Ubuntu Security :: Fish:// Seems To Be Sending SYN Floods?
Apr 13, 2010
I've got a strange problem. I have a number of linux boxes - main running Gentoo, a couple of others running Mint and a new one running Kubuntu 9.10.All, except the new one, connect to my hosted remote server through FTP, FISH or SSH without any problem.However the new machine will connect to my remote server, via fish, but then gets immediately disconnected. I have discovered, via my hosting company, that it is flooding the connection and looking in my Router log I can see:Quote:1. 2010.04.13 03:24:42 **SYN Flood to Host** 10.10.xxx.xxx, 38299->> 209.85.xxx.xxx, 80 (from ATM Outbound)If I connect first through SSH on this machine it is fine and I can navigate through the remote filesystem. If I connect through FISH using either Konqueror or Dolphin, I get an initial file listing and then the remote firewall kicks in and blacklists my IP address for half an hour.Does anyone have any ideas why this may be happening? Once I'm blacklisted I cannot make any connection, from any machine on my external IP address - whether it is HTTP, FTP, SSH
Currently I'm having a problem with a box which keep sending spams all over the world. yesterday we upgraded some drupal modules (which can send email), and the spam quantity reduced. But still some spams keep on going out from our server. Some of them even have attachment.
Some of them sent using accounts that never exist at our server (e.g. strager@mydomain.com), and some of them are from 'nobody'. what to check, or where to look. I've check the MX-Records and there was no strange forwarders. Really stuck here...
We have a spam in our network and we installed antivirus in all our systems and cleaned the virus from all pc's after that i had removed my ip from the database of blocked ip's but still my ip is blocked for sending spam i don't know from which pc the spam is going on the internet.
so i have a question that my proxy server is redhat linux and as a newbie i don't know the command's to find out which pc is creating large bandwidth to the internet. If you tell the command how to see which pc is sending spam then i will discard that pc. Also i want a strong firewall to stop spam activities.
When I get on the internet with Mozilla I am getting advertising that mentions the city I live in. How is that information being sent from my computer and how can I stop it? Is this in a file I can edit or delete?
i m using centos 5.4 for Data Server, there i hv shared a directory to store data. i want, when ever owner of that data does delete any thing from directory, system should send me a mail with logs of that deletion action with the detail some thing like bellow
1- IP of system, from where owner did access the server and delete the data.
2- Date, Time and Name of File with Path.
These logs should be sent me by email automatically.
In my network I have 25 workstations and some serves. Everything working in local LAN with firewall. The problem is that on one machine (I dont know which one) is installed software which sending data to the internet. Actually I dont know what it is. Last time as I remember was trojan which can create new network interfaces in windows and send some data to the internet. The half speed of my network connection is used by this infected machine. How can I detect which machine it is? How can I listen/capture some traffic and analyze from which machine I have more connections.
Please take a look on this time. Instead of 141-150ms should be 4-5ms.
64 bytes from web30.ispnetz.de (62.xx.191.74): icmp_seq=1 ttl=249 time=141 ms 64 bytes from web30.ispnetz.de (62.xx.191.74): icmp_seq=2 ttl=249 time=135 ms 64 bytes from web30.ispnetz.de (62.xx.191.74): icmp_seq=3 ttl=249 time=147 ms 64 bytes from web30.ispnetz.de (62.xx.191.74): icmp_seq=4 ttl=249 time=127 ms 64 bytes from web30.ispnetz.de (62.xx.191.74): icmp_seq=5 ttl=249 time=156 ms 64 bytes from web30.ispnetz.de (62.xx.191.74): icmp_seq=6 ttl=249 time=129 ms 64 bytes from web30.ispnetz.de (62.xx.191.74): icmp_seq=7 ttl=249 time=188 ms
How can I detect which machine is infected using only linux and keyboard ?
i configured sendmail with squirrelmail in RHEL5.3
it is working fine. i can send the mail and receive the mail .
but when i try to send the mail a selinux error is coming[but mail is sending successfully ]. i don't under stand this message.
Quote:
Summary:
SELinux is preventing sendmail (system_mail_t) "read" to eventpoll (httpd_t).
Detailed Description:
SELinux denied access requested by sendmail. It is not expected that this access is required by sendmail and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access.
