Discuss February 2010

discuss@lists.centos.org

273 participants
231 discussions

saslauthd attack
by John Hinton 11 Feb '10

11 Feb '10

I'm seeing a lot of activity over the last two days with what looks to be a kiddie script. Mostly trying to access several of our servers with the username anna. All failed... in fact I don't think we have a user anna on any of our servers. Meanwhile... I'm running Sendmail. This pertains to Centos 4 and 5 servers. I'm also running fail2ban on some and Ossec on others. So far, no blocking is being done. When I look at the logs all I find is under messages and here is a sample: Feb 10 05:23:08 neptune saslauthd[3370]: do_auth : auth failure: [user=anna] [service=smtp] [realm=] [mech=shadow] [reason=Unknown] Feb 10 05:23:25 neptune saslauthd[3369]: do_auth : auth failure: [user=anna] [service=smtp] [realm=] [mech=shadow] [reason=Unknown] Feb 10 05:23:58 neptune saslauthd[3370]: do_auth : auth failure: [user=anna] [service=smtp] [realm=] [mech=shadow] [reason=Unknown] Feb 10 06:56:53 neptune saslauthd[3370]: do_auth : auth failure: [user=anna] [service=smtp] [realm=] [mech=shadow] [reason=Unknown] Feb 10 06:56:54 neptune saslauthd[3368]: do_auth : auth failure: [user=anna] [service=smtp] [realm=] [mech=shadow] [reason=Unknown] Feb 10 06:56:55 neptune saslauthd[3370]: do_auth : auth failure: [user=anna] [service=smtp] [realm=] [mech=shadow] [reason=Unknown] Feb 10 06:56:59 neptune saslauthd[3368]: do_auth : auth failure: [user=anna] [service=smtp] [realm=] [mech=shadow] [reason=Unknown] So, I can't write a rule to block this attack as I can't find any IP address to block. I've looked and googled til my eyes are red and can't find where to set logging in saslauthd or where ever it needs to be set to record the IP address generating these failures. Does anyone have an idea? Also, some may wish to do a grep 'do_auth' on messages to see if this is happening to you. They sometimes come in rapid succession. John Hinton

5 6

Syslog for chroot-jailed SFTP users?
by Sean Carolan 11 Feb '10

11 Feb '10

Maybe one of you can help. We have set up a CentOS server so that each user who logs in via sftp will be jailed in their home directory. Here's the relevant sshd_config: # override default of no subsystems Subsystem sftp internal-sftp -f LOCAL2 -l INFO Match Group sftponly ChrootDirectory /home/%u ForceCommand internal-sftp This actually works great, but none of the activities of sftponly group members is getting logged. The man page for sftp-server says: "For logging to work, sftp-server must be able to access /dev/log. Use of sftp-server in a chroot configuation therefore requires that syslogd(8) establish a logging socket inside the chroot directory." How do I establish a logging socket inside the chroot directory, when the chroot directory is different depending on which user is logging in at any given time? I don't want to run separate sockets in every customer's chroot directory, this is not practical. Any ideas?

3 5

Re: [CentOS] saslauthd attack
by Les Bell 11 Feb '10

11 Feb '10

John Hinton wrote: >> Yes... most of them. Just the new PITA. Anyway... I still can't seem to figure out how to log the IP addresses for this attack. << I'd use iptables to log connections on that port and then time-correlate with the log entries from saslauthd. Best, --- Les Bell [http://www.lesbell.com.au] Tel: +61 2 9451 1144

1 0

CentOS-announce Digest, Vol 60, Issue 2
by centos-announce-request＠centos.org 10 Feb '10

10 Feb '10

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2010:0088 Important CentOS 5 x86_64 kvm Update (Karanbir Singh) 2. CESA-2010:0094 Critical CentOS 4 i386 HelixPlayer - security update (Tru Huynh) 3. CESA-2010:0094 Critical CentOS 4 x86_64 HelixPlayer - security update (Tru Huynh) ---------------------------------------------------------------------- Message: 1 Date: Tue, 9 Feb 2010 13:51:39 +0000 From: Karanbir Singh <kbsingh(a)centos.org> Subject: [CentOS-announce] CESA-2010:0088 Important CentOS 5 x86_64 kvm Update To: centos-announce(a)centos.org Message-ID: <20100209135139.GA22305(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2010:0088 Important Upstream details at : http://rhn.redhat.com/errata/RHSA-2010-0088.html The following updated files have been uploaded and are currently syncing to the mirrors: ( md5sum Filename ) x86_64: 79704ae0e59d7ca2c76c96e087fe94b7 kmod-kvm-83-105.el5_4.22.x86_64.rpm 1e848a0873b1d28fe87945202e8ea483 kvm-83-105.el5_4.22.x86_64.rpm be5796fe492fcb764c5ffd0b662298ba kvm-qemu-img-83-105.el5_4.22.x86_64.rpm ca27435ea4a07209579fc9518901a2c7 kvm-tools-83-105.el5_4.22.x86_64.rpm Source: f5b9b0b74caf41a66786f047cb2e17e8 kvm-83-105.el5_4.22.src.rpm -- Karanbir Singh CentOS Project { http://www.centos.org/ } irc: z00dax, #centos(a)irc.freenode.net ------------------------------ Message: 2 Date: Tue, 9 Feb 2010 18:22:40 +0100 From: Tru Huynh <tru(a)centos.org> Subject: [CentOS-announce] CESA-2010:0094 Critical CentOS 4 i386 HelixPlayer - security update To: centos-announce(a)centos.org Message-ID: <20100209172240.GA13104(a)sillage.bis.pasteur.fr> Content-Type: text/plain; charset="us-ascii" CentOS Errata and Security Advisory CESA-2010:0094 HelixPlayer security update for CentOS 4 i386: https://rhn.redhat.com/errata/RHSA-2010-0094.html The following updated file has been uploaded and is currently syncing to the mirrors: i386: updates/i386/RPMS/HelixPlayer-1.0.6-1.el4_8.1.i386.rpm source: updates/SRPMS/HelixPlayer-1.0.6-1.el4_8.1.src.rpm You may update your CentOS-4 i386 installations by running the command: yum update HelixPlayer Tru -- Tru Huynh (mirrors, CentOS-3 i386/x86_64 Package Maintenance) http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xBEFA581B

