The Linux Questions Thread: a bunch of pitfalls, but technically it's possible

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Linux Questions Thread: a bunch of pitfalls, but technically it's possible

«‹›1028 »

nitrogen: May 21, 2004; Oh, what's a 217°C difference between friends?

PalmTreeFun posted:

1. What's the recommended antivirus software for Ubuntu? I use Avast under Windows for what it's worth.

ClamAV works well, especially if you are using the machine as a fileserver for windows clients.

# ? Feb 19, 2012 20:10

Adbot: ADBOT LOVES YOU

# ? May 10, 2024 00:04

Bruce Hussein Daddy: Dec 26, 2005; I testify that there is none worthy of worship except God and I testify that Muhammad is the Messenger of God

spankmeister posted:

hda is almost certainly your cdrom drive since even if a hard drive is IDE it will show up as sdX with modern kernels.

So if sdb1 is your USB drive, your new drive seems to be missing.

What does "lshw -C disk" and "mount" tell you? please post the result of both here. (if you don't have lshw, install it )

You apparently changed the partition type of your external drive, but you haven't reformatted it. Besides that, you should not make external drives LVM, just set the partition type to "Linux" (83 I think) and format as ext4.

Changing the partition type does nothing but flip a few bytes in the partition table. You need to reformat it to change the file system. (You WILL lose all data on the drive, so keep that in mind.)

Here's what to do with that external drive:
1. unmount it
2. set the partition type to 83 with fdisk
3. mkfs.ext4 /dev/sdb1 ( <<destroys all data on it>> )
4. remount it.

You're right. I came back to edit but you beat me, that is in fact the CDRom.

lshw:

code:

  *-cdrom
       description: IDE CD-ROM
       product: TEAC CD-ROM CD-224E-N
       physical id: 0
       bus info: ide@0.0
       logical name: /dev/hda
       version: 3.AC
       capabilities: packet atapi cdrom removable nonmagnetic dma lba iordy audio
       configuration: mode=udma2 status=nodisc
  *-disk
       description: SCSI Disk
       product: 10EAVS External
       vendor: WD
       physical id: 0.0.0
       bus info: scsi@6:0.0.0
       logical name: /dev/sdb
       version: 1.65
       serial: WD-WCAU40201438
       size: 931GB
       capabilities: partitioned partitioned:dos
       configuration: ansiversion=4
  *-disk
       description: SCSI Disk
       product: PERC 5/i
       vendor: DELL
       physical id: 2.0.0
       bus info: scsi@0:2.0.0
       logical name: /dev/sda
       version: 1.03
       serial: 00e14a144d6b10c60e00a5afcb30c201
       size: 148GB
       capabilities: partitioned partitioned:dos
       configuration: ansiversion=5

mount:

code:

                                             
/dev/mapper/VolGroup00-LogVol00 on / type ext3 (rw)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
devpts on /dev/pts type devpts (rw,gid=5,mode=620)
/dev/sda3 on /boot type ext3 (rw)
tmpfs on /dev/shm type tmpfs (rw)
/dev/mapper/VolGroup00-LogVol02 on /usr type ext3 (rw)
/dev/mapper/VolGroup00-LogVol04 on /var type ext3 (rw)
/dev/mapper/VolGroup00-LogVol03 on /tmp type ext3 (rw)
/dev/mapper/VolGroup00-LogVol05 on /home type ext3 (rw)
none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw)
/proc on /var/named/chroot/proc type none (rw,bind)
/var/run/dbus on /var/named/chroot/var/run/dbus type none (rw,bind)
sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw)
/dev/sdb1 on /media/My Book type vfat (rw,noexec,nosuid,nodev,shortname=winnt,uid=500)

Thanks for the help on the external, that should do me for that problem. edit:

[root@SB1 ~]# mkfs.ext4 /dev/sdb1
-bash: mkfs.ext4: command not found

Bruce Hussein Daddy fucked around with this message at 20:55 on Feb 19, 2012

# ? Feb 19, 2012 20:43

PalmTreeFun: Apr 25, 2010; *toot*

nitrogen posted:

ClamAV works well, especially if you are using the machine as a fileserver for windows clients.

