Discuss

discuss@lists.centos.org

34753 discussions

Re: [CentOS] How to tell if I've been hacked?
by J.Witvliet＠MINDEF.NL 23 Aug '09

23 Aug '09

-----Original Message----- From: centos-bounces(a)centos.org [mailto:centos-bounces@centos.org] On Behalf Of Ryan Pugatch Sent: Wednesday, August 19, 2009 5:23 AM To: CentOS mailing list Subject: Re: [CentOS] How to tell if I've been hacked? Christopher Chan wrote: > Scott Ehrlich wrote: >> There is a lot of talk about the vulnerable Linux kernel. I'm simply >> wondering the telltale signs if a given system has been hacked? >> What, specifically, does a person look for? >> > > rpm -Va is a good start for modified binaries/libraries. > rootkit detectors is another thing you can try. > > > Other than that, it is checking your logs and looking for odd files > lying around... > Also, processes running that you don't recognize. Users you don't recognize. Logged in sessions that you don't recognize. Free space shrinking abnormally. An increase in bandwidth usage that is unexpected. Ryan Also processes you thinkk you DO recognize: Just for testing how alert my co-workers were, i had a program called "kswapd", just calculating prime-numbers... They never noticed. ;-) Without any preperation it's harder. No point in installing tripwire, activating apparmor/selinux afterwards. Those things should be done after a fresh installation. ______________________________________________________________________ Dit bericht kan informatie bevatten die niet voor u is bestemd. Indien u niet de geadresseerde bent of dit bericht abusievelijk aan u is toegezonden, wordt u verzocht dat aan de afzender te melden en het bericht te verwijderen. De Staat aanvaardt geen aansprakelijkheid voor schade, van welke aard ook, die verband houdt met risico's verbonden aan het elektronisch verzenden van berichten. This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. The State accepts no liability for damage of any kind resulting from the risks inherent in the electronic transmission of messages.

3 2

transfer file for window
by ann kok 22 Aug '09

22 Aug '09

Hi What is the best way to transfer file for window via internet ls samba doing it? thank you __________________________________________________________________ Looking for the perfect gift? Give the gift of Flickr! http://www.flickr.com/gift/

2 1

Schnitzer, Ted is out of the office.
by Ted_Schnitzer＠vrtx.com 22 Aug '09

22 Aug '09

I will be out of the office starting 08/21/2009 and will not return until 09/02/2009. In my absence please contact Dave Lowenstein for UNIX/Linux technical issues. Please contact Kim Richardson for management issues. Thanks, Ted

2 1

how to get mail stats for a single email address, on an Exim mail server?
by Rudi Ahlers 22 Aug '09

22 Aug '09

Hi, Can someone please tell me how to get the stats for a single email address, and all the addresses on a certain domain? -- Kind Regards Rudi Ahlers CEO, SoftDux Hosting Web: http://www.SoftDux.com Office: 087 805 9573 Cell: 082 554 7532

2 1

CentOS-announce Digest, Vol 54, Issue 9
by centos-announce-request＠centos.org 22 Aug '09

