Re: Chkrootkit - true/false ?

2004-05-21 Thread Jason Lim
> > Checking `lkm'... You have 3 process hidden for readdir command > > You have 3 process hidden for ps command > > Warning: Possible LKM Trojan installed > > > > Sometimes chkrootkit returns nothing detected and every time rkhunter > > tells me nothing is wrong. Is this a false positive w

Re: Chkrootkit - true/false ?

2004-05-21 Thread Jason Lim
> > Checking `lkm'... You have 3 process hidden for readdir command > > You have 3 process hidden for ps command > > Warning: Possible LKM Trojan installed > > > > Sometimes chkrootkit returns nothing detected and every time rkhunter > > tells me nothing is wrong. Is this a false positive w

Re: multiple IP addresses cause ZONE TRANSFER to fail.

2004-05-21 Thread Christian Storch
Perhaps options { ... query-source address 209.113.151.7 port 53; ... }; would help. Christian - Original Message - From: "Andrew P. Kaplan" <[EMAIL PROTECTED]> To: "Debian-Isp" Sent: Friday, May 21, 2004 6:23 PM Subject: multiple IP addresses cause ZONE TRANSFER to fail. > My Debia

Re: Chkrootkit - true/false ?

2004-05-21 Thread Myke Place
* David Ross ([EMAIL PROTECTED]) [040521 01:55] spake thusly: > Checking `lkm'... You have 3 process hidden for readdir command > You have 3 process hidden for ps command > Warning: Possible LKM Trojan installed > > Sometimes chkrootkit returns nothing detected and every time rkhunter >

Re: Chkrootkit - true/false ?

2004-05-21 Thread August MacBeth
yeah. i think there are some bug reports on chkrootkit / woody. if you run it again right after, you shouldn't get the message again. (i personally prefer rkhunter) :) http://tinyurl.com/3fddn ~august David Ross wrote: Hi I have rkhunter and chkrootkit running in a cron job every morning and e

Re: multiple IP addresses cause ZONE TRANSFER to fail.

2004-05-21 Thread Andreas John
Are you looking for somethings like that? /etc/bind/named.conf.options [included via include "/etc/bind/named.conf.options"; in /etc/bind/named.conf] [snip] version "Windows 3.11"; notify yes; query-source address 209.113.151.7; notify-source 209.113.151.7;

Question about Exim

2004-05-21 Thread Phillip Hofmeister
Greetings everyone, I set up an Exim mail filter file containing the following: # Exim filter if $h_X-Amavis-Hold contains " " then freeze endif Is there a better condition that will test just for the existence of the header? I have tried def: without any luck. If anyone knows how, that wo

Re: multiple IP addresses cause ZONE TRANSFER to fail.

2004-05-21 Thread Christian Storch
Perhaps options { ... query-source address 209.113.151.7 port 53; ... }; would help. Christian - Original Message - From: "Andrew P. Kaplan" <[EMAIL PROTECTED]> To: "Debian-Isp" <[EMAIL PROTECTED]> Sent: Friday, May 21, 2004 6:23 PM Subject: multiple IP addresses cause ZONE TRANSFER to

multiple IP addresses cause ZONE TRANSFER to fail.

2004-05-21 Thread Andrew P. Kaplan
My Debian box has two IP's running BIND 9. 209.113.151.5 and 209.113.151.7. BIND is setup to listen on 209.113.151.7 and act as a slave server. However, it makes the zone transfer from 209.113.151.5. The master server blocks these request. Is there a way to make the request come from 209.113.151.7

Re: Chkrootkit - true/false ?

2004-05-21 Thread Myke Place
* David Ross ([EMAIL PROTECTED]) [040521 01:55] spake thusly: > Checking `lkm'... You have 3 process hidden for readdir command > You have 3 process hidden for ps command > Warning: Possible LKM Trojan installed > > Sometimes chkrootkit returns nothing detected and every time rkhunter >

Re: Chkrootkit - true/false ?

2004-05-21 Thread August MacBeth
yeah. i think there are some bug reports on chkrootkit / woody. if you run it again right after, you shouldn't get the message again. (i personally prefer rkhunter) :) http://tinyurl.com/3fddn ~august David Ross wrote: Hi I have rkhunter and chkrootkit running in a cron job every morning and e

Re: multiple IP addresses cause ZONE TRANSFER to fail.

2004-05-21 Thread Andreas John
Are you looking for somethings like that? /etc/bind/named.conf.options [included via include "/etc/bind/named.conf.options"; in /etc/bind/named.conf] [snip] version "Windows 3.11"; notify yes; query-source address 209.113.151.7; notify-source 209.113.151.7;

Question about Exim

2004-05-21 Thread Phillip Hofmeister
Greetings everyone, I set up an Exim mail filter file containing the following: # Exim filter if $h_X-Amavis-Hold contains " " then freeze endif Is there a better condition that will test just for the existence of the header? I have tried def: without any luck. If anyone knows how, that wo

multiple IP addresses cause ZONE TRANSFER to fail.

2004-05-21 Thread Andrew P. Kaplan
My Debian box has two IP's running BIND 9. 209.113.151.5 and 209.113.151.7. BIND is setup to listen on 209.113.151.7 and act as a slave server. However, it makes the zone transfer from 209.113.151.5. The master server blocks these request. Is there a way to make the request come from 209.113.151.7

Re: Rotating mail.log daily: a problem

2004-05-21 Thread Stephane Bortzmeyer
On Fri, May 21, 2004 at 09:59:59AM -0400, Dominique Fortier <[EMAIL PROTECTED]> wrote a message of 52 lines which said: > rotate 52<- that does'nt seem right Why? logrotate(1) rotate count Log files are rotated count times before being removed or mailed

Re: Rotating mail.log daily: a problem

2004-05-21 Thread Brett Parker
On Fri, May 21, 2004 at 03:20:02PM +0200, Stephane Bortzmeyer wrote: > I try to rotate the mail logs of a big mail server more often than the > default (weekly). > > I added this to /etc/logrotate.d : > > # http://lists.debian.org/debian-devel/2003/09/msg01310.html > # sysklogd rotates file and "

Re: Rotating mail.log daily: a problem

2004-05-21 Thread Dominique Fortier
Stephane Bortzmeyer a écrit : I try to rotate the mail logs of a big mail server more often than the default (weekly). I added this to /etc/logrotate.d : # http://lists.debian.org/debian-devel/2003/09/msg01310.html # sysklogd rotates file and "weekly" is hardwired in it. We add this file # to over

Rotating mail.log daily: a problem

2004-05-21 Thread Stephane Bortzmeyer
I try to rotate the mail logs of a big mail server more often than the default (weekly). I added this to /etc/logrotate.d : # http://lists.debian.org/debian-devel/2003/09/msg01310.html # sysklogd rotates file and "weekly" is hardwired in it. We add this file # to override it. /var/log/mail.log

Re: Rotating mail.log daily: a problem

2004-05-21 Thread Stephane Bortzmeyer
On Fri, May 21, 2004 at 09:59:59AM -0400, Dominique Fortier <[EMAIL PROTECTED]> wrote a message of 52 lines which said: > rotate 52<- that does'nt seem right Why? logrotate(1) rotate count Log files are rotated count times before being removed or mailed

Re: Rotating mail.log daily: a problem

2004-05-21 Thread Brett Parker
On Fri, May 21, 2004 at 03:20:02PM +0200, Stephane Bortzmeyer wrote: > I try to rotate the mail logs of a big mail server more often than the > default (weekly). > > I added this to /etc/logrotate.d : > > # http://lists.debian.org/debian-devel/2003/09/msg01310.html > # sysklogd rotates file and "

Re: Rotating mail.log daily: a problem

2004-05-21 Thread Dominique Fortier
Stephane Bortzmeyer a écrit : I try to rotate the mail logs of a big mail server more often than the default (weekly). I added this to /etc/logrotate.d : # http://lists.debian.org/debian-devel/2003/09/msg01310.html # sysklogd rotates file and "weekly" is hardwired in it. We add this file # to over

Rotating mail.log daily: a problem

2004-05-21 Thread Stephane Bortzmeyer
I try to rotate the mail logs of a big mail server more often than the default (weekly). I added this to /etc/logrotate.d : # http://lists.debian.org/debian-devel/2003/09/msg01310.html # sysklogd rotates file and "weekly" is hardwired in it. We add this file # to override it. /var/log/mail.log

Chkrootkit - true/false ?

2004-05-21 Thread David Ross
Hi I have rkhunter and chkrootkit running in a cron job every morning and every now and again I get chkrootkit results like this: Checking `lkm'... You have 3 process hidden for ps command Warning: Possible LKM Trojan installed And sometimes this: Checking `lkm'... You have 3 process h

Chkrootkit - true/false ?

2004-05-21 Thread David Ross
Hi I have rkhunter and chkrootkit running in a cron job every morning and every now and again I get chkrootkit results like this: Checking `lkm'... You have 3 process hidden for ps command Warning: Possible LKM Trojan installed And sometimes this: Checking `lkm'... You have 3 process h

Re: high performance, highly available web clusters

2004-05-21 Thread Jeremy Zawodny
On May 20, 2004, at 9:27 AM, David Wilk wrote: Now, here's the other question. Now that the web cluster can scale the static content ad infinitum, what about the dynamic content? What can be done with Mysql to load balance? currently they do what everyone does with two stand-alone Mysql servers