Allowing Access:
Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for eventpoll,
restorecon -v 'eventpoll'
If this does not work, there is currently no automatic way to allow this access.Instead, you can generate a local policy module to allow this access - see FAQ(url) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended.Please file a bug report (url) against this package.
I just got control over a server that was hacked several months back. The other day we started receiving rejected emails sent from my server to a yahoo email address that is no longer active that contained users login information. I am trying to find the process that is sending these emails. So far its been like finding a needle in a haystack. The email that is being sent is appending the login information each time it is sent so there must be a local file that contains this information. I have tried using grep and find without any luck.
I just discovered that my server is sending huge amount of data out at about 1Mbps. My immediate thought was the deluge bittorrent client, however it is supposedly not running (and a check confirmed its total active torrents was set to 0). I turned off the network and went in to Firestarter to set the outbound traffic to restrictive, turned on network again and no more data was sent. A look in Firestarter / Events showed a long list of random ports being used (see further down). How can I identify what program is sending all the data?
In Firestarter it doesn't really say much more than the port. Not sure if it is some misconfigured program or a malware/virus. I just got my ADSL connected a few days ago, and before that I used a mobile broadband (3G) as I just relocated. During the period I used the 3G the server might have been without firewall for a few days and it was also at this time I discovered an increase in network traffic (but I didn't really pay much attention at that time). I am running Fedora 10.
List of events from firestarter, my server is 192.168.1.100: Time:Jun 1 16:48:12 Direction: Outbound In: Out:eth1 Port:39435 Source:192.168.1.100 Destination:58.208.xxx.56 Length:129 TOS:0x00 Protocol:UDP Service:Unknown Time:Jun 1 16:48:12 Direction: Outbound In: Out:eth1 Port:6990 Source:192.168.1.100 Destination:112.94.xxx.212 Length:129 TOS:0x00 Protocol:UDP Service:Unknown Time:Jun 1 16:48:12 Direction: Outbound In: Out:eth1 Port:2973 Source:192.168.1.100 Destination:118.93.42.xxx Length:129 TOS:0x00 Protocol:UDP Service:Svnetworks .....
I have been unable to connect between two boxes. One box is using ethernet cable and the other has a wireless nic. I can ping from the box with the wireless card to the wired box, but not the other way around. Using fish:// either way times out. Ssh and vnc services are open in the firewalls. There is no encryption for wireless being used. The wireless card is an imicro wireless pci adapter. I load the wireless driver manually after booting the box (./wlan0up,etc.) Both boxes are using opensuse 11.3. I did not have any problem using fish:// until I replaced a failing ethernet nic with the wireless nic. I use dhcp for the lan ip address
I use the friendly interactive shell, or fish, as my default shell. I find it much more user-friendly than bash, but lately (as in for the last 2 months, give or take)dding new entries to .config/fish/fish_history and .config/fish/fish_history.tmp. this means when I press up I don't get the last command I typed, but rather the last command from before the bug occurred. I have no idea why this could be and have tried several tricks but none of them have worked. I have made a bug report on launchpad but I was hoping someone here who knows more about shells would know a workaround.The things that I have tried:removing the files to see if it creates a new onemaking sure I have write access to the filesremoving the files and then using touch to create a blank one
I got a Rocketfish RF-WEB2C webcam, plugged it into my Dell Inspiron Mini 10, and it worked just fine. Cheese ran it, tinychat ran it, skype ran it, all was good. Today, all I get is a black screen. Tinychat claims that it isn't giving out any signal, though can detect it, and Cheese showed me a black screen, though listed it as the the device it was using. I figure it isn't a lack of drivers, as it worked yesterday, and it really shouldn't have broken yet, as I just opened it yesterday.
using konqueror/dolphin to connect to my desktop and the connection is okay.fish://userone@192.168.1.101:12345 out of curiosity, in konsole typedssh userone@192.168.1.101:12345 and got and error messagessh: Could not resolve hostname 192.168.1.101:12345: Name or service not known Googled and got more confused
i am trying to compile the fish shell, in order to install it on my system.when i am run the 'configure' command, i get an error that it can't find 'curses' implementation.i have on my system (Fedora 14) ncurses, which is also supported according to the Fish site.when i try to install curses with yum, i get a message that it couldn't find a package like that.i have tried to google about that but i found nothing
This started after my upgrade to 11.3, if I remember correctly. I may have it slightly wrong because I don't drag & drop copy every day, but it's close. Also, it happened to my laptop & desktop both.
