KCLUG

kclug@kclug.org

10 participants
3254 discussions

Hospital
by mike＠handuma.com 02 Mar '05

02 Mar '05

I went to visit Chris at KU. He's doin' fine. He was in the hospital because his humerus needed a little bit of bone transplant. The surgical steel plate in his forearm needed replacing too. When I saw him he was wide awake, mostly achin' to get to tonights meetin'. Michael handuma.com http://www.handuma.com

1 0

Trojan Found
by Jonathan Hutchins 01 Mar '05

01 Mar '05

I found a trojan running on my server today - rootedoor (http://vil.mcafeesecurity.com/vil/content/v_128116.htm). Couldn't find much information about it on the web. If you know anything specific about it (not general speculation on rootkits, trojans, etc.), I would appreciate you sharing it with the list. I detected it running as one of the last two processes listed by 'ps ax' just before a reboot to install a new kernel; the reboot seems to have elimiated all traces of it from the system. I found a number of missing or corrupt perl modules on the system, but that may not be related, it's an old system and I've had some perl issues before. This _is_ the system that suddenly lost all it's files Sunday night, so it could have been hacked before.

4 13

Costa Rica May Criminalize VoIP
by Brian Kelsay 01 Mar '05

01 Mar '05

http://yro.slashdot.org/article.pl?sid=05/02/28/2231247&tid=215&tid=95&tid=… Is Greg Kedrovsky still there or amI confused and it's Puerto Rico and someone else in the group? I really should sleep more. Brian Kelsay

2 1

eight pounds two ounces twentytwo inches
by David Nicol 01 Mar '05

01 Mar '05

Aurora Nicol is here!

1 0

Sir Dork
by Brian Kelsay 01 Mar '05

01 Mar '05

http://slashdot.org/article.pl?sid=05/03/01/1731228&tid=109 Brian Kelsay

1 0

Re: Server Fundraiser
by Brian Kelsay 01 Mar '05

01 Mar '05

Those could also be mailed to Bill. He posted his address in here a week or two ago. Brian Kelsay >>> Dave Hull <> 03/01/05 03:55PM >>> Quoting Brian Kelsay <>: > At the regularly scheduled KCLUG Meeting tomorrow I will collect more funds > for the LUG server upgrades. Anyone from Lawrence attending the meeting tomorrow and willing to ferry a check? -- Dave Hull

1 0

Server Fundraiser
by Brian Kelsay 01 Mar '05

01 Mar '05

At the regularly scheduled KCLUG Meeting tomorrow I will collect more funds for the LUG server upgrades. I believe we are about $60 from our goal so that bigger, better drives and a controller can be purchased. Chris Bier will not be present at the meeting and I'm not sure about Bill C., so I will make sure the funds get to one of them in time for the hardware purchase. Only give if you are able. Checks can be made out to Bill Cavalieri w/ a ref. to KCLUG Server Fund in the memo. Brian Kelsay

3 2

Re: Trojan Found
by Brian Kelsay 28 Feb '05

28 Feb '05

Do these 2 tools work with the standard .debs I grab when I update my PC? Still figuring some intricacies of Debian out. Brian Kelsay >>> Chris Bier <chris.bier(a)cymor.com> 02/28/05 01:22PM >>> | | On this note, other than CRC checking and MD5 checksum options, | | is there any kind of an equivalent with Debian for this type of | | check? I'm guessing no | <snip /> | | debsig-verify | | http://www.linuxmafia.com/faq/Debian/package-signing.html | also dpkg-sig

1 0

RE: Trojan Found
by Brian Densmore 28 Feb '05

28 Feb '05

> -----Original Message----- > From: Jonathan Hutchins > > ... I did a CRC check against ALL of the system files. They're > fine. I checked > RPM before I used it to check the rest of the system. > > RPM's a great tool for a lot of things, including verifying > system integrity. ... > > It's VERY hard to hack an RPM system in such a way as to > conceal tampering > with files within the packages. Not impossible, but hard in > a way that the > low-level simplicity of rootedoor tends to contraindicate. > On this note, other than CRC checking and MD5 checksum options, is there any kind of an equivalent with Debian for this type of check? I'm guessing no. Although, it might be possible to build an rpm database of installed software on a Debian box and then use that as an additional check. Of course there's nothing, stopping a cunning cracker from building an RPM database, setting the timestamp and copying it onto the cracked system. Something possible with Jonathon's box too. Jonathon, was your check done with a local copy of the RPM database, or an archived known good copy? Certainly, if I were a cracker, installing a new copy of the RPM database would be part of my initial and every subsequent loading of software onto a cracked system. After all, to be successful at cracking it best to remain undetected. Brian

3 3

RE: Trojan Found
by Charles, Joshua Micah (UMKC-Student) 28 Feb '05

28 Feb '05

>Tucson, in fact. The manager at the ISP down there mounted the drive in a "spare" server running RH9 on VMWare, and gave me ssh access to it. I >reformatted the partitions and used rsync to reinstall. It took many hours, >even though it was only about 2.5G of data. I could have filtered it a >little better and used compression to speed it up some, but with the low >upstream bandwidth from RR it was just slow. I'm a niave person that has absolutely no knowledge of how to administer a server. That said, what is the possibiliy that the machine you rsync'd from has been compromised?

2 1

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

KCLUG