Discuss

discuss@lists.centos.org

34758 discussions

dictonary attacks
by PA 11 Nov '10

11 Nov '10

Hi hoping someone can help me a little with this one. I have 2 mail servers, the incoming mail server runs dovecot and the outgoing mail server runs postfix with sasl. Lately I noticed a lot of spammers are running dictionary attacks on my incoming server and then using that user/password for sasl on the outgoing server. The weird thing is I never see on the logs the guessed username/password. I always see the ones they can't guess. For example: Looking at the logs I see the following dictionary attack from 94.242.206.37 Nov 10 03:04:38 pop dovecot: pop3-login: Disconnected: rip=94.242.206.37, lip=209.213.66.10 Nov 10 03:04:38 pop dovecot: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=209.213.66.10 rip=94.242.206.37 resp=<hidden> Nov 10 03:04:38 pop dovecot: auth(default): shadow(aarhus,94.242.206.37): lookup Nov 10 03:04:38 pop dovecot: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=209.213.66.10 rip=94.242.206.37 resp=<hidden> Nov 10 03:04:38 pop dovecot: auth(default): shadow(abaft,94.242.206.37): lookup Nov 10 03:04:38 pop dovecot: auth(default): shadow(abaft,94.242.206.37): unknown user Nov 10 03:04:38 pop dovecot: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=209.213.66.10 rip=94.242.206.37 resp=<hidden> Nov 10 03:04:38 pop dovecot: auth(default): shadow(aarhus,94.242.206.37): unknown user Nov 10 03:04:38 pop dovecot: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=209.213.66.10 rip=94.242.206.37 resp=<hidden> Nov 10 03:04:38 pop dovecot: auth(default): shadow(aaron,94.242.206.37): lookup Nov 10 03:04:38 pop dovecot: auth(default): shadow(aaron,94.242.206.37): unknown user Nov 10 03:04:38 pop dovecot: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=209.213.66.10 rip=94.242.206.37 resp=<hidden> Nov 10 03:04:38 pop dovecot: auth(default): shadow(ababa,94.242.206.37): lookup ..... And so on.. Then that ip gets banned by fail2ban [root@pop ~]# grep 94.242.206.37 /var/log/fail2ban.log 2010-11-10 03:04:42,416 fail2ban.actions: WARNING [dovecot] Ban 94.242.206.37 However on my outgoing mail server that ip is already sending out all sorts of spam with the sasl username of Paramus. This username Paramus never shows up on the dovecot dictionary attack log, as a matter of fact the user Paramus is nowhere to be found on the dovecot log at all and I have logs going back months. /var/log/maillog:Nov 10 02:46:16 mrelay3 postfix/smtpd[27776]: 3B64928015: client=unknown[94.242.206.37], sasl_method=LOGIN, sasl_username=paramus /var/log/maillog:Nov 10 02:47:54 mrelay3 postfix/smtpd[27776]: 247AB28016: client=unknown[94.242.206.37], sasl_method=LOGIN, sasl_username=paramus /var/log/maillog:Nov 10 02:48:00 mrelay3 postfix/smtpd[27785]: 87DE128016: client=unknown[94.242.206.37], sasl_method=LOGIN, sasl_username=paramus /var/log/maillog:Nov 10 02:56:00 mrelay3 postfix/smtpd[27792]: 9728628015: client=unknown[94.242.206.37], sasl_method=LOGIN, sasl_username=paramus /var/log/maillog:Nov 10 03:05:38 mrelay3 postfix/smtpd[27808]: D529F28015: client=unknown[94.242.206.37], sasl_method=LOGIN, sasl_username=paramus /var/log/maillog:Nov 10 03:06:00 mrelay3 postfix/smtpd[27808]: DDF7C2801B: client=unknown[94.242.206.37], sasl_method=LOGIN, sasl_username=Paramus Does anyone have any idea what could of happened here. I mean if the user/passwd was already harvested by 94.242.206.37 why would they bother to start another dict. attack. I'm just not sure how they guess the username/password as its not on any logs that goes back months and I don't have a dovecot fail record for that user on the logs. This is the case all the time for me and it happens with other ips. Any help would be appreciated. paul

2 2

Fwd: ntp help
by tony.chamberlain＠lemko.com 11 Nov '10

11 Nov '10

Hello I am trying to sync via NTP locally (since I have no Internet access). None of the NTP stuff I read on the net seems to work right. I mean it works fine setting up a client going to something like 0.pool.ntp.org but when I want to make my LInux box a server, and I do an ntpdate to it from another machine, it says no suitable server found. I have tried every possible combination of restrict, broadcast, multicast. Followed directions in the examples but nothing works. Also "iptables-save" shows no iptables stuff set at all, so there is no firewall blocking it. Maybe I could ask my question and someone could tell me how to configure? There are 4 machines: 1. 10.5.1.50 2. 10.5.0.20 / 192.168.1.100 3. 10.6.1.50 4. 10.6.0.20 / 192.168.1.101 The 10.5s cannot reach the 10.6s (except roundaboutly through the 192 network). The two 192 machines are connected directly to each other. You can get back and forth between them I want to set it up so that, and it doesn't matter which way), one of the 191.168.1.X machines NTP syncs to the other, and then the 10.5.1.50 syncs to 10.5.0.20 and the 10.6.1.20 syncs to 10.6.0.20. How do I set the ntp.conf files? Remember there is no external internet on any of the machines, and the 10.5 machines cannot reach the 10.6 machines and v.v. (except the 10.X.0.20 machines can reach each other through the 192 network). Also I am not allowed to use the 192 machines as routers for the 10.X.1.50 machines. Thanks

3 2

RHEL Released
by William Warren 11 Nov '10

11 Nov '10

It's on their website right now.