I use fish & Krusader to manage some 50-60 servers and it's a dandy app. But now, when I try to copy files to remote servers, I get the following error. I tried it with Konqeror. I tried it with sftp instead of fish. Same results every way.
I've tried searching, but it's not an obvious error message to search for. I'm flummoxed. And sorta frustrated. Linux would be so slick minus these irritating regressions. I had been using WinSCP / Putty, but the Terminal / Krusader I like much better --- except that WinSCP always works.
Here's the screenshot of my error. You can't see it through the blur, but the part that is baffling is that the top line says something like:
this action will overwrite fish://root@server:2222/ with a newer file fish://root@192.168.5.10:2595/.asterisk_history. Notice that the remote server doesn't even HAVE that file on its system.
I have prob with running Metaspolit tool in BackTrack When i used expolit aurora (windows/shell/bind_tcp) it started a server for me running in my ip addrerss on port 8080
when the target pc trying to access that web an error appear saying : "Sending internet explorer "Aurora" Memory Corruption to client 10.64.35.52" you can check out the attached file hint to solve this prob so the session can start?
I installed KDE 4.2 ( and from using it I like it very much... switching up from gnome for a while ) and everything but one aspect is working perfectly fine and that is adding network folders... it seems that my install cannot seem to connect to any computer using fish://. Although when I ssh from command line it works fine... I installed the following packages for KDE for reference:
kdeadmin kdebase kdebase-workspace kdenetwork
Also to note I am running fedora 10 and gnome is also installed on the system. The error that I get with fish is that the it cannot connect to server. Even though I can connect with ssh in terminal. Some places I have read about is kio ioslaves and there isn't any problems like I have occurring. From what I gather is that fish works fine for everyone else so I must be doing something wrong but at a loss for what it is...
i'm not a techie but have tried my best to solve the issue without success. I have a static IP from local ISP and my computer is configured with 192.168.1.2 (LAN IP).
I have installed ubuntu server 9.04 and want to send emails from my server for which I've configured postfix. But I dont know what to do next.
My questions are:
1. Do i need to install DNS server for using postfix? If not, what should I install to send emails from this server?
2. Do I need to forward any particular port in my router?
3. If I dont have a fully qualified domain, what are the configurations I need to do to send emails?
ok so my Tech teacher installed Ubuntu on my laptop for me so that i could try to program with Objective-C in the terminal. It didn't work. Just the other day i tried to remove the partition to make space for other things that i needed on my computer.
I also made my Vista portion take of the part that was controller by Ubuntu. Now when i run i get a message that says
error: no such partition. grub rescue>
IDK what to do, i have no cd to instal it again, oh yeah and in 2 and a half hours, i won't have a computer because the one that i am on now goes back to my co-op.
Taken some pics and stored in Shotwell. When I go to File/Send to the email part does not highlight and give me sending Bluetooth and 2 others. How does one email them?
I have kubuntu 9.10 and I would like to configure Ubuntu to can send mail from command line with mailx. I've saw that I need to install a MTA. But I don't know wich install and how.
I follow this tutorial:
[URL]
But when I try to send a message, in the mail.log says me:
Code: Jan 5 10:21:33 david postfix/smtp[3795]: 41AEA41DBE: to=<pepelu@gmail.com>, relay=alt1.gmail-smtp-in.l.google.com[209.85.223.73]:25, delay=1086, d elays=1022/0.01/32/32, dsn=4.7.0, status=deferred (host alt1.gmail-
Formerly it was possible to send attached files using the "-a" option eg. mailx -a /home/yan/textfile [URL]. (I think -a stood for "attached". At the time the "-a" option figured as an option for sending attached files.Now it is an option for sending headers. how one can now send attached files using mailx?
Basically, I think my Internet crashed while sending an email via Evolution and now whenever I open Evolution, or try and receive any new email it just sits there sending this email - it reaches 100% so I can only assume it has actually sent the email.
There's a button to "Cancel the current mail operation" though it doesn't appear to be doing anything; the email is still being "sent" each time.
This would be pretty tedious for the guy I sent the email to.
