Re: Advice needed, trying to find the vulnerable code on Debian webserver.

2004-06-14 Thread Jan Meijer
On Tue, 15 Jun 2004, Ross Tsolakidis wrote: > I'd appreciate some help on how to stop this from happening. Run something like aide so you can detect when it goes wrong (though there are some caveats it does not sound like they will hit you) and run a netflow-collector next to it, if you can. Tha

Re: Advice needed, trying to find the vulnerable code on Debian webserver.

2004-06-14 Thread s. keeling
Incoming from Ross Tsolakidis: > > One of our webservers seems to get compromised on a daily basis. > When I do a ps ax I see these processes all the time. > > 18687 ?S 0:00 shell > 18701 ?Z 0:00 [sh ] > 18704 ?T 0:00 ./3 200.177.162.185 1524 I vaguely reme

Advice needed, trying to find the vulnerable code on Debian webserver.

2004-06-14 Thread Ross Tsolakidis
Hi all, One of our webservers seems to get compromised on a daily basis. When I do a ps ax I see these processes all the time. 18687 ?S 0:00 shell 18701 ?Z 0:00 [sh ] 18704 ?T 0:00 ./3 200.177.162.185 1524 18705 ?Z 0:00 [3 ] And if I check the

Re: password managers

2004-06-14 Thread Russell Coker
On Tue, 15 Jun 2004 04:56, andrew lattis <[EMAIL PROTECTED]> wrote: > currently i've got an ever growing password list in a plain text file > stored on an encrypted loopback fs, this is getting cumbersome... > > figaro's password manager (package fpm) looks nice and uses blowfish to > encrypt data

Re: Advice needed, trying to find the vulnerable code on Debian webserver.

2004-06-14 Thread s. keeling
Incoming from Ross Tsolakidis: > > One of our webservers seems to get compromised on a daily basis. > When I do a ps ax I see these processes all the time. > > 18687 ?S 0:00 shell > 18701 ?Z 0:00 [sh ] > 18704 ?T 0:00 ./3 200.177.162.185 1524 I vaguely reme

Re: rbl's status?

2004-06-14 Thread Daniel Pittman
On 14 Jun 2004, Bernd Eckenfels wrote: > In article <[EMAIL PROTECTED]> you wrote: >> This sort of thing is why I would rather use any RBL within >> SpamAssassin, rather than at SMTP delivery time. Even if one of these >> services goes completely belly up and blacklists the world, I don't >> automa

Advice needed, trying to find the vulnerable code on Debian webserver.

2004-06-14 Thread Ross Tsolakidis
Hi all, One of our webservers seems to get compromised on a daily basis. When I do a ps ax I see these processes all the time. 18687 ?S 0:00 shell 18701 ?Z 0:00 [sh ] 18704 ?T 0:00 ./3 200.177.162.185 1524 18705 ?Z 0:00 [3 ] And if I check the

Re: password managers

2004-06-14 Thread Russell Coker
On Tue, 15 Jun 2004 04:56, andrew lattis <[EMAIL PROTECTED]> wrote: > currently i've got an ever growing password list in a plain text file > stored on an encrypted loopback fs, this is getting cumbersome... > > figaro's password manager (package fpm) looks nice and uses blowfish to > encrypt data

Re: rbl's status?

2004-06-14 Thread Daniel Pittman
On 14 Jun 2004, Bernd Eckenfels wrote: > In article <[EMAIL PROTECTED]> you wrote: >> This sort of thing is why I would rather use any RBL within >> SpamAssassin, rather than at SMTP delivery time. Even if one of these >> services goes completely belly up and blacklists the world, I don't >> automa

Re: password managers

2004-06-14 Thread Stephan Dietl
Hello! andrew lattis <[EMAIL PROTECTED]> schrieb: > what does everyone else use to keep track of all there passwords? Following an article of Martin Joey Schulze in a german magazine i send a mail with the password encryted for myself to me and use it via mutt. HTH, Ciao, Steve -- www.cargal

Re: password managers

2004-06-14 Thread Dale Amon
On Mon, Jun 14, 2004 at 02:56:15PM -0400, andrew lattis wrote: > what does everyone else use to keep track of all there passwords? Try gringotts. -- -- Dale Amon [EMAIL PROTECTED]+44-7802-188325 International linux systems con

