Re: [CentOS] what percent of time are there unpatched exploits against default config?

2012-01-01 Thread Marc Deop
>Agreed. I don't even label as idiots the idiots who post here, asking us >to tell them how to do the job they were hired for, without any indication >that they've read man pages, or googled for an answer. Last time I checked you *were* in this list therefore you are calling yourself an idiot. J

Re: [CentOS] Checkinstall rpm for CentOS-6 x86_64?

2012-01-01 Thread Karanbir Singh
On 12/31/2011 02:24 PM, Tilman Schmidt wrote: >> consider using fpm instead ? it kind of address's the same problem in a >> different way. > > Although I'm not the OP I'm interested in that topic too. https://github.com/jordansissel/fpm/wiki and https://docs.google.com/present/view?id=0Aa9liCTsAy

Re: [CentOS] what percent of time are there unpatched exploits against default config?

2012-01-01 Thread Ljubomir Ljubojevic
On 12/31/2011 11:45 PM, Timothy Murphy wrote: > Les Mikesell wrote: > > Yes, I'm more worried about attacks through port 80. > Can anyone point me to documentation on protecting a web-server? > You should check http://www.snort.org, IDS system. ClearOS has them integrated. I can not remember if

[CentOS] (no subject)

2012-01-01 Thread Bennett Haselton
(Tried sending this before but it doesn't look like it went through; apologies if you're seeing it twice.) OK, a second machine hosted at the same hosting company has also apparently been hacked. Since 2 of out of 3 machines hosted at that company have now been hacked, but this hasn't happened to

[CentOS] an actual hacked machine, in a preserved state

2012-01-01 Thread Bennett Haselton
(Sorry, third time -- last one, promise, just giving it a subject line!) OK, a second machine hosted at the same hosting company has also apparently been hacked. Since 2 of out of 3 machines hosted at that company have now been hacked, but this hasn't happened to any of the other 37 dedicated ser

Re: [CentOS] what percent of time are there unpatched exploits against default config?

2012-01-01 Thread Ljubomir Ljubojevic
On 01/01/2012 09:14 PM, Ljubomir Ljubojevic wrote: > On 12/31/2011 11:45 PM, Timothy Murphy wrote: >> Les Mikesell wrote: >> >> Yes, I'm more worried about attacks through port 80. >> Can anyone point me to documentation on protecting a web-server? >> > > You should check http://www.snort.org, IDS

Re: [CentOS] an actual hacked machine, in a preserved state

2012-01-01 Thread Eero Volotinen
2012/1/2 Bennett Haselton : > (Sorry, third time -- last one, promise, just giving it a subject line!) > > OK, a second machine hosted at the same hosting company has also apparently > been hacked.  Since 2 of out of 3 machines hosted at that company have now > been hacked, but this hasn't happened

Re: [CentOS] what percent of time are there unpatched exploits against default config?

2012-01-01 Thread Nataraj
On 12/30/2011 09:02 PM, Alex Milojkovic wrote: > Scenario of botnet with 1000 PCs making attempts to crack are password ain't > gonna happen. > On one system that I run, for a fairly popular domain, I see botnet attacks trying to break in to the pop and ftp ports as well as botnet spam and SASL a

Re: [CentOS] an actual hacked machine, in a preserved state

2012-01-01 Thread Bennett Haselton
On Sun, Jan 1, 2012 at 2:55 PM, Eero Volotinen wrote: > 2012/1/2 Bennett Haselton : > > (Sorry, third time -- last one, promise, just giving it a subject line!) > > > > OK, a second machine hosted at the same hosting company has also > apparently > > been hacked. Since 2 of out of 3 machines host

Re: [CentOS] Centos 6.X compatible to ORACLE DB verssion????

2012-01-01 Thread Christopher J. Buckley
On 29 December 2011 19:15, Johnny Hughes wrote: > They can't very well (at least not with a straight face) tell Red Hat > that RHEL6 is not certified while saying that OEL6 is certified can > they?  If they do that for very long, they will be breaching their > support agreements. Really? In what

Re: [CentOS] an actual hacked machine, in a preserved state

2012-01-01 Thread Rilindo Foster
On Jan 1, 2012, at 5:23 PM, Bennett Haselton wrote: > (Sorry, third time -- last one, promise, just giving it a subject line!) > > OK, a second machine hosted at the same hosting company has also apparently > been hacked. Since 2 of out of 3 machines hosted at that company have now > been hac

Re: [CentOS] an actual hacked machine, in a preserved state

2012-01-01 Thread Les Mikesell
On Sun, Jan 1, 2012 at 4:23 PM, Bennett Haselton wrote: > > So, following people's suggestions, the machine is disconnected and hooked > up to a KVM so I can still examine the files.  I've found this file: > -rw-r--r-- 1 root root 1358 Oct 21 17:40 /home/file.pl > which appears to be a copy of thi

Re: [CentOS] an actual hacked machine, in a preserved state

2012-01-01 Thread Ljubomir Ljubojevic
On 01/02/2012 12:27 AM, Bennett Haselton wrote: > On Sun, Jan 1, 2012 at 2:55 PM, Eero Volotinenwrote: > >> 2012/1/2 Bennett Haselton: >>> (Sorry, third time -- last one, promise, just giving it a subject line!) >>> >>> OK, a second machine hosted at the same hosting company has also >> apparently

Re: [CentOS] an actual hacked machine, in a preserved state

2012-01-01 Thread Bennett Haselton
On Sun, Jan 1, 2012 at 4:57 PM, Rilindo Foster wrote: > > > On Jan 1, 2012, at 5:23 PM, Bennett Haselton > wrote: > > > (Sorry, third time -- last one, promise, just giving it a subject line!) > > > > OK, a second machine hosted at the same hosting company has also > apparently > > been hacked.

Re: [CentOS] an actual hacked machine, in a preserved state

2012-01-01 Thread RILINDO FOSTER
≈On Jan 1, 2012, at 8:24 PM, Bennett Haselton wrote: > On Sun, Jan 1, 2012 at 4:57 PM, Rilindo Foster wrote: > >> >> >> On Jan 1, 2012, at 5:23 PM, Bennett Haselton >> wrote: >> >>> (Sorry, third time -- last one, promise, just giving it a subject line!) >>> >>> OK, a second machine hosted

Re: [CentOS] an actual hacked machine, in a preserved state

2012-01-01 Thread Bennett Haselton
On Sun, Jan 1, 2012 at 5:33 PM, RILINDO FOSTER wrote: > ≈On Jan 1, 2012, at 8:24 PM, Bennett Haselton wrote: > > > On Sun, Jan 1, 2012 at 4:57 PM, Rilindo Foster wrote: > > > >> > >> > >> On Jan 1, 2012, at 5:23 PM, Bennett Haselton > >> wrote: > >> > >>> (Sorry, third time -- last one, promise

Re: [CentOS] an actual hacked machine, in a preserved state

2012-01-01 Thread RILINDO FOSTER
On Jan 1, 2012, at 8:50 PM, Bennett Haselton wrote: > On Sun, Jan 1, 2012 at 5:33 PM, RILINDO FOSTER wrote: > >> ≈On Jan 1, 2012, at 8:24 PM, Bennett Haselton wrote: >> >>> On Sun, Jan 1, 2012 at 4:57 PM, Rilindo Foster wrote: >>> On Jan 1, 2012, at 5:23 PM, Bennett Haselton

Re: [CentOS] an actual hacked machine, in a preserved state

2012-01-01 Thread Bennett Haselton
On Sun, Jan 1, 2012 at 5:01 PM, Les Mikesell wrote: > On Sun, Jan 1, 2012 at 4:23 PM, Bennett Haselton > wrote: > > > > So, following people's suggestions, the machine is disconnected and > hooked > > up to a KVM so I can still examine the files. I've found this file: > > -rw-r--r-- 1 root root

Re: [CentOS] an actual hacked machine, in a preserved state

2012-01-01 Thread Fajar Priyanto
On Mon, Jan 2, 2012 at 9:33 AM, RILINDO FOSTER wrote: > The script in question is an exploit from a web board which is apparently > designed to pull outside traffic. If you had SELinux, it would put httpd in > its own context and by default, it will NOT allow connections from that > context to

Re: [CentOS] an actual hacked machine, in a preserved state

2012-01-01 Thread Ljubomir Ljubojevic
On 01/02/2012 02:50 AM, Bennett Haselton wrote: > I'm not sure what you mean by "an exploit from a web board which is > apparently designed to pull outside traffic". Like Ljubomir said, it looks > like a script that is used from machine X to DOS attack machine Y, if > machine Y has the VBulletin b

Re: [CentOS] an actual hacked machine, in a preserved state

2012-01-01 Thread Bennett Haselton
On Sun, Jan 1, 2012 at 6:03 PM, Fajar Priyanto wrote: > On Mon, Jan 2, 2012 at 9:33 AM, RILINDO FOSTER wrote: > > The script in question is an exploit from a web board which is > apparently designed to pull outside traffic. If you had SELinux, it would > put httpd in its own context and by defau

Re: [CentOS] what percent of time are there unpatched exploits against default config?

2012-01-01 Thread Joseph L. Casale
> Does ipset work with the existing kernel under CentOS 5 and if so is there an > RPM available? > I've goggled around a bit, but haven't found anything. From > http://ipset.netfilter.org/ I'm led > to believe that the current kernel should support it. Well, you have modules on your system, an

Re: [CentOS] what percent of time are there unpatched exploits against default config?

2012-01-01 Thread Alex Milojkovic
I actually found a link on Apnic's web site to their IPv4 netblocks which helped me eliminate their traffic. http://www.apnic.net/publications/research-and-insights/ip-address-trends/ap nic-resource-range This solved most of my problems. There are not as many lines as one would expect. Just go to

[CentOS] Can't find qemu-kvm

2012-01-01 Thread Mark LaPierre
I just installed CentOS 6.2 32 bit today. When I try to start the Virtual Machine Manager I get a error: Packages required for KVM usage The following packages are not installed: qemu-kvm These are required to create KVM guests locally. Would you like to install them now? If I click on the [

Re: [CentOS] Can't find qemu-kvm

2012-01-01 Thread Digimer
On 01/02/2012 01:49 AM, Mark LaPierre wrote: > I just installed CentOS 6.2 32 bit today. When I try to start the > Virtual Machine Manager I get a error: > > Packages required for KVM usage > > The following packages are not installed: > > qemu-kvm > > These are required to create KVM guests