2 1

flash-plugin crashes on full screen
by Rob Kampen 11 Nov '10

11 Nov '10

Hi List. doing my weekly updates with yum last night installed kernel.x86_64 2.6.18-194.17.4.el5.centos.plus and flash-plugin.i386 10.1.102.64-release now today as I go to watch a movie from hulu.com it crashes the flash-plugin whenever I try to go full screen. Anyone else notice this behaviour? I guess I'll try to downgrade flash and see if that fixes the problem. TIA

4 7

kerboros and nfs v4
by m.roth＠5-cent.us 10 Nov '10

10 Nov '10

My mamnager's trying to get nfs v4 working with kerboros. One major issue is that we do *not* have access to the server, or ktadmin - that's the network folks, and they have AD on the other side. The result is that he can't create (if I have this right) objects. I found <http://sadiquepp.blogspot.com/2009/02/how-to-configure-nfsv4-with-kerberos-…>, and he says he's done everything and more. Any pointers, suggestions, etc? mark

2 1

Need advice trying to load ethernet firmware for kickstart
by Spiro Harvey 10 Nov '10

10 Nov '10

I've got a memory stick that I use to install systems. It's basically just has a simple isolinux setup on it that calls up the kickstart files from an http server and pulls down the distro via our online repo. However, I'm trying to get a standard automated install like this on an IBM box which has a Broadcom NetXtreme 2 NIC that requires firmware to be there on bootup. I've got the file, and I've added it into the directory that I think it should be in (/lib/firmware/bnx2) on the initrd.img. However, when the system boots, it identifies the NICs on one of the console screens, but borks and won't boot properly. On console 1: GRUB boots, I get menu, choose option. Kernel loads initrd.img loads anaconda starts loads usb-storage module borks with: """ loader received SIGSEGV! Backtrace [0xf00bar] ... etc install exited normally [1/1] """ sends termination signals, unmounts everything, and halts ("You may safely reboot") On console screen 3: last few items are loading bnx2 module, insert module, remove usb-storge from modprobe.conf, and finally "getting kickstart file" On screen 4: detects storge devices and BNX2 NICs It seems to be crapping out when it tries to do the network access, but I've got nothing more I can trace the problem with. There's no shell yet. So I can't figure out if I've put the firmware in the wrong place, given it the wrong permissions (dirs are 755 and .fw file is 644) but whether that even matters because the source files are on a FAT16 partition, I don't know. It could just not be loading it, or the file could be corrupt. So how do I go about debugging this? Or am I doing it wrong? Any advice or pointers greatly appreciated. Thanks. -- Spiro Harvey Knossos Networks Ltd (04) 460-2531 : (021) 295-1923 www.knossos.net.nz

1 0

Re: [CentOS] flash-plugin crashes on full screen
by brett mm 10 Nov '10

10 Nov '10

>> now today as I go to watch a movie from hulu.com it crashes the >> flash-plugin whenever I try to go full screen. On Fedora 13, some versions of Flash crashed when fullscreen button was clicked, if the user also had nvidia drivers installed. The workaround was to right click on the flash video content (before switching to fullscreen), unticking "enable hardware acceleration" then clicking fullscreen. Might be worth a try. Brett.

3 2

Re: [CentOS] CentOS Digest, Vol 70, Issue 10
by Frans Rosslee 10 Nov '10

10 Nov '10

I listened to your email using DriveCarefully and will respond as soon as I can. Download DriveCarefully for free at www.drivecarefully.com Sent via my BlackBerry from Vodacom - let your email find you!

3 2

CentOS-announce Digest, Vol 69, Issue 5
by centos-announce-request＠centos.org 10 Nov '10

