KCLUG

kclug@kclug.org

3239 discussions

Tier 3 Support Shirts
by Bill Cavalieri 02 Nov '04

02 Nov '04

Last meeting after the meeting, we talked about needing Tier 3 shirts. No markup on price. Front left pocket area says: "TIER 3" Back centered says: "I'm not ingnoring you, I'm TIER 3" Long Sleeve Tee-shirt $18.99 http://www.cafepress.com/lumensoftware.14176963 Sweatshirt $20.99 http://www.cafepress.com/lumensoftware.14177111

1 0

"lsof -o" under Linux
by Gerald Combs 02 Nov '04

02 Nov '04

Does anyone know if it's possible to make lsof (or any other utility) print file descriptor offsets under Linux? It seems like this ought to work, it being 2004 and all.

3 3

RE: Cron
by Brian Densmore 02 Nov '04

02 Nov '04

Thanks all for the suggestions. Here's my latest update. Cron is not running the script in the cron.daily directory. I'm using Vixie cron. Cron is running the root crontab I created for it, but I really wanted it to be part of the system cron jobs. So, now I have the script working and running, but I would like to figure out why the system cron job is not running. Anyone?

1 0

re: ndiswrapper
by Jonathan Hutchins 02 Nov '04

02 Nov '04

As I understand it, there is the potential for 802.11g cards to disrupt, or at least use, frequencies that are used by the military. Manufactureres have, according to rumor, been pressured not to release information that would allow users to select these frequencies. Open Source software does not provide any means for manufacturers to do this, and aparantly locking down the available frequencies in the hardware is impractical. This is just rumor - I have seen no confirmation that there has been any pressure on the manufacturers, nor can I confirm that this potential is anythnig more than an excuse to stick to a propietary model. That said, http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/Linux.Wireless.drivers… Lists two 802.11g device driver projects, the Prism54 driver at http://prism54.org/ and the Intell IPW2200 at http://ipw2200.sourceforge.net/. A little searching finds the prism-based Tekram TM-802G available from pcbay.com at $22.98 shipped. This article says that Intel is releasing Linux drivers for it's Centrino platform: http://news.zdnet.co.uk/software/linuxunix/0,39020390,39156340,00.htm Here's an article from someone who picked up a prism based Netgear WG511 for $35 a year ago - gotta be cheaper now: http://toys.lerdorf.com/archives/15-802.11g-Netgear-WG511-and-Linux.html So it's just a matter of putting in the effort to find one that works, even if you really want 11g speed for $25.

3 2

newly arrived on list
by Bailey, Michael L [NTK] 01 Nov '04

01 Nov '04

Hello, I just joined the list. Hoping to attend some meetings. The downtown KC library is a beautiful place. Linux has been good to me. I had worked my way through customer service positions in Sprint in Florida (operator, repair clerk, various kinds of service rep) Got interested in Linux in 1996 and spent a few hundred dollars on books for this free software, learning a lot about computers. Sprint in 96-97 paid for me to take a Unix class (SCO!) and I got a CCNA through self-study with no hands-on. Partly on the strength of those credentials I got a promotion in 2000 into the ATAC testing trouble tickets here in Kansas. Not a 1-to-1 mapping of skills, but the UNIX and Linux pay off in many ways. This past February I got into PCS translations, and am currently on loan to Physical Layer Provisioning working on dial-ip disconnects. I consider my interest in Linux the main factor in migrating from customer service to more technical positions. It's nice to read Paul Taylor's notification of a job opening up in Security - though I can't do a normal job bid till February. I'd make the leap in a minute, though, especially if I could get a night shift...maybe something will come up later. (If one were thinking of that move, would free time be better invested in re-certifying the CCNA which ran out in 2003 or in other lines of study?) Currently only have a Knoppix live CD and have been doing only some minor playing on a low-end PC. Have installed over the years and fooled with Red Hat, Slackware, FreeBSD, Debian. Getting geared up to try Linux from Scratch but keep getting distracted by home improvement projects (my wife and I live with our 2 cats and 3-legged black Lab in a little 1920's vintage home with numerous opportunities for that) Sorry to ramble on like this. All of the people I've met through Linux have been really nice, so I hope you'll pardon my verbosity. I'm looking forward to contributing something to the group, if I can. Despite having played with GNU/Linux since 1997, I can't claim that my skills are world-class, but I'd like to learn more. Have a nice day, Michael Bailey

3 2

RE: Crackers and correlations
by Brian Densmore 01 Nov '04

01 Nov '04

I get this type of attack also. The latest one is different in both the length of time spent on it and the distinct characteristic of only attempting to gain root access. By all indications, this was a scripted attack. The port numbers used seemed to follow a general upward trend with a pseudo-random reset to a lower port. I'm sure there are multiple scripts for running brute force attacks of this kind. I expect the scripted attacks to grow ever more sophisticated over time, as there is definitely a professional bent to system cracking these days. I do have a question for y'all. Is there some non-crippling thing I can do to my system to detect an attack and : 1) send me an email (optionally), 2) log the conversation for xxx seconds, 3) automatically update the firewall to block the offending user/script. Keep in mind I'm running on an antique here: Pentium Pro 200 MHz @ 40MB RAM w/ ~8 GB of disk. P.S. - I have an email and phone call in to the good people at the USDA and will update you all on anything I may find out. Assuming they will ever admit that one of their PCs has been compromised. > -----Original Message----- > From: Dustin Decker . > > I've been seeing a lot of traffic that behaves in similar > fashion, across > sensors deployed on various ISP's for which the only common > link is being a > client of mine, and the attacks. I (and more importantly my > clients) stay > off the radar pretty well, so I am inclined to think this is > a scripted > process, executed after a root-kit is installed etc. to further the > conquest. > > If you watch the behavior, and the ascending port numbers, it > looks more and > more like I am correct. What I find interesting is the > sources change over > time, and then we see the script trying an even larger number > of user names. > > Another reference point - I see this a lot more on roadrunner > clients than > any others. Someone is ramping up for something, looking for launch > platforms is my guess. Anyone interested in seeing the > entire conversations > (rather than the logged info below) can drop me an e-mail and I will > obfuscate things and offer 'em up. Due to confidentiality > clauses in my > contracts, I will have to munge the IPs that I am protecting, > and make a > mess of the checksums etc. >

