Re: [CentOS] an actual hacked machine, in a preserved state

2012-01-02 Thread Craig White
On Sun, 2012-01-01 at 14:23 -0800, Bennett Haselton wrote: > (Sorry, third time -- last one, promise, just giving it a subject line!) > > OK, a second machine hosted at the same hosting company has also apparently > been hacked. Since 2 of out of 3 machines hosted at that company have now > been

Re: [CentOS] Can't find qemu-kvm

2012-01-02 Thread Akemi Yagi
On Sun, Jan 1, 2012 at 10:49 PM, Mark LaPierre wrote: > I just installed CentOS 6.2 32 bit today.  When I try to start the > Virtual Machine Manager I get a error: > > Packages required for KVM usage > > The following packages are not installed: > > qemu-kvm KVM is not available for 32-bit. You n

Re: [CentOS] an actual hacked machine, in a preserved state

2012-01-02 Thread Bennett Haselton
On Mon, Jan 2, 2012 at 12:04 AM, Craig White wrote: > On Sun, 2012-01-01 at 14:23 -0800, Bennett Haselton wrote: > > (Sorry, third time -- last one, promise, just giving it a subject line!) > > > > OK, a second machine hosted at the same hosting company has also > apparently > > been hacked. Sin

Re: [CentOS] an actual hacked machine, in a preserved state

2012-01-02 Thread Bennett Haselton
On Sun, Jan 1, 2012 at 6:04 PM, Ljubomir Ljubojevic wrote: > On 01/02/2012 02:50 AM, Bennett Haselton wrote: > > I'm not sure what you mean by "an exploit from a web board which is > > apparently designed to pull outside traffic". Like Ljubomir said, it > looks > > like a script that is used fro

Re: [CentOS] an actual hacked machine, in a preserved state

2012-01-02 Thread Johnny Hughes
On 01/02/2012 02:04 AM, Craig White wrote: > On Sun, 2012-01-01 at 14:23 -0800, Bennett Haselton wrote: >> (Sorry, third time -- last one, promise, just giving it a subject line!) >> >> OK, a second machine hosted at the same hosting company has also apparently >> been hacked. Since 2 of out of 3

Re: [CentOS] Centos 6.X compatible to ORACLE DB verssion????

2012-01-02 Thread Johnny Hughes
On 01/01/2012 06:07 PM, Christopher J. Buckley wrote: > On 29 December 2011 19:15, Johnny Hughes wrote: >> They can't very well (at least not with a straight face) tell Red Hat >> that RHEL6 is not certified while saying that OEL6 is certified can >> they? If they do that for very long, they will

Re: [CentOS] Centos 6.X compatible to ORACLE DB verssion????

2012-01-02 Thread Hakan Koseoglu
On 2 January 2012 15:46, Johnny Hughes wrote: > And my point is, right now Oracle can say that they have not certified > their own OEL6 either ... therefore, one can not expect RHEL6 to be > certified either.  If they certify OEL6 for a version of Oracle > Database, it would be difficult for them

Re: [CentOS] an actual hacked machine, in a preserved state

2012-01-02 Thread Les Mikesell
On Mon, Jan 2, 2012 at 6:03 AM, Bennett Haselton wrote: > > I tried SELinux but it broke so much needed functionality on the server > that it was not an option. Pretty much all of the stock programs work with SELinux, so this by itself implies that you are running 3rd party or local apps that hav

Re: [CentOS] an actual hacked machine, in a preserved state

2012-01-02 Thread Lorenzo Martínez Rodríguez
Hello, just if it helps, please find below these lines the steps I have used to analyze several suspicious machines in some customers, to check if they have been compromised or not: * Chrootkit && rkhunter -> To search for known trojans and common linux malware. * unhide (http://www.unhide-for

Re: [CentOS] Can't find qemu-kvm

2012-01-02 Thread Mark LaPierre
On 01/02/2012 03:19 AM, Akemi Yagi wrote: > On Sun, Jan 1, 2012 at 10:49 PM, Mark LaPierre wrote: >> I just installed CentOS 6.2 32 bit today. When I try to start the >> Virtual Machine Manager I get a error: >> >> Packages required for KVM usage >> >> The following packages are not installed: >>

[CentOS] probleme with my wifi card on centos 6

2012-01-02 Thread fakessh
Hello list 6 centos I wish you a very good year for this festive period I am writing to report a problem I encounter with my wireless card realtek 8150 the installer does not detect the device so the /etc/sysconfig/network-script/ifcfg-wlan0 is absent I can not find the driver for the deposit e

[CentOS] 'last' command doesn't include ssh connections made by this perl script?

2012-01-02 Thread Bennett Haselton
My home machine has IP 50.54.225.130. I have (for the purposes of this experiment) one remote machine at www.peacefire.org (69.72.177.140) and another at www.junkwhale.com. When I'm logged in to peacefire, I run this perl script to open an ssh connection to junkwhale and run a command: my $hostn

Re: [CentOS] probleme with my wifi card on centos 6

2012-01-02 Thread Ljubomir Ljubojevic
On 01/02/2012 09:58 PM, fakessh wrote: > I am writing to report a problem I encounter with my wireless card > realtek 8150 > the installer does not detect the device so the > /etc/sysconfig/network-script/ifcfg-wlan0 is absent > Realtek 8150 is USB LAN NIC, not the wireless one. Drivers for it are

[CentOS] raid resync deleting data?

2012-01-02 Thread Nathan
Hello, I have a c5 box with a 6 drive raid 6 array. I was going away over Christmas so I was shutting the machine down, I noticed a raid resync (on the raid 6 array) so i stopped it, using the command # echo "idle" > /sys/block/md5/md/sync_action then shut the machine down. A week later I tur

Re: [CentOS] Can't find qemu-kvm

2012-01-02 Thread Ljubomir Ljubojevic
On 01/02/2012 09:49 PM, Mark LaPierre wrote: > On 01/02/2012 03:19 AM, Akemi Yagi wrote: >> On Sun, Jan 1, 2012 at 10:49 PM, Mark LaPierre wrote: >>> I just installed CentOS 6.2 32 bit today. When I try to start the >>> Virtual Machine Manager I get a error: >>> >>> Packages required for KVM usa

Re: [CentOS] 'last' command doesn't include ssh connections made by this perl script?

2012-01-02 Thread Nataraj
On 01/02/2012 03:04 PM, Bennett Haselton wrote: > My home machine has IP 50.54.225.130. I have (for the purposes of this > experiment) one remote machine at www.peacefire.org (69.72.177.140) and > another at www.junkwhale.com. In general it is better not to post actual hostnames and IP addresses o

Re: [CentOS] 'last' command doesn't include ssh connections made by this perl script?

2012-01-02 Thread Stephen Harris
On Mon, Jan 02, 2012 at 03:04:07PM -0800, Bennett Haselton wrote: > This makes me wonder two things: > 1) What is the difference, from the server's point of view, between the > connection opened by the script and the one opened by my ssh client; and Spot the difference between ssh remotemachine

Re: [CentOS] probleme with my wifi card on centos 6

2012-01-02 Thread fakessh
Le 2012-01-03 00:15, Ljubomir Ljubojevic a écrit : > On 01/02/2012 09:58 PM, fakessh wrote: >> I am writing to report a problem I encounter with my wireless card >> realtek 8150 >> the installer does not detect the device so the >> /etc/sysconfig/network-script/ifcfg-wlan0 is absent >> > > Realtek

Re: [CentOS] probleme with my wifi card on centos 6

2012-01-02 Thread fakessh @
Le mardi 03 janvier 2012 à 02:02 +0100, fakessh a écrit : > Le 2012-01-03 00:15, Ljubomir Ljubojevic a écrit : > > On 01/02/2012 09:58 PM, fakessh wrote: > >> I am writing to report a problem I encounter with my wireless card > >> realtek 8150 > >> the installer does not detect the device so the >

Re: [CentOS] Can't find qemu-kvm

2012-01-02 Thread Mark LaPierre
On 01/02/2012 06:26 PM, Ljubomir Ljubojevic wrote: > On 01/02/2012 09:49 PM, Mark LaPierre wrote: >> On 01/02/2012 03:19 AM, Akemi Yagi wrote: >>> On Sun, Jan 1, 2012 at 10:49 PM, Mark LaPierrewrote: I just installed CentOS 6.2 32 bit today. When I try to start the Virtual Machine Ma

Re: [CentOS] probleme with my wifi card on centos 6

2012-01-02 Thread Ljubomir Ljubojevic
On 01/03/2012 02:15 AM, fakessh @ wrote: > > Le mardi 03 janvier 2012 à 02:02 +0100, fakessh a écrit : >> Le 2012-01-03 00:15, Ljubomir Ljubojevic a écrit : >>> On 01/02/2012 09:58 PM, fakessh wrote: I am writing to report a problem I encounter with my wireless card realtek 8150 the

Re: [CentOS] probleme with my wifi card on centos 6

2012-01-02 Thread fakessh
Le 2012-01-03 02:21, Ljubomir Ljubojevic a écrit : > On 01/03/2012 02:15 AM, fakessh @ wrote: >> >> Le mardi 03 janvier 2012 à 02:02 +0100, fakessh a écrit : >>> Le 2012-01-03 00:15, Ljubomir Ljubojevic a écrit : On 01/02/2012 09:58 PM, fakessh wrote: > I am writing to report a problem I e

Re: [CentOS] probleme with my wifi card on centos 6

2012-01-02 Thread Ljubomir Ljubojevic
On 01/03/2012 02:33 AM, fakessh wrote: > Le 2012-01-03 02:21, Ljubomir Ljubojevic a écrit : >> On 01/03/2012 02:15 AM, fakessh @ wrote: >>> >>> Le mardi 03 janvier 2012 à 02:02 +0100, fakessh a écrit : Le 2012-01-03 00:15, Ljubomir Ljubojevic a écrit : > On 01/02/2012 09:58 PM, fakessh wro

Re: [CentOS] probleme with my wifi card on centos 6

2012-01-02 Thread Ljubomir Ljubojevic
On 01/03/2012 02:44 AM, Ljubomir Ljubojevic wrote: > But there is Realtek's source you can compile: > http://www.realtek.com/downloads/downloadsView.aspx?Langid=1&PNid=1&PFid=1&Level=6&Conn=5&DownTypeID=3&GetDown=false&Downloads=true#RTL8185L > > Also look at http://rtl8180-sa2400.sourceforge.net/

Re: [CentOS] an actual hacked machine, in a preserved state

2012-01-02 Thread Bennett Haselton
On 1/2/2012 9:18 AM, Les Mikesell wrote: > On Mon, Jan 2, 2012 at 6:03 AM, Bennett Haselton > wrote: >> I tried SELinux but it broke so much needed functionality on the server >> that it was not an option. > Pretty much all of the stock programs work with SELinux, so this by > itself implies that

Re: [CentOS] probleme with my wifi card on centos 6

2012-01-02 Thread fakessh
Le 2012-01-03 02:44, Ljubomir Ljubojevic a écrit : > On 01/03/2012 02:33 AM, fakessh wrote: >> Le 2012-01-03 02:21, Ljubomir Ljubojevic a écrit : >>> On 01/03/2012 02:15 AM, fakessh @ wrote: Le mardi 03 janvier 2012 à 02:02 +0100, fakessh a écrit : > Le 2012-01-03 00:15, Ljubomir Ljub

Re: [CentOS] an actual hacked machine, in a preserved state

2012-01-02 Thread Bennett Haselton
On 1/2/2012 9:18 AM, Les Mikesell wrote: > There have been many, many vulnerabilities that permit local user > privilege escalation to root (in the kernel, glibc, suid programs, > etc.) and there are probably many we still don't know about. They > often require writing to the filesystem. For examp

Re: [CentOS] an actual hacked machine, in a preserved state

2012-01-02 Thread Ljubomir Ljubojevic
On 01/03/2012 03:30 AM, Bennett Haselton wrote: > In other words, when SELinux causes a problem, it can take hours or days > to find out that SELinux is the cause -- and even then you're not done, > because you have to figure out a workaround if you want to fix the > problem while keeping SELinux t

Re: [CentOS] vsftpd log issues

2012-01-02 Thread Nataraj
On 12/31/2011 02:48 AM, Timo Neuvonen wrote: > I have an up-to-date CentOS 6 with reasonable amount of ftp activity (a > dozen of network cameras uploading images every second 24x7). > > The first issue was that the whole /var filesystem was about to get full, > because of huge ftp daemon log. > >

Re: [CentOS] an actual hacked machine, in a preserved state

2012-01-02 Thread Harold Pritchett
On 1/2/2012 9:41 PM, Ljubomir Ljubojevic wrote: > On 01/03/2012 03:30 AM, Bennett Haselton wrote: >> In other words, when SELinux causes a problem, it can take hours or days >> to find out that SELinux is the cause -- and even then you're not done, >> because you have to figure out a workaround if

[CentOS] Request for suggestion of a SCM package for Centos 6

2012-01-02 Thread Rajagopal Swaminathan
Greetings, I have a freshly installed Centos 6.2 box with everything (darn! I had to hand select each and every package -- IIRC one of the fedora versions had a nice "select all" checkbox). My questions are: 1. Can somebody suggest a way to select all packages while installing from DVD? 2. Can s

Re: [CentOS] an actual hacked machine, in a preserved state

2012-01-02 Thread Les Mikesell
On Mon, Jan 2, 2012 at 8:30 PM, Bennett Haselton wrote: >  What apps are those (i.e. the ones that >> SELinux would have broken) and if they are open source, have those >> projects updated the app or the underlying language(s)/libraries since >> you have? > > So here's a perfect example.  I insta

Re: [CentOS] an actual hacked machine, in a preserved state

2012-01-02 Thread RILINDO FOSTER
On Jan 2, 2012, at 9:37 PM, Bennett Haselton wrote: > On 1/2/2012 9:18 AM, Les Mikesell wrote: >> There have been many, many vulnerabilities that permit local user >> privilege escalation to root (in the kernel, glibc, suid programs, >> etc.) and there are probably many we still don't know about.

Re: [CentOS] an actual hacked machine, in a preserved state

2012-01-02 Thread RILINDO FOSTER
On Jan 2, 2012, at 9:30 PM, Bennett Haselton wrote: > On 1/2/2012 9:18 AM, Les Mikesell wrote: >> On Mon, Jan 2, 2012 at 6:03 AM, Bennett Haselton >> wrote: >>> I tried SELinux but it broke so much needed functionality on the server >>> that it was not an option. >> Pretty much all of the stock

Re: [CentOS] Request for suggestion of a SCM package for Centos 6

2012-01-02 Thread Les Mikesell
On Mon, Jan 2, 2012 at 9:46 PM, Rajagopal Swaminathan wrote: > 2. Can somebody suggest a versioning system which integrates well with > a bug tracking system (I had installed Subversion with Trac more than > a couple of years back on Centos 5.x for some customer -- but it was a > kludge as it requ

Re: [CentOS] an actual hacked machine, in a preserved state

2012-01-02 Thread Bennett Haselton
On 1/2/2012 8:11 PM, RILINDO FOSTER wrote: > On Jan 2, 2012, at 9:30 PM, Bennett Haselton wrote: > >> On 1/2/2012 9:18 AM, Les Mikesell wrote: >>> On Mon, Jan 2, 2012 at 6:03 AM, Bennett Haselton >>> wrote: I tried SELinux but it broke so much needed functionality on the server that it

Re: [CentOS] an actual hacked machine, in a preserved state

2012-01-02 Thread Bennett Haselton
On 1/2/2012 7:48 PM, Les Mikesell wrote: > On Mon, Jan 2, 2012 at 8:30 PM, Bennett Haselton > wrote: > >>What apps are those (i.e. the ones that >>> SELinux would have broken) and if they are open source, have those >>> projects updated the app or the underlying language(s)/libraries since >>

Re: [CentOS] an actual hacked machine, in a preserved state

2012-01-02 Thread Les Mikesell
On Tue, Jan 3, 2012 at 12:23 AM, Bennett Haselton wrote: > > So I stand by the statement that SELinux is more likely to cause > problems that are hard to figure out for people who aren't professional > admins. Don't think anyone claims otherwise. Or that security is easy. > And then there's th

Re: [CentOS] an actual hacked machine, in a preserved state

2012-01-02 Thread Bennett Haselton
On 1/2/2012 7:29 AM, Johnny Hughes wrote: > On 01/02/2012 02:04 AM, Craig White wrote: >> On Sun, 2012-01-01 at 14:23 -0800, Bennett Haselton wrote: >>> (Sorry, third time -- last one, promise, just giving it a subject line!) >>> >>> OK, a second machine hosted at the same hosting company has also

Re: [CentOS] an actual hacked machine, in a preserved state

2012-01-02 Thread John R. Dennison
On Mon, Jan 02, 2012 at 10:41:15PM -0800, Bennett Haselton wrote: > > Again, you don't have to take my word for it -- in the first 10 Google > hits of pages with people posting about the problem I ran into, none of > the people helping them, thought to suggest SELinux as the cause of the > prob

Re: [CentOS] an actual hacked machine, in a preserved state

2012-01-02 Thread Les Mikesell
On Tue, Jan 3, 2012 at 12:41 AM, Bennett Haselton wrote: >> Standard/non-standard isn't the point. The point is to control what an >> app can do even if some unexpected flaw lets it execute arbitrary >> code. > What's the scenario where this port restriction would make a > difference?  Suppose an