| 00:43:44 | scanline | is back (gone 00:44:34) |
| 02:03:47 | | prpplague was last seen on #blob 3 hours, 36 minutes and 22 seconds ago, saying: bbl [Sun Mar 10 22:27:25 2002] |
| 02:03:47 | TomW | ibot: seen prpplague |
| 04:51:14 | TomW | CosmicPenguin: how is it going? |
| 04:53:38 | CosmicPenguin | Drive by greeting, apparently |
| 04:57:14 | CosmicPenguin | Time for bed... no more hacking tonight |
| 05:10:33 | pmisfit | is away: zzzzzzz |
| 09:56:17 | | andersee was last seen on #tuxscreen 2 days, 11 hours, 2 minutes and 19 seconds ago, saying: I rebuilt my tuxscreen image this morning. works. One behavior change though... inittab entries now evecute in the order they are found in inittab... [Fri Mar 8 22:53:58 2002] |
| 09:56:17 | fontenot | ibot: seen andersee |
| 10:51:11 | scanline | hi LoneTech |
| 10:51:19 | scanline | #tuxscreen's been quiet today... |
| 11:07:59 | LoneTech | k |
| 12:33:38 | scanline | is away: ZzZzZzzzzzz |
| 15:14:29 | prpplague | morning all |
| 15:15:19 | LoneTech | lo |
| 15:27:44 | pattieja | morning prpplague |
| 15:28:01 | prpplague | pattieja: morning |
| 15:28:44 | pattieja | prpplague: I was looking over the linux-hacker.net site some more on Thursday night and found out how to map the IA-1's keyboard under the console |
| 15:29:02 | pattieja | now it boots and remaps the top row of keys to ESC, F1, F2, ..., F11, F12 |
| 15:29:26 | pattieja | now what I would like to be able to do is map the (|) (Power) key to switch the LCD backlight on and off |
| 15:30:11 | pattieja | somebody on the list wrote a really cool program that toggles the bits of the controller interface for the LED's on the front of the unit that tell you whether power is on and if you've got mail and other stuff like that |
| 15:30:23 | pattieja | and it also allows you to turn on and off the backlight of the unit |
| 15:44:22 | prpplague | pattieja: nice |
| 15:48:12 | pattieja | prpplague: any thoughts on trapping the "Power" button? |
| 15:48:51 | prpplague | pattieja: sorry, i'm trying to escape x86 machines and have been concentrating on arm based stuff |
| 15:48:55 | pattieja | I'd like to run a script that determines the status of the backlight (or just keeps track of a file in /tmp or somewhere that contains the current status of the backlight) |
| 15:49:27 | pattieja | well, it would have to be a shell/X thing, right? |
| 15:49:33 | prpplague | pattieja: /var/tmp would be better if you need to store a status file |
| 15:49:37 | pattieja | sort of like a keyboard macro |
| 15:49:50 | pattieja | prpplague: I'll keep that in mind, thanks |
| 15:50:13 | prpplague | pattieja: ya just watch for the scan code, execute the code, check the stat file, and do the switch |
| 15:51:04 | pattieja | what would be watching for the scancode? the shell, or the kernel? What if a shell is not running? I'd kind of maybe like some sort of daemon that isn't dependent on compilation changes to, say, bash or ash |
| 15:51:28 | pattieja | hmm. Maybe I would need to write a module |
| 15:51:59 | prpplague | pattieja: you create a daemon |
| 16:14:21 | LoneTech | what button is this you're trying to detect? |
| 16:20:00 | prpplague | LoneTech: its one of those "gee-whiz" buttons on an ir keyboard |
| 16:20:46 | LoneTech | ic |
| 16:20:57 | LoneTech | lirc? |
| 16:23:14 | LoneTech | starts up bzflag |
| 16:35:28 | LoneTech | unplayable.. too little CPU. |
| 18:44:54 | eyezz | is away. Automatically set away [SZon] |
| 20:21:28 | anotherScanline | is away: I'm busy |
| 20:21:46 | scanline | is back (gone 00:00:18) |
| 20:50:40 | | prpplague was last seen on #blob 1 hours, 53 minutes and 0 seconds ago, saying: seletz: i think he was putting on a dog and pony show for someone [Mon Mar 11 18:57:40 2002] |
| 20:50:40 | TomW | ibot: seen prpplague |
| 20:50:53 | TomW | prpplague: are you there? |
| 20:51:01 | scanline | is away: class |
| 20:51:56 | TomW | Has anyone any experience with a machine of yours that has had a root kit installed on it? I think I just found one on my server. |
| 20:53:26 | AlHazWork | oddly enough, tho i have two linux systems with 24/7 connectivity, it's never happened |
| 20:55:19 | TomW | I just found a file called "rkt.tgz" in my /tmp dir. Looking at it, it has: ps, ls, netstat, sniff, cleaner, sz, etc. in it. |
| 20:55:34 | TomW | these are elf binaries. |
| 20:58:11 | AlHazWork | *nod* |
| 20:58:48 | AlHazWork | maybe the key to my non-rooted-state is that scriptkiddies are too inept to figure out a cross compiler, and all my exposed systems are odd archetectures |
| 20:58:50 | AlHazWork | one sparc, one alpha |
| 20:58:52 | TomW | shit! I just copied the kit's ps + my /bin/ps over to my workstation and diffed them there, they match.. When I diff'ed them on the server, the server said they don't match. |
| 20:59:01 | AlHazWork | so an ia32 rootkit would be a resounding flop |
| 20:59:33 | AlHazWork | maybe I should shove two nics in a tuxscreen and use that as my firewall . . . |
| 20:59:36 | TomW | looks like I have been compromised. |
| 20:59:48 | AlHazWork | sux to be you |
| 21:00:05 | AlHazWork | there are simple procedures to preventing that sort of thing, tho |
| 21:00:29 | AlHazWork | 1: Any service you are not absolutly certian you are using, disable before you ever make the box visible on the 'net |
| 21:01:07 | AlHazWork | 2: firewall off, for inbound connections, every priviliged port you're not certian you're using |
| 21:01:33 | TomW | whew! My mistake, I copied the same ps over to the workstation as the same file, when I did it properly, they did not match. But, just to make sure, I will have to pull ps off the cdrom and check against that one. |
| 21:01:36 | AlHazWork | 3: use the 'secure' versions of everything. Telnet and ftp have to go. use ssh, sftp |
| 21:02:05 | TomW | Telnet, ftp have been off this server for over two years now. Firewall is paranoid. |
| 21:02:16 | AlHazWork | what'd you have running, tho? |
| 21:02:34 | TomW | RH 6.2 on the server. |
| 21:02:38 | AlHazWork | ouch |
| 21:02:42 | TomW | Hmm. |
| 21:02:47 | AlHazWork | yeah, that's probably riddled with holes at this point |
| 21:02:50 | AlHazWork | what services tho |
| 21:02:51 | AlHazWork | ? |
| 21:02:58 | TomW | Been meaning to update that machine... |
| 21:03:08 | AlHazWork | the only tcp ports that answer on my firewall are 22, 113, and 80 |
| 21:03:25 | AlHazWork | 113 is the openbsd ident daemon, and it tells everyone lies |
| 21:03:33 | AlHazWork | 80 is boa |
| 21:04:33 | AlHazWork | boa is only there because due to various design features of my network, "dcc" filetransfer is more or less impossible, and ftp is a PITA |
| 21:04:50 | TomW | I have pop-2, pop-3, imap, auth, httpd, cvs, sshd, and http open here. |
| 21:04:54 | AlHazWork | there's not even an index.html, I just dump files in the document root for people occasionally |
| 21:05:32 | AlHazWork | i'm betting you were rooted with either pop3 or imap, pssibly httpd if it's an old version of apache or something |
