Security....
by James Kosin
Everyone,
I've actually had to lock down most ports on my server; because, I got
tired of all the attempts at attacks.
Everyone, please use a firewall. I've noticed many attacks to the
following ports:
111 -- sunrpc ** this effects Linux machines
135 -- DCE Endpoint Resolution
137 -- netbios-ns
139 -- netbios-ssn
445 -- microsoft-ds ** these affects samba services as well.
1433 -- ms-sql-s
1434 -- ms-sql-m ** I don't know why SQL ports are being attacked.
1023 -- ???
5554 -- ???
9898 -- ??? ** this group may be related to PCAnywhere, or Worm, etc.
The most active: port 445 by far!
Just giving everyone a heads-up on the security issues.
James Kosin
19 years, 7 months
Some thoughts about yum and repositories
by D. D. Brierton
Judging from recent discussions on this list, it seems that many are
still confused about configuring their yum.conf files, and about all the
different repositories out there. I was wondering what we, the Fedora
community, might do to make this easier. I'm not so much thinking about
documentation -- it seems to me that FedoraFAQ.org does a pretty good
job of explaining stuff to people, however it still requires that they
find it or look for it in the first place. I was wondering if there was
something that could be done to yum itself (either the client program
itself, or the format of yum repositories) to make this easier.
Just off the top of my head, these things strike me as being potentially
useful:
1. Yum repositories should have a mirrors.xml file. All the user
need do is sign up to the main repository itself, the
mirrors.xml file is downloaded, and yum tries to use the mirror
that is closest or fastest (I'm not sure *how* it should do
that, but lets think of this as an ideal scenario proposal).
2. Yum repositories should be able to announce that they are
dependent on other yum repositories: if I sign up to Livna.org I
am then automatically signed up to Fedora.us.
3. If 1. can be implemented, then I think the GPG key of the
repository should automatically be installed -- because mirrors
are determined automatically you only ever sign up to the main
repository itself and so automatically retrieving its GPG key
should be no more a security issue than manually adding it.
4. I shouldn't need to alter my yum.conf when I upgrade to a new
version of FC -- yum should determine which version of FC I am
running and automatically use the appropriate repositories (i.e.
if I subscribe to rpm.livna.org when running FC2 and then I
upgrade to FC3 yum should automatically start using livna's FC3
repository).
5. I should be able to subscribe to a repository from the command
line without manually editing yum.conf (i.e. something like "yum
subscribe rpm.livna.org").
6. There should be some way of distinguishing between a repository
that is part of Fedora Core, or Fedora Extras or Fedora
Alternatives. Subscribing to a repository from Fedora
Alternatives should warn the user of potential problems. I'm not
sure quite how this should be done, but perhaps have something
like "channels" which group repositories (and yum-arch should be
altered so that you can't create a yum repository without
declaring whether it is Core, Extras or Alternatives).
7. If 6. could be implemented, then "channels" should be able to
advise you what other repositories there were in a channel,
together with a short description of what the repository
provided. This would aid people in finding the right
repositories.
If some of these things sound familiar that is because some of them are
features of Red Carpet, my favourite software installer and manager. I
would have liked to have seen red-carpet/rug/rcd adopted by Fedora Core,
but (a) it seems hardly anyone else wanted that, and (b) it looks like
Red Carpet may no longer be a standalone product but may have been
entirely integrated into Novell ZenWorks for Unix. However, if yum got
at least some of the above features I think it would be a vast
improvement, and I suspect we would have less problems reported on this
list.
I'm really hoping some people might have other suggestions, or comments
on what I've said above.
Best, Darren
--
=====================================================================
D. D. Brierton darren(a)dzr-web.com www.dzr-web.com
Trying is the first step towards failure (Homer Simpson)
=====================================================================
19 years, 7 months
Sendmail Milter Question
by Yang Xiao
Hi guys,
Is it possible to use multiple milters with sendmail? and if so, what
determines the order they are applied?
ie.
include(`/usr/share/sendmail-cf/m4/cf.m4')dnl
VERSIONID(`@(#)ohpp')dnl
OSTYPE(linux)dnl
FEATURE(nocanonify)dnl
MASQUERADE_AS(ohpp.com)dnl
FEATURE(allmasquerade)dnl
dnl Milter
dnl APPENDDEF(`conf_sendmail_ENVDEF', `-DMILTER')
define(`MAIL_HUB', `mail.domain.com')dnl
define(`SMART_HOST', `mail.domain.com')dnl
define(`confFORWARD_PATH', `')dnl
define(`STATUS_FILE', `/var/log/mail/statistics')dnl
define(`UUCP_MAILER_MAX', `2000000')dnl
FEATURE(`smrsh',`/usr/sbin/smrsh')dnl
dnl SpamAssassin Milter
INPUT_MAIL_FILTER(`spamassassin', `S=local:/var/run/spamass.sock,
F=,T=C:15m;S:4m;R:4m;E:10m')
dnl ClamAV Milter
INPUT_MAIL_FILTER(`clmilter',`S=local:/var/run/clamav/clamd.sock, F=,
T=S:4m;R:4m')dnl
define(`confINPUT_MAIL_FILTERS', `clmilter')dnl
dnl FEATURE(always_add_domain)dnl
FEATURE(use_cw_file)dnl
FEATURE(use_ct_file)dnl
EXPOSED_USER(`root')dnl
MAILER(smtp)dnl
many thanks,
Yang
19 years, 7 months
How about the support of FC for laptop?
by Park Lee
Hi,
Would you please tell me How about the support of Fedora Core for notebook PC(aka laptop)? and what kinds of notebook PC can be supported by Fedora Core (such as FC2, FC3) ?
Thanks a lot !
--
Best Regards,
Park Lee <parklee_sel(a)yahoo.com>
---------------------------------
Do you Yahoo!?
Yahoo! Mail Address AutoComplete - You start. We finish.
19 years, 7 months
Installing Fedora 2 in VMWare 4.5.2
by Alexis Aloneftis
Hi anyone
I am not at all a Unix person and would very much like to learn. I installed
Fedora Final Core 2 on my P4 PC running WinXP inside a virtual machine. The
installer worked fine when I used at the installation boot prompt the text
"linux linuxresolution=1024x768" (without the quotes). The X-Windows GUI
worked and installed fine until the end. When I rebooted for the first time,
I noted that all services said OK except smartd which failed. Towards the
end, when the X-Windows GUI is about to come up, text line which go by
quickly state that a monitor cannot be found and I am sent to the command
line for logging on.
Can anyone help to get my gui environment up?
Thanks
AA
19 years, 7 months
version of GNOME, hardware detection
by ashwin kesavan iyengar
Hi,
How can i know which version of GNOME is running? In my FC2 box
sometimes a hardware goes undetected and sometimes the same hardware
is detected. It happened with my modem and sound card. Why does this
happen? Any suggestions.
Thank you,
with regards,
ashwin
19 years, 7 months
Computer crashes after 2 days
by Peter Collier
I've noticed these logwatch messages sent to root. Don't know if this
gives a clue.
--------------------- ModProbe Begin ------------------------
Errors running install command:
sound_slot_1 : 7 Time(s)
---------------------- ModProbe End -------------------------
--------------------- pam_unix Begin ------------------------
su:
Sessions Opened:
peter(uid=500) -> root: 2 Time(s)
up2date:
Unknown Entries:
authentication failure; logname= uid=500 euid=0 tty= ruser=peter
rhost= user=root: 1 Time(s)
---------------------- pam_unix End -------------------------
--------------------- Connections (secure-log) Begin
------------------------
Connections:
Service sgi_fam:
<no address>: 3 Time(s)
**Unmatched Entries**
gdm[2839]: pam_succeed_if: requirement "uid < 100" not met by user
"peter"
userhelper[5595]: pam_timestamp: timestamp file
`/var/run/sudo/peter/unknown:root' has unacceptable age (35100 seconds),
disallowing access to system-config-network for UID 500
userhelper[5595]: pam_timestamp: updated timestamp file
`/var/run/sudo/peter/unknown:root'
userhelper[5598]: running '/usr/sbin/system-config-network' with root
privileges on behalf of 'peter'
gdm[2839]: pam_succeed_if: requirement "uid < 100" not met by user
"irene"
gdm[2839]: pam_succeed_if: requirement "uid < 100" not met by user
"peter"
userhelper[7845]: pam_timestamp: timestamp file
`/var/run/sudo/peter/unknown:root' has unacceptable age (54590 seconds),
disallowing access to up2date for UID 500
---------------------- Connections (secure-log) End
-------------------------
Box is a pcchips fsb266 k7 motherboard. Athlon 1700, wdig 40 gb with an
ex suse 9.0 install, maxtor 40gb with fedora 2 install ( this is the
operating system I'm active/using, the suse hard drive is only used for
a backup copy now) . 512 2100 266 ddr, ati 7800 graphics. All updates
applied.
Peter
19 years, 7 months
How to add language (font) after installation
by Justin Zhao
Hi all,
During installation I only select one language(English). But now I want
add other language(font) in order to display correctly when browser the
website of other language.
How to do this?
Thanks!
19 years, 7 months
manually assigned mac address
by mlists
I'm trying to work out how to configure a manually assigned mac address
onto an interface without much luck.
Does anyone know how ?
19 years, 7 months
ClamAV 0.80rc3 and FC1
by Mike McMullen
Hi All,
Does anyone know if the FC2 rpm for ClamAV 0.80rc3 will work on
FC1?
I used up2date to get the RPM from CrashHat on an FC2 system but there
doesn't seem to be one for FC1.
TIA,
Mike
19 years, 7 months