Re: password managers

2004-06-14 Thread Stephan Dietl
Hello! andrew lattis <[EMAIL PROTECTED]> schrieb: > what does everyone else use to keep track of all there passwords? Following an article of Martin Joey Schulze in a german magazine i send a mail with the password encryted for myself to me and use it via mutt. HTH, Ciao, Steve -- www.cargal

Re: password managers

2004-06-14 Thread Dale Amon
On Mon, Jun 14, 2004 at 02:56:15PM -0400, andrew lattis wrote: > what does everyone else use to keep track of all there passwords? Try gringotts. -- -- Dale Amon [EMAIL PROTECTED]+44-7802-188325 International linux systems con

Re: password managers

2004-06-14 Thread sjk
We use PMS (http://passwordms.sourceforge.net), but I keep meaning to re-write parts of the code to make it multi-user freindly. On Mon, 14 Jun 2004, andrew lattis wrote: > currently i've got an ever growing password list in a plain text file > stored on an encrypted loopback fs, this is getting

Jari Heikkinen is out of the office.

2004-06-14 Thread jari . heikkinen
I will be out of the office starting 12.06.2004 and will not return until 27.06.2004. I am on holiday unti 28.6.04 and will read my email next time at 28.06.04. If you have urgent support matters, please email to [EMAIL PROTECTED] For other matters, please contact to Pasi Lindholm +35840730

password managers

2004-06-14 Thread andrew lattis
currently i've got an ever growing password list in a plain text file stored on an encrypted loopback fs, this is getting cumbersome... figaro's password manager (package fpm) looks nice and uses blowfish to encrypt data but i can't find anything showing any type of third party audit. what does e

Re: rbl's status?

2004-06-14 Thread Brian Thomas Sniffen
Bernd Eckenfels <[EMAIL PROTECTED]> writes: > In article <[EMAIL PROTECTED]> you wrote: >> This sort of thing is why I would rather use any RBL within >> SpamAssassin, rather than at SMTP delivery time. Even if one of these >> services goes completely belly up and blacklists the world, I don't >>

Re: rbl's status?

2004-06-14 Thread Matthew Whitworth
Bernd Eckenfels wrote: In article <[EMAIL PROTECTED]> you wrote: This sort of thing is why I would rather use any RBL within SpamAssassin, rather than at SMTP delivery time. Even if one of these services goes completely belly up and blacklists the world, I don't automatically lose mail from it

Re: Kernel Crash Bug????

2004-06-14 Thread Diego Alvarez
it does crash 2.6.6-1-686 On Mon, Jun 14, 2004 at 09:57:54AM -0700, peace bwitchu wrote: > Anyone have info on this one? > > > http://linuxreviews.org/news/2004-06-11_kernel_crash/index.html > > > > Peace > > > > > __ > Do you Yahoo!? >

Re: Kernel Crash Bug????

2004-06-14 Thread Philippe Troin
peace bwitchu <[EMAIL PROTECTED]> writes: > Anyone have info on this one? > > > http://linuxreviews.org/news/2004-06-11_kernel_crash/index.html Fixed by Linux here: http://linux.bkbits.net:8080/linux-2.5/diffs/include/asm-i386/[EMAIL PROTECTED]|src/.|src/include|src/include/asm-i386|hist/inc

Re: password managers

2004-06-14 Thread sjk
We use PMS (http://passwordms.sourceforge.net), but I keep meaning to re-write parts of the code to make it multi-user freindly. On Mon, 14 Jun 2004, andrew lattis wrote: > currently i've got an ever growing password list in a plain text file > stored on an encrypted loopback fs, this is getting

Jari Heikkinen is out of the office.

2004-06-14 Thread jari . heikkinen
I will be out of the office starting 12.06.2004 and will not return until 27.06.2004. I am on holiday unti 28.6.04 and will read my email next time at 28.06.04. If you have urgent support matters, please email to [EMAIL PROTECTED] For other matters, please contact to Pasi Lindholm +35840730

password managers

2004-06-14 Thread andrew lattis
currently i've got an ever growing password list in a plain text file stored on an encrypted loopback fs, this is getting cumbersome... figaro's password manager (package fpm) looks nice and uses blowfish to encrypt data but i can't find anything showing any type of third party audit. what does e

Re: rbl's status?

2004-06-14 Thread Brian Thomas Sniffen
Bernd Eckenfels <[EMAIL PROTECTED]> writes: > In article <[EMAIL PROTECTED]> you wrote: >> This sort of thing is why I would rather use any RBL within >> SpamAssassin, rather than at SMTP delivery time. Even if one of these >> services goes completely belly up and blacklists the world, I don't >>

Re: rbl's status?

2004-06-14 Thread Matthew Whitworth
Bernd Eckenfels wrote: In article <[EMAIL PROTECTED]> you wrote: This sort of thing is why I would rather use any RBL within SpamAssassin, rather than at SMTP delivery time. Even if one of these services goes completely belly up and blacklists the world, I don't automatically lose mail from it. Pl

Re: Kernel Crash Bug????

2004-06-14 Thread Diego Alvarez
it does crash 2.6.6-1-686 On Mon, Jun 14, 2004 at 09:57:54AM -0700, peace bwitchu wrote: > Anyone have info on this one? > > > http://linuxreviews.org/news/2004-06-11_kernel_crash/index.html > > > > Peace > > > > > __ > Do you Yahoo!? >

Kernel Crash Bug????

2004-06-14 Thread peace bwitchu
Anyone have info on this one? http://linuxreviews.org/news/2004-06-11_kernel_crash/index.html Peace __ Do you Yahoo!? Friends. Fun. Try the all-new Yahoo! Messenger. http://messenger.yahoo.com/

Re: Kernel Crash Bug????

2004-06-14 Thread Philippe Troin
peace bwitchu <[EMAIL PROTECTED]> writes: > Anyone have info on this one? > > > http://linuxreviews.org/news/2004-06-11_kernel_crash/index.html Fixed by Linux here: http://linux.bkbits.net:8080/linux-2.5/diffs/include/asm-i386/[EMAIL PROTECTED]|src/.|src/include|src/include/asm-i386|hist/inc

May Glover-Gunn/UK/IBM is out of the office.

2004-06-14 Thread May Glover-Gunn
I will be out of the office starting 12/06/2004 and will not return until 22/06/2004. I am out of the office on education in Oxford this week and will not be checking my email. For any EXITE queries, please contact Kirstin E Brownlee/UK/IBM or Natalie Hogan/UK/IBM. For any other urgent matt

Kernel Crash Bug????

2004-06-14 Thread peace bwitchu
Anyone have info on this one? http://linuxreviews.org/news/2004-06-11_kernel_crash/index.html Peace __ Do you Yahoo!? Friends. Fun. Try the all-new Yahoo! Messenger. http://messenger.yahoo.com/ -- To UNSUBSCRIBE, email to [EMAIL

May Glover-Gunn/UK/IBM is out of the office.

2004-06-14 Thread May Glover-Gunn
I will be out of the office starting 12/06/2004 and will not return until 22/06/2004. I am out of the office on education in Oxford this week and will not be checking my email. For any EXITE queries, please contact Kirstin E Brownlee/UK/IBM or Natalie Hogan/UK/IBM. For any other urgent matt

Powerful weightloss now available where you are.

2004-06-14 Thread Dino Floyd
Hello, I have a special offer for you... WANT TO LOSE WEIGHT? The most powerful weightloss is now available without prescription. All natural Adipren720 100% Money Back Guarantée! - Lose up to 19% Total Body Weight. - Up to 300% more Weight Loss while dieting. - Loss of 20-35% abdominal Fat. - Redu

Re: rbl's status?

2004-06-14 Thread Bernd Eckenfels
In article <[EMAIL PROTECTED]> you wrote: > This sort of thing is why I would rather use any RBL within > SpamAssassin, rather than at SMTP delivery time. Even if one of these > services goes completely belly up and blacklists the world, I don't > automatically lose mail from it. Please dont do t

Powerful weightloss now available where you are.

2004-06-14 Thread Dino Floyd
Hello, I have a special offer for you... WANT TO LOSE WEIGHT? The most powerful weightloss is now available without prescription. All natural Adipren720 100% Money Back Guarantée! - Lose up to 19% Total Body Weight. - Up to 300% more Weight Loss while dieting. - Loss of 20-35% abdominal Fat. - Redu

Mon, 14 Jun 2004 05:25:16 -0600

2004-06-14 Thread Debian-security-announce
Here is a casino giving away $25 Free when you sign up an account. No credit card required http://secret.cls2.org/iwin.html Damian

Re: rbl's status?

2004-06-14 Thread Bernd Eckenfels
In article <[EMAIL PROTECTED]> you wrote: > This sort of thing is why I would rather use any RBL within > SpamAssassin, rather than at SMTP delivery time. Even if one of these > services goes completely belly up and blacklists the world, I don't > automatically lose mail from it. Please dont do t

Mon, 14 Jun 2004 05:25:16 -0600

2004-06-14 Thread Debian-security-announce
Here is a casino giving away $25 Free when you sign up an account. No credit card required http://secret.cls2.org/iwin.html Damian

Re: rbl's status?

2004-06-14 Thread Dale Amon
On Mon, Jun 14, 2004 at 04:57:42PM +1000, Russell Coker wrote: > relays.ordb.org, reject_rhsbl_client rhsbl.sorbs.net, reject_rhsbl_client > dsn.rfc-ignorant.org, reject_rhsbl_client postmaster.rfc-ignorant.org Just to publicly eat my previous words... I submitted the request, had a *person* resp

Re: rbl's status?

2004-06-14 Thread Dale Amon
On Mon, Jun 14, 2004 at 04:57:42PM +1000, Russell Coker wrote: > a test message to [EMAIL PROTECTED] and it hasn't bounced yet... Maybe the > Yahoo abuse team are being butt-head's about clicking on the removal URL. Yeah, just I found I got listed by ignoramuses about RFC's due to a mail helper

Re: rbl's status?

2004-06-14 Thread Dale Amon
On Mon, Jun 14, 2004 at 04:57:42PM +1000, Russell Coker wrote: > relays.ordb.org, reject_rhsbl_client rhsbl.sorbs.net, reject_rhsbl_client > dsn.rfc-ignorant.org, reject_rhsbl_client postmaster.rfc-ignorant.org Just to publicly eat my previous words... I submitted the request, had a *person* resp

Re: rbl's status?

2004-06-14 Thread Dale Amon
On Mon, Jun 14, 2004 at 04:57:42PM +1000, Russell Coker wrote: > a test message to [EMAIL PROTECTED] and it hasn't bounced yet... Maybe the > Yahoo abuse team are being butt-head's about clicking on the removal URL. Yeah, just I found I got listed by ignoramuses about RFC's due to a mail helper

Re: rbl's status?

2004-06-14 Thread Russell Coker
On Mon, 14 Jun 2004 16:39, Adrian 'Dagurashibanipal' von Bidder <[EMAIL PROTECTED]> wrote: > Also you may want to look at the rfc-ignorant.org ones, but reading > nanae I got the impression that they are more trouble than they're > worth. This thread inspired me to fiddle with my anti-spam settin

Re: rbl's status?

2004-06-14 Thread Adrian 'Dagurashibanipal' von Bidder
On Sunday 13 June 2004 18.01, Dale Amon wrote: > What are the recommended rbl's these days? Just one opinion more: (ok, this is postfix syntax. But let's not start this war here :-) reject_rbl_client cbl.abuseat.org, reject_rbl_client list.dsbl.org, these are very good and catch

Re: rbl's status?

2004-06-14 Thread Vassilii Khachaturov
> Also, for Vassilii - you use the SpamCop blacklists. That is something > that I would be very nervous of. They have some pretty liberal policies > about what they accept, and their automatic tools are not that great at > filtering out innocent parties... > This is why on the primary MX (which I

Re: rbl's status?

2004-06-14 Thread Russell Coker
On Mon, 14 Jun 2004 16:39, Adrian 'Dagurashibanipal' von Bidder <[EMAIL PROTECTED]> wrote: > Also you may want to look at the rfc-ignorant.org ones, but reading > nanae I got the impression that they are more trouble than they're > worth. This thread inspired me to fiddle with my anti-spam settin