- wlug - list.wlug.org.nz

ragger's newbie again: to make a file executable
by sable drum 12 Aug '03

12 Aug '03

hi! i am learning how to use cdroast on mandrake 9.0. i have checked that the ide-scsi diver is indeed loaded and i can check that i have a functional burner at cd level using cdrecord -scanbus. both parts a-ok! now, along with wlug advice from last week or so, i am using advice from this article http://www.linuxjournal.com/article.php?sid5800 and am stuck at the part that says "make file executable" using chmod and g group something this feels really silly but i cannot figure out what is the correct file name for my file -- i use the one that is on the file as displayed in the file manager but chmod does not find it. what am i doing wrong???? thanks folks from me here in raggers town is overcast and it is full moon, which is always dangerous on one level or another. :-) _________________________________________________________________ Surf the net and talk on the phone with Xtra Jetstream @ http://www.xtra.co.nz/products/0,,5803,00.html !

2 1

RE: [nznog] RPC DCOM Worm On The Loose
by Lindsay Druett 11 Aug '03

11 Aug '03

Yep... We have live one :-) Secure your Windows Servers, upgrade them to Linux :-) > For those who have not read /. Yet > http://isc.sans.org/diary.html?date=2003-08-11 > > For those who cant read the link > Here is a cut and paste > > > This RPC DCOM worm started spreading early afternoon EDT > (evening UTC). At this point, it is spreading rapidly. > > ********** > NOTE: PRELIMINARY. Do not base your incidents response solely > on this writeup. ********** > > Increase in port 135 activity: > http://isc.sans.org/images/port135percent.png > > Latest update: The worm may launch a syn flood against > windowsupdate.com on the 16th. (unconfirmed) > > The worm uses the RPC DCOM vulnerability to propagate. One it > finds a vulnerable system, it will spawn a shell on port 4444 > and use it to download the actual worm via tftp. The exploit > itself is very close to 'dcom.c' and so far appears to use > the "universal Win2k" offset only. > > The name of the binary is msblast.exe. It is packed with UPX > and will self extract. The size of the binary is about > 11kByte unpacked, and 6kBytes packed: > > MD5sum packed: 5ae700c1dffb00cef492844a4db6cd69 (6176 Bytes) > > So far we found the following properties: > > - Scans sequentially for machines with open port 135, > starting at a presumably random IP address > - uses multiple TFTP servers to pull the binary > - adds a registry key to start itself after reboot > > Name of registry key: > SOFTWARE\Microsoft\Windows\CurrentVersion\Run, name: 'windows > auto update' > > Strings of interest: > > msblast.exe > I just want to say LOVE YOU SAN!! > billy gates why do you make this possible ? Stop making money > and fix your software!! windowsupdate.com start %s tftp -i %s > GET %s %d.%d.%d.%d %i.%i.%i.%i BILLY windows auto update > SOFTWARE\Microsoft\Windows\CurrentVersion\Run > > Existing RPC DCOM snort signatures will detect this worm. The > worm is based on dcom.c > > known tftp servers for this worm: > > 204.210.57.87 > 217.211.179.193 > 24.147.64.171 > 24.147.64.205 > 24.147.64.208 > 24.147.65.146 > 24.147.65.45 > 24.147.65.9 > 61.254.65.159 > 67.119.36.219 > 68.112.65.38 > 68.166.102.136 > 68.166.107.21 > 68.166.111.175 > 68.166.120.34 > 68.166.121.135 > 68.166.123.4 > 68.166.124.186 > 68.166.124.93 > 68.166.139.155 > 68.166.139.210 > 68.166.141.66 > 68.166.142.194 > 68.166.142.215 > 68.166.36.178 > 68.166.56.123 > 68.166.60.51 > 68.166.98.3 > > > > > _______________________________________________ > Nznog mailing list > Nznog(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nzn> og > >

1 0

Hamilton PC Users Group meeting is tomorrow night
by Meeting Reminder Bot 11 Aug '03

11 Aug '03

The Hamilton PC Users Group meeting is tomorrow night This is an announcement about the Hamilton PC Users Group, not the next WLUG meeting. Feel free to ignore it. If you're interested in the PC Users Group they meet about 7:30pm on the second Wednesday of each week at St Peters Cathedral Hall, which is up the hill at the South End of Victoria Street. They also have a website at http://crash.ihug.co.nz/~jonali/, but it was last modified 09/07/1999 and appears to be out of date.

2 1

RE: [wlug] The Wiki
by Lindsay Druett 11 Aug '03

11 Aug '03

> Some kind soul had the mark-up fixed within minutes. > > Next morning, I went back to the page to view the masterpiece > of the night before. It was gone, refactored out of > existence by some guy in Europe :-) > Now let me guess who that is... It must be Aristotle Pagaltzis

2 1

The Wiki
by Perry Lorier 10 Aug '03

10 Aug '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Since we're unlikely to get much traffic to the wiki for the next while from google, perhaps we should do something else to get the traffic up. I propose we have another week of trying to put information into the Wiki. For those of you that haven't tried to contribute, goto http://www.wlug.org.nz/ and find a page, and click the "Edit" button at the bottom. It'll ask you for your name, you can put anything there, just take your first and last names, capitalise them and mush them together, thus "Perry Lorier" -> "PerryLorier". Then edit the page. If you don't know what to add, check out * http://www.wlug.org.nz/HelpingOut * http://www.wlug.org.nz/WantedWikis (generated regularly) Also, perhaps look at what searches people are doing * http://www.wlug.org.nz/webalizer/ * http://www.wlug.org.nz/archive/querys-recent.txt or, if you want a nice long download * http://www.wlug.org.nz/archive/querys.txt Perhaps also try reviews of software you've used, or questions you want answers to. If everyone adds one page a day for 5 days, we will have a huge impact on the amount of extra information in the wiki when google decides to readd us to the index :) - -- I smell a RANCID CORN DOG! -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) Comment: Only when you are sure they have you, can you stop being paranoid iD8DBQE/NPYtcAgRpy8z8UQRAhYiAJ9+YD656zCD0Bh+u2AOKQ9e8FRIOgCeNw3R Jqmktw0eddX/6pBo7B+ZCuA= =b/XM -----END PGP SIGNATURE-----

3 2

Google searches
by Gavin Grieve 09 Aug '03

09 Aug '03

Is it just me or have we fallen off Googles radar? I've tried a few searches including (without the quotes - they just show what i searched for) "wlug", "waikato linux users group", "linux afsnotes", "linux wlug ipv6" and i didn't get a single hit for the wiki. I did get a few hits for "waikato linux users group" that referred to the mailing list, or links from other sites. Has enabling ipv6 on www.wlug.org.nz broken googles ability to access the wiki and provide links to it? Just a thought - not sure what else could be the problem. Ideas? Gavin Grieve

8 11

Re: [wlug] Learning the CLI ... using the wiki as well
by Jared Wigmore 09 Aug '03

09 Aug '03

> I think that the offer that we have for live CLI> tutorials using Rute> is great. But we need also to provide ongoing help.> Is it possible> to make further use of our excellent infrastructure:> the wiki? Can> we have portions of the rute with comments from us> and perhaps with> one or more people proof-reading this part of the> wiki?I think we could. I might be a proof-reader; I've been almost obsessive-compulsive about error correction the last few years. --------------------------------- Yahoo! Personals - New people, new possibilities! Try Yahoo! Personals, FREE for a limited period!

1 0

kppp sucky-motto
by S Swami 06 Aug '03

06 Aug '03

'top(1)' tells me that my ppp connection from the console (while in X) takes significantly less memory than kppp: ------------------------------------------------------------------- # X usage for comparison PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 390 root 18 0 16880 9268 3444 R 3.6 7.3 8:12.19 X # dial-up connection via console PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 24477 root 8 0 876 872 732 S 0.0 0.7 0:00.01 pppd # and then later dial-up connection via kppp PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 25070 sns 9 0 13012 12m 11m S 0.0 10.3 0:01.34 kppp 25071 root 9 0 8080 8080 7624 S 0.0 6.4 0:00.01 kppp ------------------------------------------------------------------- Any advice will be appreciated. (I know what Craig's thinking :) Cheers, Sid.

3 3

geek.nz
by Oliver Jones 06 Aug '03

06 Aug '03

-- Quote --- The new Second Level Domain, .geek.nz, will be available through Domainz from 11am on Tuesday 26 August 2003. .geek.nz will be an open (not moderated) second level, and will be available on a 'first come, first served' basis. Registrations can be made as usual either through our website or using the email template. Please feel free to get in touch with me if you have any questions relating to .geek.nz, or about your Provider account in general. -- Quote --

2 1

Re: [wlug] Some things I use.
by Martin Baehr 06 Aug '03

06 Aug '03

Distribution: debian Instant Messaging: none -> sTeam Web Browser: firebird Email: mutt IRC: ircii (to lazy to look for something better :-), roxenchat (not irc) Music (Ogg/MP3): xmms, mplayer... Movie players: mplayer (works always) (never seen xine working) Office Suite: none Remote Access/Control: ssh PDF: gv Graphics: gimp Image Viewer: xzgv (am not entirely happy with it, but others are worse) Text/Code Editor: vi Personal Finance: vi (i have a text file where i write down all my expenses) Servers: Caudium, sTeam, wwwoffle (occasionally) Window Manager: Window Maker Office: screen (in servers in austria) (the office is the place where you have all the tools you need to do your office work. all i need is a terminal running ssh (putty if necessary) and a network-connection, add a browser and my office is complete) greetings, martin. -- Pike Conference 2003 - Sep 25-27 - http://pike.ida.liu.se/conferences/2003/ -- interested in doing pike programming, sTeam/caudium/pike/roxen training, sTeam/caudium/roxen and/or unix system administration anywhere in the world. -- pike programmer working in europe open-steam.org unix system- bahai.or.at iaeste.(tuwien.ac|or).at administrator (stuts|black.linux-m68k).org is.(schon.org|root.at) Martin Bähr http://www.iaeste.or.at/~mbaehr/

6 9