I should probably add that this is just a personal computer. I installed it just so that I can use stuff from the Unix C libraries while programming. I suppose I don't need any then? Are there just not many viruses built for Unix, or does it already have good built-in security?

# ? Feb 19, 2012 20:50

spankmeister: Jun 15, 2008

Bruce Hussein Daddy posted:

You're right. I came back to edit but you beat me, that is in fact the CDRom.

lshw:

code:

  *-disk
       description: SCSI Disk
       product: PERC 5/i
       vendor: DELL
       physical id: 2.0.0
       bus info: scsi@0:2.0.0
       logical name: /dev/sda
       version: 1.03
       serial: 00e14a144d6b10c60e00a5afcb30c201
       size: 148GB
       capabilities: partitioned partitioned:dos
       configuration: ansiversion=5

Ok well this tells me your hard drive controller is in RAID mode (which makes sense because of your earlier comment about the two disks)

You'll have to configure a new "array" with just the one disk in it (usually using JBOD) or if you can plug it into another disk controller on the motherboard and put that controller in AHCI mode. (or IDE emulation if AHCI is not available).

Don't put your current controller in AHCI or IDE mode because you will break your array.

quote:

Thanks for the help on the external, that should do me for that problem. edit:

[root@SB1 ~]# mkfs.ext4 /dev/sdb1
-bash: mkfs.ext4: command not found

Hmm, strange. What distro are you running?

PalmTreeFun posted:

Are there just not many viruses built for Unix, or does it already have good built-in security?

Both.

# ? Feb 19, 2012 21:20

Longinus00: Dec 29, 2005; Ur-Quan

PalmTreeFun posted:

I should probably add that this is just a personal computer. I installed it just so that I can use stuff from the Unix C libraries while programming. I suppose I don't need any then? Are there just not many viruses built for Unix, or does it already have good built-in security?

It's not as vulnerable to drivebys so the main way of getting a virus an infection is running random poo poo you download (which is just as dangerous in windows) or deciding to install a bunch of servers and not securing them (which is just as dangerous in windows).

spankmeister posted:

Hmm, strange. What distro are you running?

Redhat 4 is still supported by redhat and wouldn't have ext4.

Longinus00 fucked around with this message at 21:34 on Feb 19, 2012

# ? Feb 19, 2012 21:32

spankmeister: Jun 15, 2008

Yeah if you run SSH open to the internet port scanners WILL find you and they WILL try to bruteforce you.

Just don't be dumb and use 1234 as your root password and you should be fine.

# ? Feb 19, 2012 21:34

PalmTreeFun: Apr 25, 2010; *toot*

Alright, cool. Thanks a bunch.

# ? Feb 19, 2012 22:33

PS. Love the cabin: Dec 30, 2011; Bee Lincoln

spankmeister posted:

Yeah if you run SSH open to the internet port scanners WILL find you and they WILL try to bruteforce you.

Just don't be dumb and use 1234 as your root password and you should be fine.

I used to run sshd just so I could use irssi on my phone, should I have been paranoid or would not using the default port and using public/private keys for authentication be good enough?

# ? Feb 19, 2012 22:55

text editor: Jan 8, 2007

PS. Love the cabin posted:

I used to run sshd just so I could use irssi on my phone, should I have been paranoid or would not using the default port and using public/private keys for authentication be good enough?

More than enough, swapping off the default port alone with pretty much completely stop the random bruteforcers

# ? Feb 19, 2012 23:06

Longinus00: Dec 29, 2005; Ur-Quan

PS. Love the cabin posted:

I used to run sshd just so I could use irssi on my phone, should I have been paranoid or would not using the default port and using public/private keys for authentication be good enough?

Consider investing in fail2ban or denyhosts for extra security against brute forcing. Also interesting to see where attacks are coming from.

# ? Feb 20, 2012 00:32

spankmeister: Jun 15, 2008

Banning china and russia in iptables gets rid of like 90%

# ? Feb 20, 2012 00:43

PS. Love the cabin: Dec 30, 2011; Bee Lincoln

That's actually a great idea, maybe to expand on it only allowing the IP range of my cell provider.
I just wish my phone tethering app would allow me to use SSH, they block anything but http and mail for "security reasons".