10 Nov '10

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2010:0839 Moderate CentOS 5 i386 kernel Update (Karanbir Singh) 2. CESA-2010:0839 Moderate CentOS 5 x86_64 kernel Update (Karanbir Singh) ---------------------------------------------------------------------- Message: 1 Date: Tue, 9 Nov 2010 22:40:43 +0000 From: Karanbir Singh <kbsingh(a)centos.org> Subject: [CentOS-announce] CESA-2010:0839 Moderate CentOS 5 i386 kernel Update To: centos-announce(a)centos.org Message-ID: <20101109224043.GA10138(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2010:0839 Moderate Upstream details at : https://rhn.redhat.com/errata/RHSA-2010-0839.html The following updated files have been uploaded and are currently syncing to the mirrors: ( md5sum Filename ) i386: d121c43f4c192a0d57f3a914ff9d5e62 kernel-2.6.18-194.26.1.el5.i686.rpm df72e94d0c64ebc4719fbe2321c3aa17 kernel-debug-2.6.18-194.26.1.el5.i686.rpm e8a473a5489412c52bc234c5592a5846 kernel-debug-devel-2.6.18-194.26.1.el5.i686.rpm b1bc156cbc685de1d5987ab0e68ec1ed kernel-devel-2.6.18-194.26.1.el5.i686.rpm 98854bc0cc91c508eb1886b54baf8101 kernel-doc-2.6.18-194.26.1.el5.noarch.rpm 6e9e8c55cb7ca9721342937a42a12bec kernel-headers-2.6.18-194.26.1.el5.i386.rpm 1ef86e848ec5804fdbfc1e8cacfc1753 kernel-PAE-2.6.18-194.26.1.el5.i686.rpm 3f17d764da86ce8ff192d6bfde59a862 kernel-PAE-devel-2.6.18-194.26.1.el5.i686.rpm f1a492c80a81ce80a3a1d190a7299679 kernel-xen-2.6.18-194.26.1.el5.i686.rpm fd2dd0907c7730bda802152ff460126b kernel-xen-devel-2.6.18-194.26.1.el5.i686.rpm Source: d3b4f0593f5f8c2ab2f436549b7e6347 kernel-2.6.18-194.26.1.el5.src.rpm -- Karanbir Singh CentOS Project { http://www.centos.org/ } irc: z00dax, #centos(a)irc.freenode.net ------------------------------ Message: 2 Date: Tue, 9 Nov 2010 22:40:44 +0000 From: Karanbir Singh <kbsingh(a)centos.org> Subject: [CentOS-announce] CESA-2010:0839 Moderate CentOS 5 x86_64 kernel Update To: centos-announce(a)centos.org Message-ID: <20101109224044.GA10154(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2010:0839 Moderate Upstream details at : https://rhn.redhat.com/errata/RHSA-2010-0839.html The following updated files have been uploaded and are currently syncing to the mirrors: ( md5sum Filename ) x86_64: 960beaa2770d2d0607ff426fbe936f82 kernel-2.6.18-194.26.1.el5.x86_64.rpm 00e18cf5f435e198d83c419e3d8c7d53 kernel-debug-2.6.18-194.26.1.el5.x86_64.rpm ba1cd10ff374a4beaec8de1c6090e3b0 kernel-debug-devel-2.6.18-194.26.1.el5.x86_64.rpm 18d005a14e65e7b7779698e89a30ff42 kernel-devel-2.6.18-194.26.1.el5.x86_64.rpm c7a10fd5410f4997f78371757681bc43 kernel-doc-2.6.18-194.26.1.el5.noarch.rpm 2fd1f1e9466c96372d0bc6bff59ebd8e kernel-headers-2.6.18-194.26.1.el5.x86_64.rpm 21675572616e9cc3d3c8cdebc9c03e60 kernel-xen-2.6.18-194.26.1.el5.x86_64.rpm 3a98cb4aed00e182ff8986c8ce6d3b5f kernel-xen-devel-2.6.18-194.26.1.el5.x86_64.rpm Source: d3b4f0593f5f8c2ab2f436549b7e6347 kernel-2.6.18-194.26.1.el5.src.rpm -- Karanbir Singh CentOS Project { http://www.centos.org/ } irc: z00dax, #centos(a)irc.freenode.net ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org http://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 69, Issue 5 **********************************************

1 0

Re-export an NFS mount from another machine for roaming profiles
by Nicolas Kovacs 10 Nov '10

10 Nov '10

Hi, In my office I have a server running CentOS 5.5. I have Apache+PHP+MySQL running on that server, and I'm exporting /var/www/html, so I can mount it on my main desktop with NFS. Server : grossebertha Desktop : babasse [root@babasse:~] # mount /dev/sda3 on / type ext4 (rw) proc on /proc type proc (rw) sysfs on /sys type sysfs (rw) devpts on /dev/pts type devpts (rw,gid=5,mode=620) tmpfs on /dev/shm type tmpfs (rw) /dev/sda1 on /boot type ext2 (rw) /dev/sdb1 on /Disque2 type ext4 (rw) none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw) sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw) grossebertha:/var/www/html on /home/kikinovak/Sites type nfs (rw,rsize=8192,wsize=8192,timeo=14,intr,addr=192.168.1.252) Now I'm thinking about configuring a few roaming profiles here with NIS/NFS, using 'babasse' as my main machine. In that case, I would export babasse's full /home to the local network, and then configure authentication with NIS. I wonder if it can be a problem when one of the directories, in that case /home/kikinovak/Sites, is already an NFS mount. I can't really figure it out, but I guess I vaguely fear some situation similar to the one displayes in "Being John Malkovich", where John Malkovich enters the secret trapdoor to his own thoughts. Thought I'd better ask before doing something silly. Cheers, Niki -- http://www.kikinovak.net

3 2

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss