KCLUG

kclug@kclug.org

5 participants
3240 discussions

Blocking IPs from the FW [was RE: spamassassin question [with blacklist question]]
by Brian Densmore 26 Oct '04

26 Oct '04

By the way, anyone have a take on what kind of performance hit this will take on a server? So far I have 22 addresses or address ranges blocked in my blacklist. And is there a better way? Most of the attempts have been to try to gain root access via ssh, which root isn't allowed to ssh anyway, so this would always fail. Some are for non-existent users. Brian Densmore > -----Original Message----- > From: Brian Densmore > > Well you were right about sed. Not something I could do with sed. > I wound up using awk, and temporarily putting the addresses > in a separate file > until I feel comfortable it won't jack up my firewall. > > #!/bin/sh > > # list of ip address to allow always > MYIP=yyy.yyy.yyy.yyy > MYIP2=xxx.xxx.xxx.xxx > > # name of logfile to scan - need to variablize so I can call > it with an alternate > # logfile and default to this > lfl=/var/log/auth.log > > # ugly all on one line, but it works > cat $lfl | grep -i failed\ password | awk '{ print $11 }' > |uniq | grep -v $MYIP | grep -v $MYIP2 >> /etc/illegalips.txt > > # still to do add commands to extract ips from above file > # and add to actual blacklist and call firewall restart > > > > http://kclug.org/mailman/listinfo/kclug > > > _______________________________________________ > Kclug mailing list > Kclug(a)kclug.org > http://kclug.org/mailman/listinfo/kclug >

2 1

RE: spamassassin question [with blacklist question]
by Brian Densmore 26 Oct '04

26 Oct '04

Well SA 2.2 is catching about 155 of my spam. I may add some customization to see if I can't improve it a bit. I'll wait a bit before upgrading. I'd really like to block it up front. > -----Original Message----- > From: D. Joe Anderson [mailto:kclug@etrumeus.com] > Sent: Tuesday, October 26, 2004 12:54 PM > To: KCLUG > Subject: Re: spamassassin question [with blacklist question] > > > On Mon, Oct 25, 2004 at 05:54:17PM -0500, Brian Kelsay wrote: > > Brian, since this is a Debian system, why not use > apt-pinning for Spam > > Assassin to get the version from testing? What does Spam Assassin > > depend on? If it doesn't need the latest and greatest of a > bunch of > > pkgs., then you shouldn't have much problem. e.g. if it depends on > > Python, but doesn't need the latest. > > http://www.agnula.org/download/demudi/apt_pinning/view > > http://jaqque.sbih.org/kplug/apt-pinning.html > > Or, for that matter, if it can use i386 packages, why not > pull a > newer spamassassin out of http://www.backports.org? > > > -- > Joe > > > _______________________________________________ > Kclug mailing list > Kclug(a)kclug.org > http://kclug.org/mailman/listinfo/kclug >

2 1

OT RE: long sig (was: PostNuke site cracked)
by Brian Densmore 26 Oct '04

26 Oct '04

Wrong Roosevelt! ;') This is the one responsible for the National Park System. And the Boone & Crockett Club. We had no wars during his presidency, probably everyone was scared sh****** of the guy (just kiddin'). > -----Original Message----- > From: Brian Kelsay > > Brian, I nominate you for Longest .sig. This also works for > one of my theories; Roosevelt was a blow-hard. It's quite > possible that the House and Senate agreed w/ his plans out of > sheer boredom and a fight-flight instinctual response. Lucky > for us that the war finally encouraged investment from the > people in charge of spending real and borrowed money. > <flame-retardant suit on> > > Brian Kelsay > > >>> "Brian Densmore" <> 10/26/04 12:34PM >>> > > "The President is ..... > than about any one else." > > --Theodore Roosevelt, Kansas City Star, May 7, 1918 > >