| 21:06:12 | TomW | Well, I will have to consider that machine compromised anyway. That rootkit that they left may have been a ruse to lure me into a false sense of security. |
| 21:06:35 | AlHazWork | scriptkiddies typically use utilities that cause a buffer overflow or whathaveyou, and then try to execute ia32 binary code remotely |
| 21:07:02 | AlHazWork | so anyone who's tried that on my sparc or alpha boxes has been sorely disappointed |
| 21:09:34 | AlHazWork | I use debian/stable for my server |
| 21:09:41 | AlHazWork | with a cron job that downloads security updates nightly |
| 21:13:34 | AlHazWork | my firewall is running rh 6.0, but none of the active daemons came from rh 6.0 |
| 21:13:50 | AlHazWork | ls |
| 21:14:13 | CosmicPenguin | Thats one nice things about RPMS... they'll verify the checksums of any installed packages |
| 21:14:30 | CosmicPenguin | Of course, if you are rooted, there is nothing stopping the rooters from installing new RPMS, I guess |
| 21:14:49 | AlHazWork | or just updating the rpm database |
| 21:15:34 | AlHazWork | You could also add a cron job to the system that periodically identifies all the setuid capable binaries on the system, and mails you their sizes and m5sums |
| 21:15:43 | TomW | Ah well, first goto the tape drive so I have the config files saved so I can refer to them. Then a total wipe via fdisk, rm -rf / (while running recovery mode from the CDROM), then a total reinstall, followed by fresh sources for all my qmail, tcpserver, etc. sources. |
| 21:15:50 | AlHazWork | md5sums, even |
| 21:15:54 | CosmicPenguin | AlHazWork: Thats always a good idea |
| 21:16:09 | TomW | CosmicPenguin: yeah, but, can't they compromise the rpm binary as well? |
| 21:16:34 | TomW | Yes, the md5sum sounds like a good idea, as long as it is a statically linked version of md5sum. |
| 21:16:46 | AlHazWork | I've never worried about precompiled rootkits, because there isn't a scriptkiddie alive who has any idea how to cross compile anything, or even understands what that means |
| 21:16:47 | CosmicPenguin | TomW: Yeah, thats one of the problems |
| 21:16:57 | AlHazWork | and none of my exposed systems are ia32 |
| 21:17:28 | TomW | There is a couple of the files in the rootkit which are replacements for some key libraries. |
| 21:17:39 | AlHazWork | I'm planning on getting rid of my loud, heat producing alpha firewall tho |
| 21:19:07 | TomW | Maybe, I should take a TuxScreen cpu board, shove two nics into it, then hardwire an IDE drive to the J602 port, and run the StrongARM system as my gateway + server. |
| 21:19:33 | AlHazWork | ide on j602? |
| 21:20:04 | TomW | AlHazWork: Yes, that connector has enough I/O to run an IDE drive. |
| 21:20:42 | TomW | AlHazWork: You only need 16 addressable locations to interface to IDE. |
| 21:20:47 | AlHazWork | *nod* |
| 21:20:50 | AlHazWork | would be handy |
| 21:21:23 | TomW | I have some experience with rewriting the ide.c to work on non-standard i/o locations. |
| 21:21:46 | TomW | Just need more RAM in the Tux... |
| 21:22:17 | TomW | Well, I have to get ready for a meeting, CUL. |
| 21:25:01 | AlHazWork | I wonder what the power draw at idle for an r4400 indy is |
| 21:25:09 | AlHazWork | . . . . I'd need another nic in it, tho |
| 21:25:30 | prpplague | TomW: hows goes the dev board? |
| 21:25:40 | prpplague | TomW: mines coming alot nicely |
| 21:25:47 | prpplague | TomW: thanks for the email help |
| 21:27:08 | AlHazWork | prpplague: didja get the time over the weekend to look for old airo nics? |
| 21:33:47 | CosmicPenguin | hmmm.... redhat is going to support powerpc.... |
| 21:34:32 | prpplague | AlHazWork: ya i found 3 but all of them appear to be damaged |
| 21:35:21 | AlHazWork | prpplague: howso? |
| 21:35:57 | prpplague | AlHazWork: i.e housing damage |
| 21:36:10 | AlHazWork | Hmm |
| 21:36:23 | AlHazWork | mangled, etc? |
| 21:38:45 | prpplague | AlHazWork: yep |
| 21:40:23 | AlHazWork | that's unfortunate |
| 21:40:34 | AlHazWork | lends a clue to how the telxon unit ended up on ebay tho |
| 21:48:05 | prpplague | AlHazWork: yep |
| 21:51:25 | AlHazWork | ok, I'll tell my friend, thanks for looking |
| 21:54:51 | scanline | is back (gone 01:03:49) |
| 22:58:52 | andersee | CosmicPenguin: get a minute? |
| 22:59:03 | CosmicPenguin | andersee: sure |
| 22:59:19 | andersee | $ ./test2 |
| 22:59:19 | andersee | hello I'm a global constructor |
| 22:59:19 | andersee | hello I'm in a normal constructor |
| 22:59:19 | andersee | hello from test 1 |
| 22:59:19 | andersee | hello from test 2 |
| 22:59:20 | andersee | hello from test 3 |
| 22:59:22 | andersee | Cool, things seem to be working! |
| 22:59:24 | andersee | goodbye I'm in a normal destructor |
| 22:59:26 | andersee | goodbye I'm global destructor |
| 22:59:37 | andersee | $ ../toolchain/bin/i386-linux-ldd ./test2 |
| 22:59:37 | andersee | libstdc++.so.9 => /home/andersen/CVS/gcc/gcc/toolchain/lib/libstdc++.so.9 |
| 22:59:37 | andersee | libm.so.0 => /home/andersen/CVS/gcc/gcc/toolchain/lib/libm.so.0 |
| 22:59:38 | andersee | libgcc_s.so.0.9.9 => /home/andersen/CVS/gcc/gcc/toolchain/lib/libgcc_s.so.0.9.9 |
| 22:59:38 | andersee | libc.so.0 => /home/andersen/CVS/gcc/gcc/toolchain/lib/libc.so.0 |
| 22:59:38 | andersee | /home/andersen/CVS/gcc/gcc/toolchain/lib/ld-uClibc.so.0 => /home/andersen/CVS/gcc/gcc/toolchain/lib/ld-uClibc.so.0 |
| 23:00:04 | andersee | CosmicPenguin: i.e. Its working. :-) |
| 23:00:08 | CosmicPenguin | sweet! |
| 23:01:22 | andersee | Lemme pack things up for you so you can give it a try |
| 23:04:03 | CosmicPenguin | nice - I've got lots of things to break |
| 23:05:16 | andersee | hehe |
| 23:05:56 | andersee | Guess I need to check in a few changes first and update the daily snapshot |
| 23:09:56 | prpplague | andersee: wahoo looks great |
| 23:11:33 | andersee | The stdio rewrite is going in in the next couple hours as well. :-) |
| 23:21:03 | prpplague | andersee: man your one programming fool |
| 23:21:42 | andersee | prpplague: actually, the stdio rewrite was been done by Manuel. |
| 23:22:34 | andersee | prpplague: the new stdio is even more standards compliant than glibc's. And smaller. And (optionally) provides all the glibc extensions too. |
| 23:23:06 | andersee | Manuel put together much of the current uClibc stdio. |
| 23:23:56 | prpplague | andersee: nicew |
| 23:24:36 | prpplague | andersee: when can you start on multi-function gf app? lol |
| 23:24:44 | andersee | heh |
| 23:27:33 | CosmicPenguin | prpplague: girlfriend application? |
| 23:31:15 | andersee | I suspect starting a gf app would cause my multi-function wfe application to corrupt my stack |
| 23:31:28 | prpplague | lol |
| 23:31:36 | prpplague | CosmicPenguin: ya you know like bb |
| 23:31:51 | prpplague | CosmicPenguin: ln -s gf /home/clean |
| 23:31:53 | CosmicPenguin | I was thinking of upgrading my gf to fiance 1.0, but I heard that code was buggy |
| 23:31:59 | prpplague | CosmicPenguin: ln -s gf /proc/sexy |
| 23:32:13 | andersee | howdy ssoucek |
| 23:32:15 | prpplague | CosmicPenguin: etc.... |