- luv-main - example.com

firmware malware: DVD; ?motherboard?
by Douglas Ray 03 Feb '16

03 Feb '16

We have a PC with firmware malware on - at least - both DVDs. I don't know if it's worth recovering the system, but I definitely want to find diagnostics for identifying infections and vectors on the rest of the LAN. Booting a DVD live-image of ubuntu, invocations of firefox are intercepted and come up as "JON recovery system" or some such. The attack vector may have been the old XP system on the harddrive, but equally it may have been one of the ubuntu images. It is a medion PC, article number 10002328, and there are firmware updates at the manufacturer. I'm unsure how to securely install, given that the DVDs are compromised, and I have no way to verify the cardreader or motherboard BIOS or harddrive. (I could map/update the bootsector of the harddrive, but I haven't checked what may be available to work with the firmware.) Would putting the infected DVD drives on another system, sans media, risk infecting the new system? Conversely, let's say I swap in a new DVD drive and boot a putatively clean DVD - if the BIOS is corrupted do I risk just re-infecting the new DVD drive? Merry Christmas to all Douglas Ray

6 8

10GigE
by Russell Coker 02 Feb '16

02 Feb '16

What's a minimum cost for 10GigE on Linux? We're talking something like 3*PCIe network cards that work with Linux (and cards for a few Macs), cables that aren't particularly long, and a small switch (maybe 6 ports 10GigE and 4 ports GigE). Also is there a vendor that sells cheap servers with 10GigE cards built in? One of the Linux servers in question has an old CPU and can do with being replaced. Thanks. PS If you work for a company and want to sell this gear to my client then reply by private mail. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/

2 1

mark btrfs device as failed
by James Harper 01 Feb '16

01 Feb '16

Is there a way that I can, on a running system, mark a btrfs disk as having failed, so that it will now be "missing" and the array will be in a degraded state? I can obviously do it by using fdisk to delete the partition, then rebooting and mounting with the degraded option, but I want to do it without a reboot, and without having to tinker with the boot process remotely. I can also delete the device (move all the data off the device), then delete it, then add the new device, then rebalance to move all the data back, and that would be safer, but would be terribly slow. Also I'm not sure I have enough free space to allow this (maybe I do, but it would be tight enough that I can't be sure there wouldn't be some overhead I haven't taken into account) Thanks James

2 1

Interesting talk on open source being essential to the
by Andrew Worsley 01 Feb '16

01 Feb '16

Found this talk on open source use in Sierra Leone pretty interesting. Sounds like it saved many lives. Andrew How Open Source Software, second hand laptops and hackers helped stop Ebola [32c3] "In the dark days of October 2014 an unprecedented Ebola epidemic wrecked havoc across Sierra Leone, Liberia and Guinea. In Sierra Leone, the health system was only weeks away from total collapse due to an inability to manage or pay health workers across the country and the world braced for the unchecked spread of the disease throughout west Africa. In the face of apocalyptic scenario, a company made up of local hackers took on the unprecedented challenge of building, implementing and running a huge Management Information System and Mobile payments system to keep the health system from collapsing. This talk will show how this was achieved with Open Source Software, second hand laptops, hacked voter registration machines, second hand smartphones and some very smart and determined young people used to achieving great things with none of the resources we take for granted. .." https://www.youtube.com/watch?v=hZ29t_6TS8w

1 0

Thunderbolt
by Russell Coker 31 Jan '16

31 Jan '16

https://en.wikipedia.org/wiki/Thunderbolt_(interface) Apple's Thunderbolt uses the same connectors as MiniDisplayPort and USB-C. Is that going to matter to us? Are there going to be situations in which things can physically connect but not be able to talk to each other? -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/

2 1

Lets Encrypt
by Russell Coker 30 Jan '16

30 Jan '16

I've just installed a new free SSL from letsencrypt. We have paid for a SSL key but seem to have lost the private key. http://etbe.coker.com.au/2016/01/27/using-letsencrypt/ Above is a blog post I wrote about Lets Encrypt. Now I have configured the luv server to redirect all web traffic to https (let me know if that breaks anything) and to use a valid key for SMTP TLS. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/

5 9

Postfix Virtual Users Transport
by Fraser McGlinn 28 Jan '16

28 Jan '16

Hi Guys, I’ve got a domain where i’ve the main hosting for the domain somewhere else (not controlled by me) and then the some users hosted locally. What i’m having issues with is getting the mail from my server to send upstream if it can’t find a user locally. What i’ve got so far: alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases append_dot_mydomain = no biff = no config_directory = /etc/postfix inet_interfaces = all mailbox_size_limit = 0 message_size_limit = 256000000 milter_connect_macros = j {daemon_name} v {if_name} _ milter_default_action = accept mydestination = frodo.iama.geek.nz <http://frodo.iama.geek.nz/>, localhost myhostname = frodo.iama.geek.nz <http://frodo.iama.geek.nz/> mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 myorigin = /etc/mailname non_smtpd_milters = $smtpd_milters readme_directory = no recipient_delimiter = + relayhost = smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu) smtpd_milters = unix:/spamass/spamass.sock unix:/clamav/clamav-milter.ctl smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination, reject_unverified_recipient smtpd_sasl_auth_enable = yes smtpd_sasl_path = private/auth smtpd_sasl_type = dovecot smtpd_tls_cert_file = /etc/ssl/self-sign-star.iama.geek.nz.crt smtpd_tls_key_file = /etc/ssl/self-sign-star.iama.geek.nz.key smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache smtpd_use_tls = yes tls_random_source = dev:/dev/urandom transport_maps = proxy:mysql:/etc/postfix/mysql-virtual-transport-maps.cf virtual_alias_maps = mysql:/etc/postfix/mysql-virtual-alias-maps.cf virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf virtual_transport = lmtp:unix:private/dovecot-lmtp With the following in my virtual transport table +----+--------------------+------------------------------------+ | id | source | destination | +----+--------------------+------------------------------------+ | 1 | example.com | smtp:[aspmx.l.google.com <http://aspmx.l.google.com/>] | | 2 | .example.com | smtp:[aspmx.l.google.com <http://aspmx.l.google.com/>] | | 3 | fraser(a)example.com | lmtp:unix:private/dovecot-lmtp | +----+--------------------+------------------------------------+ What I get when i try and email an email on the upstream server is Recipient address rejected: User unknown in virtual mailbox table Does anyone have any ideas on how to resolve this? It doesn’t seem to matter if I have virtual_transport set or not and do it all manually. Cheers, Fraser

2 1

How do I process a large xml file?
by h 27 Jan '16

27 Jan '16

Hi, I am a hobbyist. I have written a style sheet (xslt) which I want to use to process an xml file. I have run some tests, using xsltproc, on a sample xml and it all works well. The xml file I am wanting to process is 650 GB in size. When I run the xsltproc command the response is "Killed". I had hoped that xsltproc would step through the xml file, creating output as it goes. This does not seem to be the case. I am running Mageia x64. I have added a 1T disk to the system and set it as a swap partition. Does anyone know of an xml parser that will work with "limited" memory? - or a method by which I can apply the style sheet. I have experience with C, and if all else fails will write a C program to do what I want the style sheet to do, but I would rather get the style sheet working. Any advice appreciated. Hugh

3 2

special beginners meeting
by Russell Coker 27 Jan '16

27 Jan '16

I've publicised the meeting on Saturday to LCA delegates, so we may get a larger attendance than usual. Also I've suggested meeting for dinner after the meeting, it's not something we usually do but will probably be of interest to people who have visited Australia for LCA. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/

2 1

Outlook.com "Smart screen" - SMTP traffic does not arrive.
by Piers Rowan 26 Jan '16

26 Jan '16

Has anyone had success in getting an new IP past the Smart screen content filter? MS support keep sending me canned responses. No messages arrive in the @outlook.com account Here is a manual try: -sh-4.2$ telnet mx1.hotmail.com 25 Trying 65.55.92.168... Connected to mx1.hotmail.com. Escape character is '^]'. 220 SNT004-MC3F13.hotmail.com Sending unsolicited commercial or bulk e-mail to Microsoft's computer network is prohibited. Other restrictions are found at http://privacy.microsoft.com/en-us/anti-spam.mspx. Mon, 25 Jan 2016 20:29:51 -0800 HELO bne.recruitonline.com.au 250 SNT004-MC3F13.hotmail.com (3.21.0.230) Hello [103.16.128.141] MAIL FROM: piers(a)r.id.au 250 piers@r.id.au....Sender OK RCPT TO: piers(a)outlook.com 250 piers(a)outlook.com DATA 354 Start mail input; end with <CRLF>.<CRLF> Testing . 250 <SNT004-MC3F13p7mvjk000d0d99(a)SNT004-MC3F13.hotmail.com> Queued mail for delivery QUIT 221 SNT004-MC3F13.hotmail.com Service closing transmission channel Connection closed by foreign host. And here is a log snippet: Jan 26 15:25:55 bne postfix/smtpd[15845]: 6F53D18344: client=localhost[::1] Jan 26 15:25:55 bne postfix/cleanup[15848]: 6F53D18344: message-id=<20160126042555.6F53D18344(a)bne.recruitonline.com.au> Jan 26 15:25:55 bne postfix/qmgr[15722]: 6F53D18344: from=<support(a)recruitonline.com.au>, size=6837, nrcpt=1 (queue active) Jan 26 15:25:55 bne postfix/smtpd[15845]: disconnect from localhost[::1] Jan 26 15:25:57 bne postfix/smtp[15849]: 6F53D18344: to=<piers(a)outlook.com>, relay=mx3.hotmail.com[207.46.8.167]:25, delay=1.9, delays=0.04/0.01/0.49/1.3, dsn=2.0.0, status=sent (250<20160126042555.6F53D18344(a)bne.recruitonline.com.au> Queued mail for delivery) Jan 26 15:25:57 bne postfix/qmgr[15722]: 6F53D18344: removed I can't see anything in the MTA queue. Thanks for your help Cheers Piers

1 0