2 1

RE: spamassassin question [with blacklist question]
by Leonard, Phil 26 Oct '04

26 Oct '04

You might want to add some of the spamassassin rules from here http://www.rulesemporium.com/rules.htm . The RulesDuJour script works very well for me. Philip -----Original Message----- From: kclug-bounces(a)kclug.org [mailto:kclug-bounces@kclug.org]On Behalf Of Brian Densmore Sent: Tuesday, October 26, 2004 1:33 PM To: KCLUG Subject: RE: spamassassin question [with blacklist question] Well SA 2.2 is catching about 155 of my spam. I may add some customization to see if I can't improve it a bit. I'll wait a bit before upgrading. I'd really like to block it up front. > -----Original Message----- > From: D. Joe Anderson [mailto:kclug@etrumeus.com] > Sent: Tuesday, October 26, 2004 12:54 PM > To: KCLUG > Subject: Re: spamassassin question [with blacklist question] > > > On Mon, Oct 25, 2004 at 05:54:17PM -0500, Brian Kelsay wrote: > > Brian, since this is a Debian system, why not use > apt-pinning for Spam > > Assassin to get the version from testing? What does Spam Assassin > > depend on? If it doesn't need the latest and greatest of a > bunch of > > pkgs., then you shouldn't have much problem. e.g. if it depends on > > Python, but doesn't need the latest. > > http://www.agnula.org/download/demudi/apt_pinning/view > > http://jaqque.sbih.org/kplug/apt-pinning.html > > Or, for that matter, if it can use i386 packages, why not > pull a > newer spamassassin out of http://www.backports.org? > > > -- > Joe > > > _______________________________________________ > Kclug mailing list > Kclug(a)kclug.org > http://kclug.org/mailman/listinfo/kclug > _______________________________________________ Kclug mailing list Kclug(a)kclug.org http://kclug.org/mailman/listinfo/kclug

1 0

OT RE: long sig (was: PostNuke site cracked)
by Brian Kelsay 26 Oct '04

26 Oct '04

You're right! I had started to snooze by the time I got to the end there. Maybe it was a trait of all Roosevelts. I do like most of what I read about Teddy, but sometimes he was over the top and too cavalier. He is lucky he was successful in most of what he took on. I saw an old Sean Connery movie, "The Wind and the Lion," a few weeks ago. Brian Keith was playing Teddy. I don't think the Secret Service would allow a lot of what he did to go on today. I did think it was cool that Teddy was testing the new Henry repeating rifles and making/demanding changes to the design. Back then, campaigns were run from train cars on whistle-stop tours. Brian Kelsay >>> "Brian Densmore" <> 10/26/04 01:06PM >>> Wrong Roosevelt! ;') This is the one responsible for the National Park System. And the Boone & Crockett Club. We had no wars during his presidency, probably everyone was scared sh****** of the guy (just kiddin').

1 0

RE: spamassassin question [with blacklist question]
by Brian Densmore 26 Oct '04

26 Oct '04

I happen to like apache 1.3 and see no problems with the 2.4 kernel. The SA version in stable is 2.2 so it's quite out of date. Then there is exim using version 3.36. The thing I like about stable is that the security patches happen first in stable. Having been hacked once, I tend to be a bit more conservative these days (*and by the way, I've also been seeing a lot of those scripted hack attacks). At least where my "production" software is concerned. At home I run testing/unstable. Not sure how I accomplished that, but there it is. * I've added some code to my firewall rules to read in my personal blacklisted ipaddresses from a file and make drop rules out of it. Now I need to write a little script to put in cron to scan my logs once a day and extract ip-addresses that are attempting to login and add them to the blacklist and restart the firewall. something like: MYADDR=xxx.xxx.xxx.xxx BLACKLIST=/etc/blacklist.txt FWSCRIPT=/etc/init.d/firewall.sh cat /var/log/auth.log |grep -i failed\ password | cut -d\ -f11 |uniq > nuiq.txt if [ -e nuiq.txt ] then while read ipaddr do if [ $ipaddr ne $MYADDR ] ; then echo $ipaddr >> $BLACKLIST fi done < nuiq.txt $FWSCRIPT restart fi My only problem here is sometimes I need to use 'cut -d\ -f11' and sometimes 'cut -d\ f12'. Sometimes I have to do both in the same file. So I guess it's time to pull out the sed pocket reference I have and learn something in there to help. It's because of the way the date is being posted to the log file: Oct 9 ... Oct 10 ... So I get one extra delimiter when the date has one digit. I'd also like to be able to skip the saving of the list to a file step. Alas my script skill are insufficient for the task. Also I might soon need to use a case or some other control method to ignore perhaps a half a dozen ipaddresses or even a range of ipaddresses for other users of the system. Brian > -----Original Message----- > From: Jeremy Turner > > I said the heck with it and pinned my server on sarge. It'll > be the new > stable soon enough. I can't stand SA 2.4 or whatever is in > stable, same > with 2.4 kernel, Apache 1.3, etc. > > Jeremy > > -- > Jeremy Turner <jeremy(a)linuxwebguy.com> > Linux Tips and News! ---> http://linuxwebguy.com > >

3 2

OT: long sig (was: PostNuke site cracked)
by Brian Kelsay 26 Oct '04

26 Oct '04

Brian, I nominate you for Longest .sig. This also works for one of my theories; Roosevelt was a blow-hard. It's quite possible that the House and Senate agreed w/ his plans out of sheer boredom and a fight-flight instinctual response. Lucky for us that the war finally encouraged investment from the people in charge of spending real and borrowed money. <flame-retardant suit on> Brian Kelsay >>> "Brian Densmore" <> 10/26/04 12:34PM >>> "The President is ..... than about any one else." --Theodore Roosevelt, Kansas City Star, May 7, 1918

1 0

PostNuke site cracked
by Brian Densmore 26 Oct '04

26 Oct '04

Anyone who downloaded PostNuke between Sunday and Tuesday need to get rid of it and re-download it. Their site was cracked and an altered PostNuke download posted. http://www.newsforge.com/article.pl?sid=04/10/26/1356232 Brian "The President is merely the most important among a large number of public servants. He should be supported or opposed exactly to the degree which is warranted by his good conduct or bad conduct, his efficiency or inefficiency in rendering loyal, able, and disinterested service to the Nation as a whole. Therefore it is absolutely necessary that there should be full liberty to tell the truth about his acts, and this means that it is exactly necessary to blame him when he does wrong as to praise him when he does right. Any other attitude in an American citizen is both base and servile. To announce that there must be no criticism of the President, or that we are to stand by the President, right or wrong, is not only unpatriotic and servile, but is morally treasonable to the American public. Nothing but the truth should be spoken about him or any one else. But it is even more important to tell the truth, pleasant or unpleasant, about him than about any one else." --Theodore Roosevelt, Kansas City Star, May 7, 1918

1 0

CD Labels
by Bill Cavalieri 26 Oct '04

26 Oct '04

ok ready to print the knoppix labels now, who has the final KCLUG label? I have 50 Suse 9.1 Live CDS, and 100 knoppix cds (50 stable, 50 unstable), and if wife doesn't smack me too much will have mr roboto do 50-100 more. -Bill

1 0

RE: We got an ITEC Booth!
by Brian Kelsay 26 Oct '04

26 Oct '04

In all seriousness, if that is possible from me, you should probably wear business casual. Slacks or Docker type pants and a collared shirt like a Polo. Or nice jeans if you want to be a bit more comfortable. Like Dustin said, there is always the possibility of an on-the-spot job interview to consider. Just don't embarrass yourself before you get a chance to talk to someone with the ability to hire. If you are comfortably employed, then break out the bunny slippers and Cafe Press "Linux Rox" thong. Damn, I knew I couldn't do it. ;-) Brian Kelsay >>> "Dustin Decker" <> 10/26/04 10:06AM >>> > I am going to wear jeans and a black Think Geek Tux polo, my only > request (not that I am anybody mind you its just my opinion) is that > we not wear shorts/flip-flops. > > There is already a stigma that Linux users are the geeks, weirdos and > odd balls that live in the basement of our mothers house - so if we at > least present a semi-working friendly appearance, maybe we can (in a > small way I know) make a better first initial impression. I tend to agree. I know Hal Duston generally does the suit and tie for an engagement such as this... and is all the better for it if interviewed on T.V.

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

KCLUG