: USDA - Office of the ChiefInformation Officer OrgTechPhone: +1-970-295-5277 OrgTechEmail: Network.Operations(a)usda.gov # ARIN WHOIS database, last updated 2004-10-28 19:10 # Enter ? for additional hints on searching ARIN's WHOIS database.

3 3

RE: Crack attempt
by Brian Densmore 29 Oct '04

29 Oct '04

> -----Original Message----- > From: Dustin Decker > > Immediately after I replied to your earlier post, I thought > to myself, "I > really aught to ask Brian what the traffic looked like." If > it's UDP, I'd > almost wholesale expect it is spoofed. Same applies to ICMP, > but if you're > looking at genuine TCP traffic, with an established > three-way-handshake, > it's a different story. (If you're working solely on the > basis of what you > find in syslog and the like, you might not be able to answer > the question > either. [Insert soapbox about logging all packets that > traverse the border > here.]) > Should definitely be TCP traffic. Attempts to log in via ssh from various ports. I don't think there's a port over 1024 on my system he/she left untouched. There may have been other ports/ services that were attempted, but they would have been dropped as part of the firewall rules. Not sure if I'm logging all the various ports/services such as ftp,etc. Don't want to open my server up to too easy of a DOS attack, so I basically ignore the impossible services.

1 0

RE: Crack attempt
by Brian Densmore 29 Oct '04

29 Oct '04

Interesting thing is this address is also a frequent visitor to West Virginia University. Possibly taking classes there? I've emailed the abuse department, have not heard back yet. <tinfoil hat> Could it be related to my complaint about beef inspection? Maybe they are confusing me with my cousin who is a cattle rustler? (just kidding all you secret policemen out there) Hey Doesn't Brian K. work for these people? ;') </tinfoil hat> It could also be a friend of mine playing a joke on me. He investigates cattle rustling and such stuff for the USDA people. Yeah, cattle rustling is big business in the US, it just doesn't make headlines much. I don't put much stock in this theory though. He's got better things to do at 3am. My bet is the ip is spoofed somehow, or one of the USDAs networks has been compromised. In any event, I'd recommend anyone who has a PC visible to the net to block this address. So far it's the only one in that block I've seen. I've got 24 entries in my blacklist. > -----Original Message----- > From: Jeremy Turner > > > On Fri, October 29, 2004 10:17 am, Brian Densmore said: > > OrgTechHandle: ZU20-ARIN > > OrgTechName: USDA - Office of the ChiefInformation Officer > > OrgTechPhone: +1-970-295-5277 > > OrgTechEmail: Network.Operations(a)usda.gov > > So they really are out to get you? =) > > That or some cracker is using zombie software to do the dirty work. > > Jeremy

2 1

RE: really cheap domain name sale
by Brian Kelsay 29 Oct '04

29 Oct '04

Whoops. You're right. It's .info. I guess the one I read before that one was .name. I was confoosed. To get the $1.00 deal, see the info below. Find your .INFO Domain Now! http://registrar.godaddy.com/default.asp?isc=gdf100781&tld=%2EINFO Prefer to order by phone? Call 1-480-505-8821 to order. Please be sure to mention offer code gdf100781 when calling. As an aside, you can opt-out of the promo mail/spam from them, but then you miss out on deals like this. Up to you. Brian Kelsay >>> "Gene Dascher" <gedascher(a)multiservice.com> 10/15/04 10:47AM >>> Hmmm, did you get an email about this? I just checked a few minutes ago and saw the special on the .biz domains, but not on the .name domains. They did have a $1.95 special on .info domains however.

3 3

here is a paragraph from the microsoft 2004 annual report
by David Nicol 29 Oct '04

29 Oct '04

http://www.davidnicol.com/October2004/microsoft_challenged.htm -- David L Nicol transportation infrastructure technology contracting since 2002

8 10

RE: OT RE: long sig
by Brian Kelsay 29 Oct '04

29 Oct '04

Brian, there was a reenactment of the invasion of Morocco in that movie I mentioned. They killed pretty much the whole Moroccan army in that battle. The US Marines swarmed into the palace and took the king/sultan into custody. I didn't watch the whole movie, so I'm a bit fuzzy on the why and the outcome. Something to do with the taking of some American hostages (women and children) by the king/sultan's brother (played by Sean Connery) on the mainland in Tangiers. This was also at the time Teddy was running for reelection, I think. He was also preparing to start the Panama Canal or it was just underway. The first machine gun had been invented (similar to Gatling gun) and it had a part in the invasion on both sides. The king/sultan had a prototype delivered just prior to the attack, but it jammed or ran out of ammo at some point. Brian Kelsay >>> "Brian Densmore" <> 10/26/04 02:59PM >>> I think you're thinking of Teddy's Rough Riders and the charge up San Juan Hill. He wasn't president then. It was however one of the greatest acts of stu<bs><bs><bs>bravery the current age has seen. > -----Original Message----- > From: Jonathan Hutchins > > Didn't we invade Morocco or something like that?

6 5

RE: Cron
by Brian Densmore 28 Oct '04

28 Oct '04

Ok thanks everyone for the responses. Some questions and clarifications. Where is the cron log? I don't see one specifically for cron. How would I add logging to the script? According to the way I read the crontab entry, the script should be called by the run-parts script as root. If this is the case then it should have rights to write to the file. Yes, I'm still rather new at scripting and cron. I'm only using cat grep and awk in the script and all paths are fully qualified. The file that the script is writing to is set up exactly like the log files in /var/log. I had considered making it world writtable for debugging, but that wouldn't solve my problem, because I want to lock it down. So I guess I need to figure out "who" is running cron jobs, although I thought it was root. ------------------------------------------------------------ /etc/crontab # /etc/crontab: system-wide crontab # Unlike any other crontab you don't have to run the `crontab' # command to install the new version when you edit this file. # This file also has a username field, that none of the other crontabs do. SHELL=/bin/sh PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin # m h dom mon dow user command 25 6 * * * root test -e /usr/sbin/anacron || run-parts --report /etc/cron.daily 47 6 * * 7 root test -e /usr/sbin/anacron || run-parts --report /etc/cron.weekly 52 6 1 * * root test -e /usr/sbin/anacron || run-parts --report /etc/cron.monthly # ---------------------------------------------------- My holding blacklist file particulars of import rw-r--r-- root.adm /etc/illegalips.txt > -----Original Message----- > From: Jonathan Hutchins > > May I suggest you develop some logging or error reporting > that shows you if > the script is getting called? > -----Original Message----- > From: Dan > > Just a guess, but cron doesn't know about your $PATH > -----Original Message----- > From: John M Geiger > > what is the setting in your /etc/crontab file for running daily > jobs? I have to believe the script is being kicked off by cron but, > as someone else has noted, may have a PATH problem or other > environmental variable problem of some sort. > > Or, just to make sure, the ID that your blacklist script runs > under does have permission to update the blacklist hold file, right?

5 4

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

KCLUG