6 10

OT: Entry level Sprint job
by Paul Taylor 30 Oct '04

30 Oct '04

If anyone is interested in an entry level position at Sprint within Corporate Security. Starting pay is around $30,000 per year (more if you have experience, but 99.99% sure nobody will) and it's an hourly wage job so overtime may be available based on business needs. http://careers.sprint.com/joblist.html Job list 187197 The *Electronic Surveillance Analyst I* is responsible for implementing, troubleshooting and maintaining court-ordered electronic surveillance, call record delivery, handset location tracking and overall support to law enforcement. The Electronic Surveillance Analyst will also provide law enforcement assistance for surveillance system outages and in emergency situations involving Sprint communication services. Based on seniority, the Analyst will require either weekend, evening or overnight shift coverage to provide 24-hour support to law enforcement agencies.

1 0

pictures
by mike＠handuma.com 30 Oct '04

30 Oct '04

Pictures from itech and the hospital. http://www.handuma.com/itech/hospital.jpg http://www.handuma.com/itech/itech.jpg http://www.handuma.com/itech/itech1.jpg http://www.handuma.com/itech/itech2.jpg http://www.handuma.com/itech/itech3.jpg http://www.handuma.com/itech/itech4.jpg http://www.handuma.com/itech/itech5.jpg http://www.handuma.com/itech/itech6.jpg handuma http://www.handuma.com

6 8

Graphic for CD Labels from last year's ITEC
by Chris Bier 30 Oct '04

30 Oct '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Who had the nice graphic for CD Labels from last year's ITEC? Chris - -- I digitally sign my emails. If you see an attachment with .asc, then that means your email client doesn't support PGP digital signatures. http://www.gnupg.org/(en)/documentation/faqs.html#q1.1 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBeCfrE5xXU3JS1mQRAjKwAKDSt3/nNrLgl6/woar0ccrgRBu0sgCgxB2E wfXHTlAWeR/cPpiikDaVxSY= =+p5n -----END PGP SIGNATURE-----

10 29

Crack attempt
by Brian Densmore 29 Oct '04

29 Oct '04

FYI. This guy spent two hours Thursday, 3am-5am, trying to break into my server's root account. 168.68.129.127 Dig says: ; <<>> DiG 2.1 <<>> @dns1.menandmice.is 168.68.129.127 A ; (1 server found) ;; res options: init recurs defnam dnsrch ;; got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 10 ;; flags: qr rd ra; Ques: 1, Ans: 0, Auth: 1, Addit: 0 ;; QUESTIONS: ;; 168.68.129.127, type = A, class = IN ;; AUTHORITY RECORDS: . 300 SOA A.ROOT-SERVERS.NET. NSTLD.VERISIGN-GRS.COM. ( 2004102900 serial 1800 refresh (30 mins) 900 retry (15 mins) 604800 expire (7 days) 86400 ) minimum (1 day) ;; Total query time: 2 msec ;; FROM: us.mirror.menandmice.com to SERVER: default -- 0.0.0.0 ;; WHEN: Fri Oct 29 09:09:57 2004 ;; MSG SIZE sent: 32 rcvd: 107 *********************************************************8 ARIN says: OrgName: USDA Office of Operations OrgID: UOO-2 Address: Suite 133, Building A Address: 2150 Centre Ave City: Fort Collins StateProv: CO PostalCode: 80526 Country: US NetRange: 168.68.0.0 - 168.68.255.255 CIDR: 168.68.0.0/16 NetName: PPQ NetHandle: NET-168-68-0-0-1 Parent: NET-168-0-0-0-0 NetType: Direct Assignment NameServer: NS1.USDA.GOV NameServer: NS2.USDA.GOV NameServer: NS3.USDA.GOV Comment: RegDate: 1994-01-26 Updated: 2003-04-30 OrgAbuseHandle: ZU20-ARIN OrgAbuseName: USDA - Office of the ChiefInformation Officer OrgAbusePhone: +1-970-295-5277 OrgAbuseEmail: Network.Operations(a)usda.gov OrgNOCHandle: ZU20-ARIN OrgNOCName: USDA - Office of the ChiefInformation Officer OrgNOCPhone: +1-970-295-5277 OrgNOCEmail: Network.Operations(a)usda.gov OrgTechHandle: ZU20-ARIN OrgTechName: USDA - Office of the ChiefInformation Officer OrgTechPhone: +1-970-295-5277 OrgTechEmail: Network.Operations(a)usda.gov # ARIN WHOIS database, last updated 2004-10-28 19:10 # Enter ? for additional hints on searching ARIN's WHOIS database.

3 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

KCLUG