22 Aug '09

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CentOS 4 i386 and x86_64 updates (Johnny Hughes) 2. CentOS 4 i386 and x86_64 release of CentOS-4.8 (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Fri, 21 Aug 2009 17:35:28 -0500 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CentOS 4 i386 and x86_64 updates To: CentOS-Announce <centos-announce(a)centos.org> Message-ID: <4A8F2130.40205(a)centos.org> Content-Type: text/plain; charset="iso-8859-1" The following updates have been released along with the CentOS 4.8 release (for i386 and x86_64). Individual announcements will not be made for these updates. Advisory Synopsis Date CESA-2009:1218 Critical: pidgin security update 2009-08-18 CESA-2009:1219 Important: libvorbis security update 2009-08-18 CEEA-2009:1214 tzdata enhancement update 2009-08-17 CESA-2009:1209 Moderate: curl security update 2009-08-13 CESA-2009:1211 Important: kernel security update 2009-08-13 CESA-2009:1203 Important: subversion security update 2009-08-10 CESA-2009:1204 Moderate: apr and apr-util security 2009-08-10 CESA-2009:1206 Moderate: libxml and libxml2 security 2009-08-10 CEEA-2008:0274 new package: para-virtualized drivers 2009-08-03 CESA-2009:1184 Critical: nspr and nss security 2009-07-30 CESA-2009:1180 Important: bind security and bug fix 2009-07-29 CEBA-2009:1175 strace bug fix update 2009-07-27 CESA-2009:1177 Moderate: python security update 2009-07-27 CEBA-2009:1174 openldap bug fix update 2009-07-23 CESA-2009:1162 Critical: firefox security update 2009-07-21 CESA-2009:1163 Critical: seamonkey security update 2009-07-21 CESA-2009:1159 Moderate: libtiff security update 2009-07-16 CESA-2009:1136 Critical: dhcp security update 2009-07-14 CEBA-2009:1149 rsh bug fix update 2009-07-10 CESA-2009:1139 Moderate: pidgin security update 2009-07-02 CESA-2009:1140 Moderate: ruby security update 2009-07-02 CESA-2009:1132 Important: kernel security update 2009-06-30 CESA-2009:1134 Important: seamonkey security update 2009-06-30 CEBA-2009:1129 lvm2 bug-fix update 2009-06-25 CESA-2009:1125 Moderate: thunderbird security update 2009-06-25 CESA-2009:1127 Critical: kdelibs security update 2009-06-25 CESA-2009:1116 Important: cyrus-imapd security update 2009-06-18 CEEA-2009:1105 tzdata enhancement update 2009-06-16 CESA-2009:1107 Moderate: apr-util security update 2009-06-16 CESA-2009:1100 Moderate: wireshark security update 2009-06-15 CESA-2009:1101 Moderate: cscope security update 2009-06-15 CESA-2009:1095 Critical: firefox security update 2009-06-11 CESA-2009:1096 Critical: seamonkey security update 2009-06-11 CEEA-2009:1086 Updated rpmdb-redhat package 2009-06-09 CESA-2009:1083 Important: cups security update 2009-06-03 CESA-2009:1066 Important: squirrelmail security update 2009-05-26 CESA-2009:0329 Important: freetype security update 2009-05-22 CESA-2009:1060 Important: pidgin security update 2009-05-22 Please see this link for more info about each update: http://rhn.redhat.com/errata/rhel4as-errata.html Thanks, Johnny Hughes

1 0

protecting multiuser systems from bruteforce ssh attacks
by Eugene Vilensky 22 Aug '09

22 Aug '09

Hello, What is the best way to protect multiuser systems from brute force attacks? I am setting up a relatively loose DenyHosts policy, but I like the idea of locking an account for a time if too many attempts are made, but to balance this with keeping the user from making a helpdesk call. What are some policies/techniques that have worked for this list with minimal hassle? Thanks! -Eugene

10 11

how to check the MD5 sums ISO directory
by Michael Wright 22 Aug '09

22 Aug '09

Ok guys How do i check MD5 SUM in the ISO Directory Mike

3 2

ned help on downloading
by Michael Wright 22 Aug '09

22 Aug '09

Pentium(R) D CPU 2.80Ghz 3 GB of Ram 250 Gb harddrive i not sure if i'm downloading the right one here as my mechine runs on 1386 scale could someone help us ouit to see if i am downloading the right one Mike CentOS-5.3-i386-bin-DVD.iso

2 2

tar and gunzip help
by ML 21 Aug '09

21 Aug '09

HI All, I have a directory tree that when the user un-gzips/untars it does into /opt by default. The directory tree is like: ugui | |-- <misc files> |-- source |-----framework |------ <misc files> so when unzipped I want to end it with /opt/ugui and all the stuff below it. How do I do this? Can I also issue one command that will unzip and untar the archive at the same time? (I know I can, I just cant get it right) Thanks! -ML

5 4

CentOS 5.3 Anaconda nic device ordering
by Mark Watts 21 Aug '09

21 Aug '09

I have a bunch of HP BL465c G5 blades, with additional dual-port network adapters. The onboard interfaces use the bnx2 driver, while the expansion card uses tg3. All 4 interfaces are detected by both Anaconda and the installed system, but Anaconda is reversing the ordering: Anaconda: eth0 Card 2, Port 1 eth1 Card 2, Port 2 eth2 Card 1, Port 1 eth3 Card 1, Port 2 BIOS and Installed Kernel: eth0 Card 1, Port 1 eth1 Card 1, Port 2 eth2 Card 2, Port 1 eth3 Card 2, Port 2 The main problem I have is that the ifcfg-eth* files have the wrong HWADDR lines in them for the actual network cards. dmesg shows the interfaces in the correct order. I've tried, unsuccessfully to use the "device eth bnx2:tg3" syntax within my kickstart file, as suggested here: http://fedoraproject.org/wiki/Anaconda/NetworkIssues#Mixed_NIC_Cards_and_Dr… If I just use the device line in my kickstart, this doesn't appear to have any effect on the device ordering at all, and using "noprobe nonet" just stops anything from being detected at all. Is there any way to get anaconda to load the drivers in a different order on CentOS 5.3? Mark. -- Mark Watts BSc RHCE MBCS Senior Systems Engineer, Managed Services Manpower www.QinetiQ.com QinetiQ - Delivering customer-focused solutions GPG Key: http://www.linux-corner.info/mwatts.gpg

2 1

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss