Re: Who changes /bin/ping on my system ?

2014-03-06 Thread Tim Ruehsen
On Tuesday 04 March 2014 09:16:15 Tim Ruehsen wrote: Does anybody know who or what changes my ping utility ? Is this a known bug (I couldn't find anything) ? I just found the package 'prelink' which explain the changes of my ping (and all other) binaries. I installed that ~10 years ago and

[SOLVED] Who changes /bin/ping on my system ?

2014-03-06 Thread Tim Ruehsen
I just found this: https://lists.debian.org/debian-qa-packages/2014/02/msg00132.html So I mark this issue as solved (I leave a copy of my initla mail down below for reference). Thanks again for all your help ! Tim On Tuesday 04 March 2014 09:16:15 Tim Ruehsen wrote: Hi, every now and

Re: Who changes /bin/ping on my system ?

2014-03-06 Thread Tim Ruehsen
On Tuesday 04 March 2014 12:33:16 Brian wrote: On Tue 04 Mar 2014 at 09:16:15 +0100, Tim Ruehsen wrote: # ls -la /bin/ping -rwxr-xr-x 1 root root 46672 01-02-14 22:18:43 /bin/ping The file size indicates this is /bin/ping6 (amd64 platform) Now I reinstalled iputils-ping: # ls -la

Re: Who changes /bin/ping on my system ?

2014-03-05 Thread Brian
On Wed 05 Mar 2014 at 10:37:44 +1100, Scott Ferguson wrote: There still remains the problem of why does it stop working. Bugreport? If the OP had an explanation for his /bin/ping in reality being /bin/ping6 it might lead to a reason for his /bin/ping(6) losing its capabilities. We then might

Re: Who changes /bin/ping on my system ?

2014-03-05 Thread Scott Ferguson
On 05/03/14 22:23, Brian wrote: On Wed 05 Mar 2014 at 10:37:44 +1100, Scott Ferguson wrote: There still remains the problem of why does it stop working. Bugreport? If the OP had an explanation for his /bin/ping in reality being /bin/ping6 it might lead to a reason for his /bin/ping(6)

Re: Who changes /bin/ping on my system ?

2014-03-05 Thread Scott Ferguson
Correction On 05/03/14 22:41, Scott Ferguson wrote: On 05/03/14 22:23, Brian wrote: On Wed 05 Mar 2014 at 10:37:44 +1100, Scott Ferguson wrote: snipped root@testing-jan20:~# getcap /bin/ping /bin/ping = cap_net_raw+ep root@testing-jan20:~# cp /bin/ping /bin/myping Copying will

Re: Who changes /bin/ping on my system ?

2014-03-05 Thread Brian
On Wed 05 Mar 2014 at 22:48:08 +1100, Scott Ferguson wrote: Correction If you are going to offer one, so will I. :) You were referencing the line in the article which has If you copy ping, it loses its setuid bit and fails to work This is correct for 'cp /bin/ping'; either the suid bit or

Re: Who changes /bin/ping on my system ?

2014-03-05 Thread Scott Ferguson
On 06/03/14 01:04, Brian wrote: On Wed 05 Mar 2014 at 22:48:08 +1100, Scott Ferguson wrote: snipped '*cp -a* /bin/ping' preserves the suid bit or capabilities. Thanks for the tip on the archive parameter, noted so I won't forget it - hopefully. Kind regards -- To UNSUBSCRIBE, email

transparent proxy (was: Re: Who changes /bin/ping on my system ?)

2014-03-05 Thread Chris
Hi Scott, On 03/04/2014 10:17 AM, Scott Ferguson wrote: I route suspect boxes through a transparent proxy to see if there are channels in use that shouldn't be. are you using port mirroring or any special software? iptables logging? - Chris -- To UNSUBSCRIBE, email to

Who changes /bin/ping on my system ?

2014-03-04 Thread Tim Ruehsen
Hi, every now and than ping loses it's capabilities to be executed by a normal user. Like here: $ ping example.com ping: icmp open socket: Operation not permitted I didn't care so far and just reinstalled iputils-ping and everything worked again. I did this three or four times since ~ November

Re: Who changes /bin/ping on my system ?

2014-03-04 Thread Scott Ferguson
On 04/03/14 19:16, Tim Ruehsen wrote: Hi, every now and than ping loses it's capabilities to be executed by a normal user. Like here: $ ping example.com ping: icmp open socket: Operation not permitted I didn't care so far and just reinstalled iputils-ping and everything worked again.

Re: Who changes /bin/ping on my system ?

2014-03-04 Thread Brian
On Tue 04 Mar 2014 at 09:16:15 +0100, Tim Ruehsen wrote: # ls -la /bin/ping -rwxr-xr-x 1 root root 46672 01-02-14 22:18:43 /bin/ping The file size indicates this is /bin/ping6 (amd64 platform) Now I reinstalled iputils-ping: # ls -la /bin/ping -rwxr-xr-x 1 root root 44080 01-02-14

Re: Who changes /bin/ping on my system ?

2014-03-04 Thread Scott Ferguson
Second thoughts On 04/03/14 20:17, Scott Ferguson wrote: On 04/03/14 19:16, Tim Ruehsen wrote: Hi, every now and than ping loses it's capabilities to be executed by a normal user. Like here: $ ping example.com ping: icmp open socket: Operation not permitted snipped Now I

Re: Who changes /bin/ping on my system ?

2014-03-04 Thread John Hasler
Scott Ferguson writes: Sorry I don't have access to a Sid box at the moment - perhaps someone who has, and for whom ping is working could post the output of getcap `which ping`?? /bin/ping = cap_net_raw+p -- John Hasler jhas...@newsguy.com Elmwood, WI USA -- To UNSUBSCRIBE, email to

Re: Who changes /bin/ping on my system ?

2014-03-04 Thread Brian
On Wed 05 Mar 2014 at 09:29:18 +1100, Scott Ferguson wrote: On 04/03/14 19:16, Tim Ruehsen wrote: Setting up iputils-ping (3:20121221-5) ... Setcap worked! *Ping(6) is not suid!* The above line, emphasis mine, is what prompted second thoughts. Perhaps one of the changes between the

Re: Who changes /bin/ping on my system ?

2014-03-04 Thread Scott Ferguson
On 05/03/14 09:46, John Hasler wrote: Scott Ferguson writes: Sorry I don't have access to a Sid box at the moment - perhaps someone who has, and for whom ping is working could post the output of getcap `which ping`?? /bin/ping = cap_net_raw+p Thanks John (it was a long shot guess on my