KCLUG

kclug@kclug.org

10 participants
3254 discussions

OT: Cymor/Evil_machine
by Thomas Bruno 26 Oct '04

26 Oct '04

Chris Bier (Cymor/Evil_machine) was in a motorcycle accedent on sunday, and is going to have surgury today for a open fractur on his arm. I was told he was ok, and that his helmet only had a few scratches, and his body armor wasn't damaged at all. He's been sitting in the hospital. I don't know what hospital or anything yet. Tom (crweb/allyourrejects)

1 3

RE: spamassassin question [with blacklist question]
by Jeremy Turner 25 Oct '04

25 Oct '04

This should have gone to kclug too.. On Mon, October 25, 2004 5:04 pm, Brian Densmore said: > My only problem here is sometimes I need to use 'cut -d\ -f11' and sometimes > 'cut -d\ f12'. Sometimes I have to do both in the same file. So I guess it's time > to pull out the sed pocket reference I have and learn something in there to help. Nah... you're crying out for Perl =) #--------------------------------------------------------------- #!/usr/bin/perl $my_ip = "192.168.0.1"; %seen = (); # get input from stdin while (<>) { # illegal = no username # failed = wrong password if (/Failed/ || /Illegal/) { # match an ip address /(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/; if ($my_ip !~ $1) { $seen{$1}++; } } } @ips = sort keys %seen; foreach (@ips) { print "$_\n"; } #----------------------------------------------------------- The "Failed" and "Illegal" words are lines you would check to contain IP addresses. The hash table is to knock out duplicate IP addresses. Jeremy -- Jeremy Turner <jeremy(a)linuxwebguy.com> Linux Tips and News! ---> http://linuxwebguy.com

1 0

RE: spamassassin question
by Brian Densmore 25 Oct '04

25 Oct '04

Spelling counts. Spamassassin now running and email coming in. I still have some frozen email, but only because it's really malformed spam, from Russia with love. It's not blocking all spam though, going to have to look at upgrading it, but not to crazy about mixing "stable" and "testing" on a "in the wild" server. Now I can update my howto for spamassassin. > -----Original Message----- > From: Jeremy Turner > > > On Mon, October 25, 2004 1:28 pm, Brian Densmore said: > > Also, you can run: > > # exim -v -qff > > and it'll force frozen messages to thaw and attempt to > deliver/relay them, > giving you feedback as it goes. > >

2 1

RE: spamassassin question
by Brian Densmore 25 Oct '04

25 Oct '04

Thanks for the link. Seems I forgot to start spamd and needed to add a transport and a director to exim. Now to let it run for a while and see what happens. I'm also running spamhous RBL on it, but it's not catching very many of the spams. I may also have to upgrade my spamassassin to a newer version, according to the link you sent. Right now I'm hoping I didn't break anything, because there are some frozen messages on the system. > -----Original Message----- > From: Jeremy Turner > > > On Mon, October 25, 2004 11:48 am, Brian Densmore said: > > Ok today, I tried something to get spamassassin working on my box. > > > > The mail arrived in the regular mailbox, but I got this message > > back from the server: > > > [SNIP] > > So what have I done wrong here? Does the "rescue" message > > mean it sent it without filtering, and that is why I got the mail? > > > > my .forward looks like this for the time being: > > |/usr/bin/procmail > > /home/brian/Maildir > > > > I may have to do some tweaking in my ~/.procmailrc file, > but it looks like > > procmail is functioning, but I need to tweak spamassassin. > > I'm confused... is exim sending your mail through the .forward file > mechanism to procmail who then sends it to spamassassin? > What version of > exim do you have? > > There are some good writeups on how to integrate spamassassin > and exim at: > http://dman13.dyndns.org/~dman/config_docs/exim-spamassassin > > I think the stock install of exim3 or exim4 on debian will > check for the > procmailrc file and attempt to run that before it looks for a .forward > file, so you might not even need that step. > > Jeremy

2 1

spamassassin question
by Brian Densmore 25 Oct '04

25 Oct '04

Ok today, I tried something to get spamassassin working on my box. The mail arrived in the regular mailbox, but I got this message back from the server: ************************************ This message was created automatically by mail delivery software (Exim). A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address(es) failed: pipe to |/usr/bin/procmail generated by brian(a)amason.net The following text was generated during the delivery attempt: ------ pipe to |/usr/bin/procmail generated by brian(a)amason.net ------ Could not lock /home/brian/Maildir/: File exists at /usr/share/perl5/Mail/SpamAssassin/NoMailAudit.pm line 381. procmail: Program failure (70) of "/usr/bin/spamassassin" procmail: Rescue of unfiltered data succeeded *********************************** So what have I done wrong here? Does the "rescue" message mean it sent it without filtering, and that is why I got the mail? my .forward looks like this for the time being: |/usr/bin/procmail /home/brian/Maildir I may have to do some tweaking in my ~/.procmailrc file, but it looks like procmail is functioning, but I need to tweak spamassassin. "The President is merely the most important among a large number of public servants. He should be supported or opposed exactly to the degree which is warranted by his good conduct or bad conduct, his efficiency or inefficiency in rendering loyal, able, and disinterested service to the Nation as a whole. Therefore it is absolutely necessary that there should be full liberty to tell the truth about his acts, and this means that it is exactly necessary to blame him when he does wrong as to praise him when he does right. Any other attitude in an American citizen is both base and servile. To announce that there must be no criticism of the President, or that we are to stand by the President, right or wrong, is not only unpatriotic and servile, but is morally treasonable to the American public. Nothing but the truth should be spoken about him or any one else. But it is even more important to tell the truth, pleasant or unpleasant, about him than about any one else." --Theodore Roosevelt, Kansas City Star, May 7, 1918

2 1

OT: Sun Micro tech needed -From Monster.com
by Oren Beck 24 Oct '04

24 Oct '04

OT : Job for Sun Micro tech . <http://jobsearch.monster.com/getjob.asp?JobID=24838138> Oren www.campdownunder.com

1 0

RE: It was bound to happen - suspected hack
by aaron hirsch 22 Oct '04

22 Oct '04

I'd modify the hosts.allow file a bit more... i.e. sshd: localhost 192.168.0.0/255.255.255.0 12.30.163.* ALL:ALL:DENY This is a "catch-all" that is a best practice just incase the hosts.deny is misconfigured or not configured at all, although the ALL:ALL in your hosts.deny is correct. It will deny access to all services that tcpd monitors to everything as a last resort. Hence, if it's not explicitly defined to be allowed, it is by default denied. Just an idea... -----Original Message----- From: Jon Moss [mailto:jon.moss@cnonline.net] Sent: Thursday, October 21, 2004 7:03 AM To: kclug(a)kclug.org Subject: Re: It was bound to happen - suspected hack I've been researching sshd and allowing/denying access and I think I have figured it out. Just please confirm that I'm on the right track. I edited my hosts.allow as follows: # # hosts.allow This file describes the names of the hosts which are # allowed to use the local INET services, as decided # by the '/usr/sbin/tcpd' server. # sshd: localhost 192.168.0.0/255.255.255.0 12.30.163.* And then my hosts.deny as follows: # # hosts.deny This file describes the names of the hosts which are # *not* allowed to use the local INET services, as decided # by the '/usr/sbin/tcpd' server. # # The portmap line is redundant, but it is left to remind you that # the new secure portmap uses hosts.deny and hosts.allow. In particular # you should know that NFS uses portmap! ALL : ALL However, I don't really have anyway to test this as I allowed access from everywhere that I am. :) Any suggestions and advice is still greatly appreciated. -- Thanks very much, Jon Moss jon.moss(a)cnonline.net _______________________________________________ Kclug mailing list Kclug(a)kclug.org http://kclug.org/mailman/listinfo/kclug

4 4

Who's going to man the booth at ITEC?
by Chris Bier 22 Oct '04

22 Oct '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi All, ~ So, who's going to man the booth at ITEC? I'm going to try and be there for one of the days. Chris - -- I digitally sign my emails. If you see an attachment with .asc, then that means your email client doesn't support PGP digital signatures. http://www.gnupg.org/(en)/documentation/faqs.html#q1.1 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBdzbdE5xXU3JS1mQRAhOaAJ0QWwYBzjoOwlrTKMWm6ySqGfzdqQCghVPa /FS5JWSA7PY638AW+qZM8oY= =PyUv -----END PGP SIGNATURE-----

3 2

RE: Who's going to man the booth at ITEC?
by djgoku 21 Oct '04

21 Oct '04

I can on Thursday 8-2, what do we need to bring or get. JO On Wed, 20 Oct 2004 23:12:33 -0500, Chris Bier <chris.bier(a)cymor.com> wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hi All, > ~ So, who's going to man the booth at ITEC? I'm going to try and be > there for one of the days. > > Chris > - -- > I digitally sign my emails. If you see an attachment with .asc, then > that means your email client doesn't support PGP digital signatures. > http://www.gnupg.org/(en)/documentation/faqs.html#q1.1 > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.2.4 (GNU/Linux) > Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org > > iD8DBQFBdzbdE5xXU3JS1mQRAhOaAJ0QWwYBzjoOwlrTKMWm6ySqGfzdqQCghVPa > /FS5JWSA7PY638AW+qZM8oY= > =PyUv > -----END PGP SIGNATURE----- > _______________________________________________ > Kclug mailing list > Kclug(a)kclug.org > http://kclug.org/mailman/listinfo/kclug > -- dj_goku -www.djgoku.com- -www.tektronic.org- -- dj_goku -www.djgoku.com- -www.tektronic.org-

3 2

RE: It was bound to happen - suspected hack
by Jon Moss 21 Oct '04

21 Oct '04

That's what I found in the config file comments. I'm implementing it now. Thanks again - Jon > > You can (and should) accomplish this in /etc/ssh/sshd_config via: > PermitRootLogin no > > Dustin > -- Thanks very much, Jon Moss jon.moss(a)cnonline.net

2 1

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

KCLUG