Re: [CentOS] Centos 5.3 -> Apache - Under Attack ? Oh hell....

2009-06-03 Thread John R. Dennison
On Wed, Jun 03, 2009 at 01:57:20AM -0400, JohnS wrote: > > Dollars to Donuts ehhh??? > How many donuts you think it will take to pay for legal costs and clean > up if there are customer data on the machine? I think right about now I 4 chocolate eclairs should cover it :) But serio

Re: [CentOS] Centos 5.3 -> Apache - Under Attack ? Oh hell....

2009-06-03 Thread JohnS
On Wed, 2009-06-03 at 02:04 -0500, John R. Dennison wrote: > On Wed, Jun 03, 2009 at 01:57:20AM -0400, JohnS wrote: > > > > Dollars to Donuts ehhh??? > > How many donuts you think it will take to pay for legal costs and clean > > up if there are customer data on the machine? I think right about no

[CentOS] [OT] Simple Shell Script (while loop)

2009-06-03 Thread James Bensley
Hey Guys, I can not find the corrent syntax for what I am trying to acheive with a while loop. Having said that I'm not exactly sure what you would call it so I have been googling with no success probably for that reason. I am just working with some sub directories except there is one I don't wan

Re: [CentOS] [OT] Simple Shell Script (while loop)

2009-06-03 Thread John R. Dennison
On Wed, Jun 03, 2009 at 08:44:29AM +0100, James Bensley wrote: There are many ways to do this; building on your code snippet it would be: #!/bin/bash find ./ -maxdepth 1 -type d | while read FOLDER do if [ "$FOLDER" = "./not_this_folder_oh_no!" ]; then cont

Re: [CentOS] [OT] Simple Shell Script (while loop)

2009-06-03 Thread James Bensley
Thanks guys the "continue" command was what I was looking for. Also to those who pointed out the lack of quotation marks around the string, they are on my original script but somehow vanished during the copy and paste operation between my shell window and browser...werid?!?! Still If I hadn't of h

Re: [CentOS] [OT] Simple Shell Script (while loop)

2009-06-03 Thread JohnS
On Wed, 2009-06-03 at 02:59 -0500, John R. Dennison wrote: > On Wed, Jun 03, 2009 at 08:44:29AM +0100, James Bensley wrote: > > There are many ways to do this; building on your code > snippet it would be: > > #!/bin/bash > find ./ -maxdepth 1 -type d | while read FOLDER > do >

Re: [CentOS] [OT] Simple Shell Script (while loop)

2009-06-03 Thread John R. Dennison
On Wed, Jun 03, 2009 at 04:33:21AM -0400, JohnS wrote: > --- > I'm no Bash expert but is there a real good reason "pass" would not be > used in place of continue? I'm just really currious Because pass is not a valid bash language construct, at least in 3.2.25.

Re: [CentOS] Harware vs Kernel RAID (was Re: External SATA enclosures: SiI3124 and CentOS 5?)

2009-06-03 Thread Michael A. Peters
Gordon Messmer wrote: > On 06/01/2009 07:52 PM, Michael A. Peters wrote: >> I've read a lot of different reports that suggest at this point in time, >> kernel software raid is in most cases better than controller raid. > > There are certainly a lot of people who feel that way. It depends on > wh

Re: [CentOS] how to debug random server reboots

2009-06-03 Thread Sergej Kandyla
Rudi Ahlers пишет: > Hi all, > > One of our CentOS 5.3 randomly reboots, at different times of the day, > and I can't see why it's doing it. > > I have looked through the logs, but don't see any thing in there that > shows me why it has rebooted. How can I debug this? > > Hi, try to enable kdu

Re: [CentOS] release/update question

2009-06-03 Thread Ralph Angenendt
j...@rossberry.com wrote: > On Tue, 2 Jun 2009, Ralph Angenendt wrote: > > > Radu-Cristian FOTESCU wrote: > >> AFAIK, this never happened. Is the 5.x.z tree concept dead-before-birth?! > > > > For CentOS: Yes. > > > > For Upstream: Ask Red Hat. > > I have asked RHT repeatedly to walk me through t

Re: [CentOS] Random server reboot after update to CentOS 5.3

2009-06-03 Thread Peter Hopfgartner
Epilogue: I've tried to disable TSO (ethtool -K eth0 tso off), as was suggested on the poweredge list. This did not help. I've configured the machine to start with the 5.2 kernel in /boot/grub/grub.conf, changing the default. It has been running for 6 1/2 days, now. I would say that this helpe

[CentOS] System V Init Script

2009-06-03 Thread James Bensley
Hey Listees, I have a question (hopefully quite simple) about the system V init scripts in /etc/init.d. I have an app installed and for some reason it had no system V init script. It has been installed a long while now so I can't quite remember whats going on but basically I remember I wrote the i

Re: [CentOS] System V Init Script

2009-06-03 Thread John R. Dennison
On Wed, Jun 03, 2009 at 10:29:08AM +0100, James Bensley wrote: > > restart) > echo -n "Stopping my_app: " > pgrep my_app | while read PIDS; do # I have chosen this method because > my_app spawns various child processes > kill -9 $PIDS # and they all need to DIE! >

