November 2022 - Lug-nuts

[gary@garymcglinn.com: Re: Re: Snort]
by saclug＠garymcglinn.com 14 Sep '23

14 Sep '23

Again sent earlier. Thanks for the intervening comments about vulnerabiliteis and versions. A lot of issues and suggestions have been made and raised. My brief response is that yes, according to nmap and my intention I had port 23, for ssh (I moved it) and port 5900 open and the rpc port, I think. I'm going by memory. Theoretically the only pinhole in the ISP router firewall was port 23. To use port 5900, you had to use an ssh tunnel. My web server is on another machine. Since I only use it for development, I don't leave it up. My actual web pages are hosted externally on a vendor's box. My experience with the upgrade treadmill is that it is a waste of time. By its own admission (if a concept can have that) the new versions will have issues and you need to upgrade. If the issues with an older version don't affect you, then it is perfectly fine to use it. Why upgrade and risk the fact that the new issues will affect your use case. The developers for Fedora 13 were no smarter or dumber than the developers who are writing Fedora 36. Or pick your distro of choice. The issue with an older release is that nifty new things come out and you can't really use them. But, if you run a VM with a recent version of the distro, you can use them just fine. The other issues is that if you are getting vendor support, they can only reasonably commit to supporting a limited number of versions. This is AMD hardware from '06. -Gary On Fri, Aug 05, 2022 at 06:19:54PM -0700, Rick Moen wrote: > Quoting Brian E. Lavender (brian(a)brie.com): > > > Gary, > > > > You were running Fedora 13? > > If so, _that_ is likely a big problem. Fedora 13's initial release was > May 25, 2010, and it was EOLed on June 24, 2011. > > Because Fedora. If you don't want to keep moving to newer versions, > it's about the worst possible distro. (But it's possible Gary meant > that he did _original_ installation 15 years ago, but has been following > the recommended upgrade treadmill^W path. > > Linus Sphinx wrote: > > > https://www.bleepingcomputer.com/news/security/new-linux-malware-brute-forc… > > You know, I have a _lot_ of things to be grateful for, and somewhere on > the list is the glad tidings that I don't need to rely on > Bleepingcomputer.com for IT information. > > Over the past 1.5 months since its discovery, the new botnet used > over 3,500 unique IPs worldwide to scan and attempt brute-forcing Linux > SSH servers. > [...] > The SSH brute-forcing relies on a list of credentials downloaded from > the [command and control server]. [...] > > *snore* > > So, doorknob-twisting for "joe accounts", like user=service > password=manager and like that. > > Guestimate the math, and measure the lengthly setup and teardown times > for remote connections to an sshd, and you'll find that > dictionary-attacking an sshd with any reasonable rules set about > password quality and length is going to take an appreciable fraction of > the time to the heat death of the universe, to succeed. > > I mentioned upthread that a lot of IT device comes from gadget freaks. > The _other_ common problem is that most security _articles_ are > copied-pasted press releases from security/antimalware firms. > So, they're big on shockhorror, and small on conveying understanding. > > I've only quick-glanced at this article about enforcing password policy > via PAM, so won't swear to it being a good one: > https://www.techrepublic.com/article/controlling-passwords-with-pam/ > Of course, if you're the -only- user, you ought to stick to decent > passwords without PAM forcing you to. (Also, a user who can su to > root has the power to overrule PAM. But if you do that, you have only > yourself to blame for consequences.) > > _______________________________________________ > Lug-nuts mailing list -- lug-nuts(a)bigbrie.com > To unsubscribe send an email to lug-nuts-leave(a)bigbrie.com ----- End forwarded message -----

6 12

ctags
by Chris Miller 06 Dec '22

06 Dec '22

Hi Folks, I'm working with Drupal and its notoriously steep learning curve. The tags file is less helpful than it could be because I think it is tracking more than definitions. It has been awhile, but I know that tagging on something that returns 800 "choice" is probably not correct. Does anybody know how to make "Exuberant ctags" a little less exuberant? Just the definitions, not the references? -- Chris. V:916.799.9461 F:916.974.0428 A: Because we read from top to bottom, left to right. Q: > Why should I start my reply below the quoted text?

3 3

Run script as root
by Chris Miller 21 Nov '22

21 Nov '22

Hi Folks, This should be easy ... And I'm sure I've done it before. But either Fedora has changed or I have, and I'm not committing either way. (-: I have a script to bounce the web-server and php-fpm with systemd and I'd like to be able to do this without "sudo" or a terminal tab permanently logged on as root. Seems like I should be able to set the script "setuid" and anybody should be able to run it. I can't seem to make it work. In the alternative, it seems like I should be able to delegate certain services to user control with systemd, like "systemctrl restart httpd", but the discussions I've found on that are hideously complex, and I'm not really interested in going down any of those rabbit holes. It can't be this difficult ... I mean, wasn't this one of the original justification for systemd? Thanks for the help, -- Chris. V:916.799.9461 F:916.974.0428

4 4

32 bit blues
by Linus Sphinx 18 Nov '22

18 Nov '22

After an all night session of drunken research I've come to the conclusion there are no 32 bit linux distros left that will fit on a CD-R and actually install a desktop, hell DVD-R either. Was going to give my faithful old Dell i486 laptop to a neighbor kid to play with but I think it's dead Jim. Suggestions? Those that are left seem to only boot from media and will not install anything to a hard disk. Must be a screen door blowing shut somewhere that could use it, pretty heavy.

6 15

Fedora 37 is out!
by Brian E. Lavender 16 Nov '22

16 Nov '22

I updated a laptop to it this morning! It uses Linux 6. I wonder about this old hardware, speaking of 32 bit support. Brian -- Brian Lavender http://www.brie.com/brian/ "There are two ways of constructing a software design. One way is to make it so simple that there are obviously no deficiencies. And the other way is to make it so complicated that there are no obvious deficiencies." Professor C. A. R. Hoare The 1980 Turing award lecture

1 0

Pale Moon
by Gary 01 Nov '22

01 Nov '22

Any thoughts on the Pale Moon web browser? I was looking around on Honda's web site and they complained about my web browser being out of date. On that VM, its Firefox 84. I clicked on "learn more" hoping that Honda would tell me exactly why they wanted me to upgrade. It's not a bank, after all, and they offered me browser options. Admittedly, I live under a rock. But, I had never heard of Pale Moon. I went to their home page and am going to give it a try. I resist browser upgardes because they often change the layout, for no apparent reason. And, the new "features" are often things I don't like. Such as storing a bunch on info on my browser so they don't have to (which I suspect may be Honda's motive). So, if I was going to have to deal with I new layout anyhow, I decided to go for broke and try something actually new. Security? Its a Honda site. Unless they want me to protect against malware from them, I don't get it. -Gary

3 4

2026

2025

2024

2023

2022

Lug-nuts November 2022