1 0

sendmail mail relay backscatter issue.
by Simon Billis 10 Feb '10

10 Feb '10

Hi Folks, I have a couple of questions which I hope that you will be able to assist with, first some background. I run a few sendmail servers that run MailScanner/Spamassassin/sendmail (current versions) on Centos 5.4 and Centos 4.8 These boxes accept mail for a large number of domains (6000+) scan the mail removing spam and then forward the ham to another server for delivery. I am attempting to stop any backscatter that these servers cause by only accepting mail for specific users@domain or for domains with a catch-all account. I currently use /etc/mail/access.db as the access map for the domains, but this allows all mail to be accepted for the domain before the attempting to send it on for final delivery which causes NDR and backscatter for those domains which do not have a catch-all account. I have looked at adding "To:user@domain RELAY" to the access map and also adding "define(`_RELAY_FULL_ADDR_', `1') " in the sendmail.mc and running make -C /etc/mail but this has no effect on the sendmail.cf file. My understanding is that if I can get sendmail to accept this undocumented feature then all will be fine as I will be able to use the access map to allow mail to those specific users as well as entries of the type "domain RELAY". My first question is: Does anyone have any ideas as to why I wouldn't be able to have this change reflected in sendmail.cf? My second question is: Does anyone have any ideas on how to utilise access map and relay-domains to achieve the same thing? Thanks for your time and assistance. Simon.

4 23

Re: [CentOS] R package on centos 5.1
by Les Bell 10 Feb '10

10 Feb '10

hersh parikh <hershparikh12(a)yahoo.com> wrote: >> I want to install R package on centos 5.1, however I am not able to install it << I'm running it here on Centos 5.4. What problem are you having? Error messages? Best, --- Les Bell [http://www.lesbell.com.au] Tel: +61 2 9451 1144

1 0

Lightscribe
by Robert 10 Feb '10

10 Feb '10

I just bought an HP DVD Writer 1040r (as identified by k3b), an external USB-connected CD/DVD burner. The drive gets assigned /dev/scd0. I can burn CDs and DVDs, read from CDs and DVDs, boot from DVDs (and, I assume, CDs) but have been unable to use the lightscribe software to label a disk. I have lightscribe-1.18.11.1-0 and lightscribeApplications-1.18.6.1-0 installed, can run the GUI at /opt/lightscribe/Applications/SimpleLabeler/SimpleLabeler which promptly and stubbornly tells me "--<no lightscribe drives found>--". This IS a lightscribe drive, according to the specs, the box and the logo on the tray. This is on a fully update CentOS 5.4 system that has behaved very well since I built this box (Gigabyte MA770T-UD3P) about 3-4 months ago. This is certainly no a critical situation but having new stuff that doesn't work is rather irksome to me. Can anyone offer a clue or two? Thanks!

3 3

best parallel / cluster SSH
by Alan McKay 09 Feb '10

09 Feb '10

Hey folks, I stumbled upon this while looking for something else http://www.linux.com/archive/feature/151340 And it is something I could actually really make use of. But right on that site they list 3 different ones, and so I'm wondering what all is out there and what I should use. Is there one that is part of the standard CentOS? thanks, -Alan -- “Don't eat anything you've ever seen advertised on TV” - Michael Pollan, author of "In Defense of Food"

14 26

xentop batch mode
by Nux 09 Feb '10

09 Feb '10

Hi guys, First of all, sorry to send this one here on the centos ml. I know it's kind of off-topic, but the xen-users list seems a dead end, I was hoping some of you guys are experienced in this. I have a problem with a xen 3.4.2 on Centos 5 x86_64 installation, I need to see the total/used/available memory of dom0 when using xentop, however in batch mode it doesn't seem to work. If I use the normal mode of xentop I get all that info nicely, however in batch mode it looks like this: http://bayimg.com/mAkNEAace A friend of mine told me that the memory info I need gets displayed on Centos 5 stock xen versions when running xentop in batch mode. Anyone can tell me what is going on? What am I missing? Is there any other way I can obtain that info? The xen is installed from gitco.de/repo/, should it matter. The kernel is 2.6.18-164. Thanks. -- Nux! www.nux.ro

3 2

Using (was: Announcing) Gluster Storage Platform
by Alan McKay 09 Feb '10

09 Feb '10

OK, you have my attention. But reading around on the website for 5 or 10 minutes and I'm still not sure what this is. What is it? Why would I use it? What would I use instead of it? (Who are its competitors) When would I not use it? I see this "The software is a powerful and flexible solution that simplifies the task of managing unstructured file data", but I have no idea what "unstructured file data" means. -- “Don't eat anything you've ever seen advertised on TV” - Michael Pollan, author of "In Defense of Food"

6 6

← Newer
1
...
12
13
14
15
16
17
18
...
24
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss February 2010