Re: [CentOS] System V Init Script

2009-06-03 Thread JohnS
On Wed, 2009-06-03 at 10:29 +0100, James Bensley wrote: > Hey Listees, > > I have a question (hopefully quite simple) about the system V init > scripts in /etc/init.d. I have an app installed and for some reason it > had no system V init script. It has been installed a long while now so > I can't

Re: [CentOS] System V Init Script

2009-06-03 Thread John R. Dennison
On Wed, Jun 03, 2009 at 04:42:09AM -0500, John R. Dennison wrote: > > I'd think that the pgrep is matching both the processes you want > to kill _and_ the init.d script itself. Try "pgrep -x" which > will exactly match the specified command. > > Even better, use "pkill -x

Re: [CentOS] System V Init Script

2009-06-03 Thread James Bensley
As you spotted john my killing loop was killing the system V script itself also hence it never starting my_app again, so instead a simple if skips the process ID of the system V script itself so it can continue on to start my_app again: > > I'd think that the pgrep is matching both the proc

Re: [CentOS] release/update question

2009-06-03 Thread Kai Schaetzl
Ralph Angenendt wrote on Wed, 3 Jun 2009 11:17:35 +0200: > One of the reasons CentOS chose not to do it It appears that only a very very small number of people need it or *think* they need it. It would have surely been a great waste of time and ressources if CentOS had adopted it and no real be

Re: [CentOS] Centos 5.3 -> Apache - Under Attack ? Oh hell....

2009-06-03 Thread Anne Wilson
On Wednesday 03 June 2009 06:09:37 John R. Dennison wrote: > He's running an apache instance on cent5.  He has processes he > can not readily identify running under apache named "atack"; > where does "windows" come into the equation?   Several of the links returned by googl

Re: [CentOS] release/update question

2009-06-03 Thread Ralph Angenendt
Kai Schaetzl wrote: > Ralph Angenendt wrote on Wed, 3 Jun 2009 11:17:35 +0200: > > > One of the reasons CentOS chose not to do it > > It appears that only a very very small number of people need it or *think* > they need it. Probably the latter. CentOS 5 SP 3 would maybe have been a better cho

Re: [CentOS] Centos 5.3 -> Apache - Under Attack ? Oh hell....

2009-06-03 Thread Ralph Angenendt
William Warren wrote: > http://www.derkeiler.com/Newsgroups/comp.os.linux.security/2004-05/0202.html This has nothing to do with the issue at hand (neither did the other URL from your earlier mail). It can *clearly* be seen that there are processes running as the apache user on that box - so why

Re: [CentOS] Centos 5.3 -> Apache - Under Attack ? Oh hell....

2009-06-03 Thread Ralph Angenendt
bruce wrote: > nope... > > not kidding... the majority of windows based attacks on an apache system > running on linux systems are obnoxiousm but not harmful... the kinds of > attacks that are looking to exploit windows buffer overflows are harmless to > linux systems.. Aha. How are active runnin

Re: [CentOS] Centos 5.3 -> Apache - Under Attack ? Oh hell....

2009-06-03 Thread Ralph Angenendt
Anne Wilson wrote: > On Wednesday 03 June 2009 06:09:37 John R. Dennison wrote: > > He's running an apache instance on cent5.  He has processes he > > can not readily identify running under apache named "atack"; > > where does "windows" come into the equation?   > > Several

[CentOS] Yum-complete-transaction wants to wipe my system out

2009-06-03 Thread Eduardo Grosclaude
After some enabling/disabling new repos (pgdg for PostgreSQL specifically) and admittedly some yum action that may have gone uncompleted, I am advised to run yum-complete-transaction. However, when I attempt to do this, yum warns that 225 packages will be erased, all of which I deeply care for. How

Re: [CentOS] Centos 5.3 -> Apache - Under Attack ? Oh hell....

2009-06-03 Thread Anne Wilson
On Wednesday 03 June 2009 12:44:58 Ralph Angenendt wrote: > where does "windows" come into the equation? The question I replied to was "where does "windows" come into the equation?". Anne -- New to KDE4? - get help from http://userbase.kde.org Just found a cool new feature? Add it to UserBase

Re: [CentOS] System V Init Script

2009-06-03 Thread John Doe
From: James Bensley > I have pasted the code below from my "restart" clause but from what I can > tell, it is killing the app but not restarting it, I think because the > killing process is still in action so when it start the app again it just > gets killed straight away. If I enter "/etc/ini

Re: [CentOS] Yum-complete-transaction wants to wipe my system out

2009-06-03 Thread Les Mikesell
Eduardo Grosclaude wrote: > After some enabling/disabling new repos (pgdg for PostgreSQL > specifically) and admittedly some yum action that may have gone > uncompleted, I am advised to run yum-complete-transaction. However, > when I attempt to do this, yum warns that 225 packages will be erased, >

Re: [CentOS] release/update question

2009-06-03 Thread Kai Schaetzl
Ralph Angenendt wrote on Wed, 3 Jun 2009 13:14:55 +0200: > Probably the latter. CentOS 5 SP 3 would maybe have been a better choice > than CentOS 5.3 Not if one wants to stay in sync with the RHEL naming scheme :-) Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services

Re: [CentOS] release/update question

2009-06-03 Thread Karanbir Singh
On 06/03/2009 01:31 PM, Kai Schaetzl wrote: >> Probably the latter. CentOS 5 SP 3 would maybe have been a better choice >> than CentOS 5.3 > > Not if one wants to stay in sync with the RHEL naming scheme :-) I dont think that will be a problem, since we have never been in sync with Red Hat's nami

Re: [CentOS] Centos 5.3 -> Apache - Under Attack ? Oh hell....

2009-06-03 Thread Nicolas Thierry-Mieg
Anne Wilson wrote: > On Wednesday 03 June 2009 06:09:37 John R. Dennison wrote: >> He's running an apache instance on cent5. He has processes he >> can not readily identify running under apache named "atack"; >> where does "windows" come into the equation? > > Several o

Re: [CentOS] Harware vs Kernel RAID (was Re: External SATA enclosures: SiI3124 and CentOS 5?)

2009-06-03 Thread Les Mikesell
Michael A. Peters wrote: > > I guess from the discussion that hardware raid is definitely still the > way to go for servers, where the guy at the colo can simply swap out a > dead drive if need be w/o any serious downtime etc. On the flip side, you generally have to install some vendor-specific

Re: [CentOS] release/update question

2009-06-03 Thread Ralph Angenendt
Kai Schaetzl wrote: > Ralph Angenendt wrote on Wed, 3 Jun 2009 13:14:55 +0200: > > > Probably the latter. CentOS 5 SP 3 would maybe have been a better choice > > than CentOS 5.3 > > Not if one wants to stay in sync with the RHEL naming scheme :-) It clearly is the other way round, Red Hat has ad

Re: [CentOS] Centos 5.3 -> Apache - Under Attack ? Oh hell....

2009-06-03 Thread Ralph Angenendt
Anne Wilson wrote: > On Wednesday 03 June 2009 12:44:58 Ralph Angenendt wrote: > > where does "windows" come into the equation? No, I did not write that. > The question I replied to was "where does "windows" come into the equation?". > And I asked what made you think that this had anything to

Re: [CentOS] Centos 5.3 -> Apache - Under Attack ? Oh hell....

2009-06-03 Thread Linux Advocate
My replies below i m just so down in the dumps nowaaah - Original Message > From: Neil Aggarwal > To: CentOS mailing list > Sent: Wednesday, June 3, 2009 1:38:05 PM > Subject: Re: [CentOS] Centos 5.3 -> Apache - Under Attack ? Oh hell > > The original poster stated

Re: [CentOS] Centos 5.3 -> Apache - Under Attack ? Oh hell....

2009-06-03 Thread Linux Advocate
- Original Message > From: Anne Wilson > On Wednesday 03 June 2009 06:09:37 John R. Dennison wrote: > > He's running an apache instance on cent5. He has processes he > > can not readily identify running under apache named "atack"; > > where does "windows" co

[CentOS] yum update error this morning

2009-06-03 Thread Jerry Geis
I am getting the following "yum update" error this morning. C 5.3 x86_64. What shall I do? Jerry --- yum update Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile * base: centos.mirror.nac.net * updates: centos.mirror.nac.net * addons: mirrors.unbornmedia.com *

Re: [CentOS] Centos 5.3 -> Apache - Under Attack ? Oh hell....

2009-06-03 Thread Linux Advocate
> > as an aside? did he say if he even looked on the net for anything related to > this?? i tried googling for 'centos apache atack" but did not get anything substantial. i tried locating a binary file called ' atack' but got nothing. ___

[CentOS] Hi ALL!!!

2009-06-03 Thread Andrey Garkin
I have a one problem with Raid controller Tekram TR-822... I'm using dmraid software: r...@ns1: / $ dmraid -r /dev/sda: sil, "sil_ajacddafagff", mirror, ok, 156299440 sectors, data@ 0 /dev/sdb: sil, "sil_ajacddafagff", mirror, ok, 156299440 sectors, data@ 0 When I'm start dmraid -ay: r...@ns1: / $

Re: [CentOS] yum update error this morning

2009-06-03 Thread Ralph Angenendt
Jerry Geis wrote: > I am getting the following "yum update" error this morning. C 5.3 x86_64. > > What shall I do? [...] > TypeError: unsubscriptable object What everybody did who got that error: yum clean all You aren't really reading here, are you? Ralph pgp87pmvoJxOM.pgp Description: PGP

Re: [CentOS] Centos 5.3 -> Apache - Under Attack ? Oh hell....

2009-06-03 Thread Linux Advocate
- Original Message > From: John R. Dennison > > I stand by my previous advice - the box is compromised, can not > be trusted, and as a responsible admin he should be working on > re-installing it, evaluating what web-apps he had running that > led to this in the firs

Re: [CentOS] Centos 5.3 -> Apache - Under Attack ? Oh hell....

2009-06-03 Thread Neil Aggarwal
Maco: > i am not worried abt reinstalling ( i loathe doing it ) but > my worry here ( as some of you have accurately pointed out ) > is that the 'issue' will repeat again bcos i just downt know > what happened. I m just surprised that a centos box was compromised. If you are only running soft

Re: [CentOS] Centos 5.3 -> Apache - Under Attack ? Oh hell....

2009-06-03 Thread Neil Aggarwal
Maco: > i have other mandriva boxes and they all are ok. i m just so > surprised that a centos box got compromised. If you are not doing anything silly in your server configuration, this is not a CentOS issue. Anything *can* be hacked. It just so happens that it was your CentOS box this time.

Re: [CentOS] yum update error this morning

2009-06-03 Thread Ron Lorah
Try: yum clean all Then try yum update again ~Ron Jerry Geis wrote: > I am getting the following "yum update" error this morning. C 5.3 x86_64. > > What shall I do? > > Jerry > --- > > yum update > Loaded plugins: fastestmirror > Loading mirror speeds from cached hostfile > * base: cento

Re: [CentOS] Centos 5.3 -> Apache - Under Attack ? Oh hell....

2009-06-03 Thread Les Mikesell
Linux Advocate wrote: > > > > > - Original Message >> From: John R. Dennison >> >> I stand by my previous advice - the box is compromised, can not >> be trusted, and as a responsible admin he should be working on >> re-installing it, evaluating what web-apps he had running

[CentOS] Can't play DVD movies on CentOS 5.3 after following guidance on the wiki

2009-06-03 Thread David McGuffey
This is my first post here on the CentOS forums.  I've been running Fedora since FC4, and have been working with RHEL 4 at work.  But this is my first foray into CentOS.I followed the multimedia guidance on the wiki, and now have the ability to view a lot of different video clips on the Internet,

Re: [CentOS] yum update error this morning

2009-06-03 Thread Sorin Srbu
>-Original Message- >From: centos-boun...@centos.org [mailto:centos-boun...@centos.org] On Behalf >Of Jerry Geis >Sent: Wednesday, June 03, 2009 3:26 PM >To: CentOS ML >Subject: [CentOS] yum update error this morning > >I am getting the following "yum update" error this morning. C 5.3 x86_6

Re: [CentOS] yum update error this morning

2009-06-03 Thread Sorin Srbu
>-Original Message- >From: centos-boun...@centos.org [mailto:centos-boun...@centos.org] On Behalf >Of Ralph Angenendt >Sent: Wednesday, June 03, 2009 3:32 PM >To: centos@centos.org >Subject: Re: [CentOS] yum update error this morning > >> TypeError: unsubscriptable object > >What everybody

[CentOS] How to remove the wrong wireless firmware module

2009-06-03 Thread David McGuffey
How do I back out of these directions?"yum install iwl4965-firmwarermmod iwl4965; modprobe iwl4965Your wireless device should be working now. Enable NetworkManager to use it. Starting from CentOS 5.3 (kernel 2.6.18-128) the kernel includes the iwlagn kernel module. If you are running an older kerne

Re: [CentOS] How to remove the wrong wireless firmware module

2009-06-03 Thread Akemi Yagi
On Wed, Jun 3, 2009 at 7:12 AM, David McGuffey wrote: > BTW, it appears that support for the Broadcom wireless device is not in the > CentOS repositories. I think I 'm going to have to download the Broadcom > files and "make" the firmware module. I'd like to avoid that...any guidance? You might

Re: [CentOS] Harware vs Kernel RAID (was Re: External SATA enclosures: SiI3124 and CentOS 5?)

2009-06-03 Thread Michael A. Peters
Les Mikesell wrote: > > I'd recommend looking at backuppc instead of amanda if you mostly want > on-line storage. Its storage scheme will hold a much longer history in > the same amount of space and it has a handy web interface for browsing > and restores. I'd rather have something that has

Re: [CentOS] How to remove the wrong wireless firmware module

2009-06-03 Thread Ned Slider
David McGuffey wrote: > How do I back out of these directions? > > "yum install iwl4965-firmware > > rmmod iwl4965; modprobe iwl4965 > rmmod iwl4965 yum erase iwl4965-firmware > Your wireless device should be working now. Enable NetworkManager to use it. > Starting from CentOS 5.3 (kernel 2.6

Re: [CentOS] Centos 5.3 -> Apache - Under Attack ? Oh hell....

2009-06-03 Thread Ross Walker
On Wed, Jun 3, 2009 at 9:22 AM, Linux Advocate wrote: > > i am not worried abt reinstalling ( i loathe doing it ) but my worry here ( > as some of you have  accurately pointed out ) is that the 'issue' will repeat > again bcos i just downt know what happened. I m just surprised that a centos >

Re: [CentOS] Hi ALL!!!

2009-06-03 Thread Tim Nelson
- "Andrey Garkin" wrote: > I have a one problem with Raid controller Tekram TR-822... > I'm using dmraid software: > r...@ns1: / $ dmraid -r > /dev/sda: sil, "sil_ajacddafagff", mirror, ok, 156299440 sectors, > data@ 0 > /dev/sdb: sil, "sil_ajacddafagff", mirror, ok, 156299440 sectors, > data@

Re: [CentOS] Harware vs Kernel RAID (was Re: External SATA enclosures: SiI3124 and CentOS 5?)

2009-06-03 Thread Ross Walker
On Jun 2, 2009, at 9:53 PM, Christopher Chan wrote: > John R Pierce wrote: >> Chan Chung Hang Christopher wrote: >> I've read a lot of different reports that suggest at this point in time, kernel software raid is in most cases better than controller raid. >>> Let

Re: [CentOS] Can't play DVD movies on CentOS 5.3 after following guidance on the wiki

2009-06-03 Thread Nicolas Thierry-Mieg
David McGuffey wrote: > This is my first post here on the CentOS forums. I've been running > Fedora since FC4, and have been working with RHEL 4 at work. But this > is my first foray into CentOS. > > I followed the multimedia guidance on the wiki, and now have the ability > to view a lot

Re: [CentOS] Centos 5.3 -> Apache - Under Attack ? Oh hell....

2009-06-03 Thread Neil Aggarwal
Bill: > Just an FYI to all those who may not know: > > $ cat test.c > #include > #include > #include > main(int argc, char *argv[]) > { > sleep(15); > strcpy(argv[0],"test.c"); > sleep(15); > exit(0); > } That is a very cool demonstration. Thanks for the info. Neil -- Neil Aggarwal,

Re: [CentOS] Hi ALL!!!

2009-06-03 Thread Phil Schaffner
Tim Nelson wrote: > - "Andrey Garkin" wrote: >> I have a one problem with Raid controller Tekram TR-822... I'm ... > Remove the RAID configuration from the card's "BIOS" and just run > them as standard SATA volumes. Then, use software raid to accomplish > your mirror. The 'fake-raid' junk will

Re: [CentOS] Centos 5.3 -> Apache - Under Attack ? Oh hell....

2009-06-03 Thread William L. Maltby
On Wed, 2009-06-03 at 11:06 -0400, William L. Maltby wrote: > I just thought of this too. There are two IDs tracked by the system. Effective (EUID) and the real ID (UID). If the process has changed UID, by either suid bit or by program call (I think it has to start as root for that to happen?),

Re: [CentOS] Centos 5.3 -> Apache - Under Attack ? Oh hell....

2009-06-03 Thread William L. Maltby
On Wed, 2009-06-03 at 06:29 -0700, Linux Advocate wrote: > > i tried googling for 'centos apache atack" but did not get anything > substantial. > i tried locating a binary file called ' atack' but got nothing. Just an FYI to all those who may not know: $ cat test.c #include #include #inclu

Re: [CentOS] Centos 5.3 -> Apache - Under Attack ? Oh hell....

2009-06-03 Thread Michael A. Peters
Neil Aggarwal wrote: > Maco: > >> i have other mandriva boxes and they all are ok. i m just so >> surprised that a centos box got compromised. > > If you are not doing anything silly in your server > configuration, this is not a CentOS issue. > > Anything *can* be hacked. It just so happens >

Re: [CentOS] yum update error this morning

2009-06-03 Thread Ralph Angenendt
Sorin Srbu wrote: > >-Original Message- > >From: centos-boun...@centos.org [mailto:centos-boun...@centos.org] On > Behalf > >Of Ralph Angenendt > >> TypeError: unsubscriptable object > > > >What everybody did who got that error: yum clean all > > > >You aren't really reading here, are you?

Re: [CentOS] Harware vs Kernel RAID (was Re: External SATA enclosures: SiI3124 and CentOS 5?)

2009-06-03 Thread Chan Chung Hang Christopher
>> See my reply to nate. If you are using boards with 12GB of cache, >> software raid is not even on the radar. >> > > True, but I feel an important point is being missed here. > > In order to avoid a lot of the random I/O file systems use page cache > to combine I/O operations and transact

Re: [CentOS] Harware vs Kernel RAID (was Re: External SATA enclosures: SiI3124 and CentOS 5?)

2009-06-03 Thread Les Mikesell
Michael A. Peters wrote: > >> I'd recommend looking at backuppc instead of amanda if you mostly want >> on-line storage. Its storage scheme will hold a much longer history in >> the same amount of space and it has a handy web interface for browsing >> and restores. > > I'd rather have somethi

[CentOS] CentOS-announce Digest, Vol 52, Issue 2

2009-06-03 Thread centos-announce-request
Send CentOS-announce mailing list submissions to centos-annou...@centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-requ..

Re: [CentOS] Centos 5.3 -> Apache - Under Attack ? Oh hell....

2009-06-03 Thread Linux Advocate
BRUCE U ARE A F*** GENIUS MAN ! u were right brothanx for spending the time on this man more info below ! - Original Message > From: bruce > To: linuxhous...@yahoo.com > Sent: Wednesday, June 3, 2009 9:53:24 PM > Subject: RE: [CentOS] Centos 5.3 -> Apache

Re: [CentOS] Random server reboot after update to CentOS 5.3

2009-06-03 Thread Scott Silva
on 6-3-2009 2:27 AM Peter Hopfgartner spake the following: > Epilogue: > > I've tried to disable TSO (ethtool -K eth0 tso off), as was suggested on > the poweredge list. This did not help. > > I've configured the machine to start with the 5.2 kernel in > /boot/grub/grub.conf, changing the defau

Re: [CentOS] Centos 5.3 -> Apache - Under Attack ? Oh hell....

2009-06-03 Thread bruce
so you're going to need to figure out what the hole in your system is/was... you're going to need to patch it... you're going to need to examine the logs for logins to your other systems.. as well as examine the ssh logs for outgoing login attempts from the hacked box to other boxes in your network

Re: [CentOS] Centos 5.3 -> Apache - Under Attack ? Oh hell....

2009-06-03 Thread William L. Maltby
On Wed, 2009-06-03 at 09:33 -0700, Linux Advocate wrote: > > [r...@fwgw unix]# pwd > /dev/shm/unix > Note that /dev/shm is a tempfs file system. It will be dynamically populated. I would expect the attack vector still resides on your system somewhere else. -- Bill __

Re: [CentOS] release/update question

2009-06-03 Thread Scott Silva
on 6-3-2009 6:10 AM Ralph Angenendt spake the following: > Kai Schaetzl wrote: >> Ralph Angenendt wrote on Wed, 3 Jun 2009 13:14:55 +0200: >> >>> Probably the latter. CentOS 5 SP 3 would maybe have been a better choice >>> than CentOS 5.3 >> Not if one wants to stay in sync with the RHEL naming sch

Re: [CentOS] how to debug random server reboots

2009-06-03 Thread Scott Silva
on 6-2-2009 11:53 PM Rudi Ahlers spake the following: > On 6/3/09, Scott Silva wrote: >> on 6-2-2009 2:46 PM Rudi Ahlers spake the following: >>> On 6/2/09, Scott Silva >>> wrote: on 6-2-2009 2:30 PM Rudi Ahlers spake the following: > Hi all, > > One of our CentOS 5.3 randomly r

[CentOS] setrubleshootd dominating

2009-06-03 Thread Frank M. Ramaekers
Anyone have any idea as to why setroubleshootd would be dominating the system: PID USER PR NI VIRT RES SHR S %CPU %MEMTIME+ COMMAND 2371 root 25 0 1884m 1.8g 4100 R 100.2 44.7 680:06.40 setroubleshootd Frank M. Ramaekers Jr. Systems Programmer MCP, MCP+I,

Re: [CentOS] Centos 5.3 -> Apache - Under Attack ? Oh hell....

2009-06-03 Thread Scott Silva
on 6-2-2009 9:09 PM John R. Dennison spake the following: > On Tue, Jun 02, 2009 at 09:01:35PM -0700, Linux Advocate wrote: >> o godd. >> >> i have a quite a few linux boxes and not even one has been hacked. oh >> man !! > > That

Re: [CentOS] Centos 5.3 -> Apache - Under Attack ? Oh hell....

2009-06-03 Thread Drew
> Further googling indicates that UnixCod  is a brute force ssh scanner... what > is is odd is that i have fail2ban ruunning ( which blocks IPs after 2 failed > attempts) and a 8 letter passwd but i still got hacked Hi Marco, Just because the app is an SSH scanner doesn't automatically mean

[CentOS] Removing old kernels

2009-06-03 Thread Frank M. Ramaekers
I have the following kernels on my /boot: 2.6.18-128.1.6 2.6.18-92.1.18 2.6.18-92.1.22 I'm low on /boot space and need to remove the oldest version. It appears that I cannot use yum to remove since all of the versions are the same (only the release is different). I believe that I can use rpm to

Re: [CentOS] Removing old kernels

2009-06-03 Thread Gilbert Sebenste
On Wed, 3 Jun 2009, Frank M. Ramaekers wrote: > I have the following kernels on my /boot: > > 2.6.18-128.1.6 > 2.6.18-92.1.18 > 2.6.18-92.1.22 > > I'm low on /boot space and need to remove the oldest version. It > appears that I cannot use yum to remove since all of the versions are > the same (o

Re: [CentOS] Removing old kernels

2009-06-03 Thread Steve Huff
On Jun 3, 2009, at 1:40 PM, Frank M. Ramaekers wrote: I have the following kernels on my /boot: 2.6.18-128.1.6 2.6.18-92.1.18 2.6.18-92.1.22 I'm low on /boot space and need to remove the oldest version. It appears that I cannot use yum to remove since all of the versions are the same (only t

Re: [CentOS] Removing old kernels

2009-06-03 Thread Frank Cox
On Wed, 03 Jun 2009 12:40:08 -0500 Frank M. Ramaekers wrote: > Any other considerations and/or methods? yum install yum-utils package-cleanup --oldkernels -- MELVILLE THEATRE ~ Melville Sask ~ http://www.melvilletheatre.com ___ CentOS mailing list Cen

Re: [CentOS] Centos 5.3 -> Apache - Under Attack ? Oh hell....

2009-06-03 Thread Scott Silva
on 6-2-2009 10:18 PM bruce spake the following: > you and i agreee on him figuring out what web apps are causing the issues.. > or in fact, exactly what the 'atack' process is? i didn't see the initial > threads.. was this simething that he discussed? did he say what the atack > process was doing?

Re: [CentOS] Centos 5.3 -> Apache - Under Attack ? Oh hell....

2009-06-03 Thread Anne Wilson
On Wednesday 03 June 2009 14:09:35 Ralph Angenendt wrote: > Anne Wilson wrote: > > On Wednesday 03 June 2009 12:44:58 Ralph Angenendt wrote: > > > where does "windows" come into the equation? > > No, I did not write that. > True. An error in snipping, somewhere. > > The question I replied to wa

Re: [CentOS] Centos 5.3 -> Apache - Under Attack ? Oh hell....

2009-06-03 Thread Anne Wilson
On Wednesday 03 June 2009 14:24:43 Linux Advocate wrote: > > - Original Message > > From: Anne Wilson > > > On Wednesday 03 June 2009 06:09:37 John R. Dennison wrote: > > > He's running an apache instance on cent5. He has processes he > > > can not readily identify runn

Re: [CentOS] Random server reboot after update to CentOS 5.3

2009-06-03 Thread Dave Jones
>Epilogue: >I've tried to disable TSO (ethtool -K eth0 tso off), as was suggested on >the poweredge list. This did not help. >I've configured the machine to start with the 5.2 kernel in >/boot/grub/grub.conf, changing the default. It has been running for 6 >1/2 days, now. I would say that this he

Re: [CentOS] Removing old kernels

2009-06-03 Thread Frank M. Ramaekers
Running Transaction Erasing: kernel [1/1] Removed: kernel.i686 0:2.6.18-92.1.18.el5 Complete! That seemed to work, but I still have some 92.1.18 elements left: ls -l /boot/*92.1.18* -rw-r--r-- 1 root root 65438 Nov 12 2008 /boot/config-2.6.18-92.1.18.el5debug -rw-r--r-- 1 root root

Re: [CentOS] Removing old kernels

2009-06-03 Thread Frank M. Ramaekers
Nevermindfigured it out. Thanks, Frank M. Ramaekers Jr. Systems Programmer MCP, MCP+I, MCSE & RHCE American Income Life Insurance Co. Phone: (254)761-6649 1200 Wooded Acres Dr.Fax: (254)741-5777 Waco, Texas 76710 -Original Message- From

Re: [CentOS] Removing old kernels

2009-06-03 Thread John R Pierce
Frank M. Ramaekers wrote: > Running Transaction > Erasing: kernel > [1/1] > > Removed: kernel.i686 0:2.6.18-92.1.18.el5 > Complete! > > That seemed to work, but I still have some 92.1.18 elements left: > ls -l /boot/*92.1.18* > /boot/config-2.6.18-92.1.18.el5debug > /boot/config-2.6.18-92

Re: [CentOS] Removing old kernels

2009-06-03 Thread Steve Huff
On Jun 3, 2009, at 2:37 PM, Frank M. Ramaekers wrote: That seemed to work, but I still have some 92.1.18 elements left: ls -l /boot/*92.1.18* -rw-r--r-- 1 root root 65438 Nov 12 2008 /boot/config-2.6.18-92.1.18.el5debug for each file, find out what package it belongs to, and then remove it

Re: [CentOS] Removing old kernels

2009-06-03 Thread Robert Heller
At Wed, 3 Jun 2009 13:37:56 -0500 CentOS mailing list wrote: > > Running Transaction > Erasing: kernel > [1/1] > > Removed: kernel.i686 0:2.6.18-92.1.18.el5 > Complete! > > That seemed to work, but I still have some 92.1.18 elements left: > ls -l /boot/*92.1.18* > -rw-r--r-- 1 root r

Re: [CentOS] Centos 5.3 -> Apache - Under Attack ? Oh hell....

2009-06-03 Thread Geoff Galitz
> And if you have other server set up identically, you might want to > check/secure them before they too are "owned" Nevermind identically; you should check all of your systems. If this is a business environment, you should really think about getting a professional vulnerability assessment or a

Re: [CentOS] Can't play DVD movies on CentOS 5.3 after following guidance on the wiki

2009-06-03 Thread MHR
On Wed, Jun 3, 2009 at 8:07 AM, Nicolas Thierry-Mieg wrote: > David McGuffey wrote: >> >> I killed totem and manually tried to start the DVD with mplayer. mplayer >> sat there...not recognizing that there was a DVD in the drive. >> > > you could install xine (it's in rpmforge), it works well for m

Re: [CentOS] Removing old kernels

2009-06-03 Thread Max Hetrick
Frank M. Ramaekers wrote: > I have the following kernels on my /boot: > > 2.6.18-128.1.6 > 2.6.18-92.1.18 > 2.6.18-92.1.22 > > I'm low on /boot space and need to remove the oldest version. It > appears that I cannot use yum to remove since all of the versions are > the same (only the release is

Re: [CentOS] Removing old kernels

2009-06-03 Thread William L. Maltby
On Wed, 2009-06-03 at 14:50 -0400, Robert Heller wrote: > At Wed, 3 Jun 2009 13:37:56 -0500 CentOS mailing list > wrote: > > rpm -e kernel-2.6.18-92.1.18.el5debug ... > > (Make *sure* you are not actually running any of these kernels!). > > Note: yum clean old-kernels keeps the last N kernel

[CentOS] Adding an 'official' CentOS image to the Amazon EC2(Electronic Compute Cloud)

2009-06-03 Thread Richard Shade
Sorry for not replying to this earlier, I just saw this thread because of the newsletter. We have had CentOS Images running in the cloud since 09/06/2007, and there have had a public script out for it, you can check us out in the Amazon catalog here: http://developer.amazonwebservices.com/connect/e

Re: [CentOS] Can't play DVD movies on CentOS 5.3 after following guidance on the wiki

2009-06-03 Thread Joshua Baker-LePain
On Wed, 3 Jun 2009 at 12:07pm, MHR wrote > I like xine for most DVD playing - as long as it recognizes the DVD, I > have no trouble with it at all. It also has a feature that mplayer > lacks - turning off the screen saver while the movie is playing (which > also has its drawbacks...). Erm, what?

Re: [CentOS] Centos 5.3 -> Apache - Under Attack ? Oh hell....

2009-06-03 Thread bruce
and if you don't figure out what caused the issue... there's not a dammed reason to think you wouldn't do the same thing and get in the same dam situation when you reinstall... i'm not quibbling with removing the box from the net... i've simply stated that just going straight to reinstall does

Re: [CentOS] Can't play DVD movies on CentOS 5.3 after following guidance on the wiki

2009-06-03 Thread MHR
On Wed, Jun 3, 2009 at 12:14 PM, Joshua Baker-LePain wrote: > > Erm, what? > $ man mplayer > . > . >        -stop-xscreensaver (X11 only) >               Turns off xscreensaver at startup and turns it on again on exit. >               If  your  screensaver supports neither the XSS nor XResetScreen

Re: [CentOS] Can't play DVD movies on CentOS 5.3 after following guidance on the wiki

2009-06-03 Thread Joshua Baker-LePain
On Wed, 3 Jun 2009 at 12:26pm, MHR wrote On Wed, Jun 3, 2009 at 12:14 PM, Joshua Baker-LePain wrote: Erm, what? $ man mplayer . .        -stop-xscreensaver (X11 only)               Turns off xscreensaver at startup and turns it on again on exit.               If  your  screensaver supports ne

Re: [CentOS] Can't play DVD movies on CentOS 5.3 after following guidance on the wiki

2009-06-03 Thread Robert Heller
At Wed, 3 Jun 2009 15:37:16 -0400 (EDT) CentOS mailing list wrote: > > > On Wed, 3 Jun 2009 at 12:26pm, MHR wrote > > > On Wed, Jun 3, 2009 at 12:14 PM, Joshua Baker-LePain wrote: > >> > >> Erm, what? > >> $ man mplayer > >> . > >> . > >>        -stop-xscreensaver (X11 only) > >>     Â

Re: [CentOS] Can't play DVD movies on CentOS 5.3 after following guidance on the wiki

2009-06-03 Thread MHR
On Wed, Jun 3, 2009 at 12:37 PM, Joshua Baker-LePain wrote: > On Wed, 3 Jun 2009 at 12:26pm, MHR wrote >> On Wed, Jun 3, 2009 at 12:14 PM, Joshua Baker-LePain >> wrote: >>> $ man mplayer >>> . >>>        -stop-xscreensaver (X11 only) >>>               Turns off xscreensaver at startup and turns i

Re: [CentOS] Can't play DVD movies on CentOS 5.3 after following guidance on the wiki

2009-06-03 Thread Joshua Baker-LePain
On Wed, 3 Jun 2009 at 12:44pm, MHR wrote > "Erm, what?" > > -stop-xscreensaver (X11 only) > Turns off xscreensaver at startup and turns it on again on exit. > > These are the only two appearances of the word "screensaver" on the > man page. There is no reference to a heartbeat-

Re: [CentOS] Can't play DVD movies on CentOS 5.3 after following guidance on the wiki

2009-06-03 Thread MHR
On Wed, Jun 3, 2009 at 12:53 PM, Joshua Baker-LePain wrote: > > What version of mplayer are you using (and from what repo)?  The CentOS > version doesn't help too much, as mplayer isn't included in any of the > default repos.  And this doesn't appear to be a very recent feature > (googling reveals

[CentOS] NOOBE help

2009-06-03 Thread Sam Drinkard
I know, I should not have to ask this question, but it appears that ALL my previous yum.repos.d entries have been trashed, with the only ones left is base, CentOS Media then the mirrors.rpmforge.reo, rhel-mondo.repo, rpmforge.repo, and webmin.repo. I've been bitten by the mixing of repositories

Re: [CentOS] Centos 5.3 -> Apache - Under Attack ? Oh hell....

2009-06-03 Thread Bob Hoffman
> > > It would be prudent to review his web code to see if he did > > > something in an insecure way. If his code is open to attack, it > > > will be so even if he puts it on a new machine. > > > > Hence my statements to evaluate the web-apps he has running :) > > > > I will bet doll

  1   2   >