Although IIRC there is a way to do it through an http proxy, I just haven't had the energy to follow through.

# ? Feb 20, 2012 01:55

Morkai: May 2, 2004; aaag babbys

Chunjee posted:

I managed to solve my problem by specifying my own screenrc file

code:

screen -S SessionName -d -m -c /home/System/screenrc

which contains:

code:

screen SessionName
screen -t CouchPotato 	python /home/Install/CouchPotato/CouchPotato.py
screen -t SickBeard 	python /home/Install/SickBeard/SickBeard.py
screen -t SABnzbd	sabnzbdplus
screen -t Top		top

I know this is a few pages back, and I didn't check to see if anyone else helped you fix this, but...

Why not just run these as daemons? I just recently submitted a patch to SickBeard that cleans up the init.d script for Ubuntu. You need to copy the sample init scripts to /etc/init.d/ and make them executable, be sure to edit the sample configs a little to match your download directories and whatnot. Easy peasy.

code:

sudo cp init.ubuntu /etc/init.d/sickbeard
sudo chmod 0755 /etc/init.d/sickbeard

The others are very similar... actually, if you install SAB from the repo it should do this for you...

Morkai fucked around with this message at 02:02 on Feb 20, 2012

# ? Feb 20, 2012 01:57

Longinus00: Dec 29, 2005; Ur-Quan

Morkai posted:

I know this is a few pages back, and I didn't check to see if anyone else helped you fix this, but...

Why not just run these as daemons? I just recently submitted a patch to SickBeard that cleans up the init.d script for Ubuntu. You need to copy the sample init scripts to /etc/init.d/ and make them executable, be sure to edit the sample configs a little to match your download directories and whatnot. Easy peasy.
code:
sudo cp init.ubuntu /etc/init.d/sickbeard
sudo chmod 0755 /etc/init.d/sickbeard
The others are very similar... actually, if you install SAB from the repo it should do this for you...

Don't forget to update rc.d if you're manually adding init scripts.

http://manpages.ubuntu.com/manpages/hardy/man8/update-rc.d.8.html

# ? Feb 20, 2012 03:33

soylent_green: Nov 6, 2004; We're not going to Guam, are we?

Zom Aur posted:

Mandriva has been unreliable lately, mostly from the developers almost abandoning the project and the community going for a fork (Mageia). The developers released a new version of mandriva some months ago, so who knows, they might get going again.

Crap, I suppose since I've been installing it for years I don't notice the problems. Any thoughts on Mageia? I have the DVD but haven't tried it yet.

# ? Feb 20, 2012 07:35

dont skimp on the shrimp: Apr 23, 2008

soylent_green posted:

Crap, I suppose since I've been installing it for years I don't notice the problems. Any thoughts on Mageia? I have the DVD but haven't tried it yet.

Uh. I've never actually used Mageia, and haven't tried Mandriva in years. You could try Mageia, but since both of them are now under active development and you haven't really encountered any issues, I don't really see any reason for you to switch. You're probably fine either way.

dont skimp on the shrimp fucked around with this message at 08:32 on Feb 20, 2012

# ? Feb 20, 2012 08:26

Rosoboronexport: Jun 14, 2006; Get in the bath, baby!; Ramrod XTreme

What could be the reason for f.lux to not operate on my Leeenux v4 (a fork of Ubuntu 10.04)?

When starting it from menu, nothing happens. From console I get:
fluxgui
Traceback (most recent call last):
File "/usr/bin/fluxgui", line 19, in <module>
import fluxgui
ImportError: No module named fluxgui

fluxgui-directory is under /usr/shared/pyshared and there is a file fluxgui.py. Should it be elsewhere? Same happens when running sudo fluxgui.

# ? Feb 20, 2012 10:53

Social Animal: Nov 1, 2005

I just wanted to mention that I started playing around with screen as an alternative to nohup and... wow. Why didn't anyone tell me how awesome it was?

# ? Feb 20, 2012 12:48

spankmeister: Jun 15, 2008

Social Animal posted:

I just wanted to mention that I started playing around with screen as an alternative to nohup and... wow. Why didn't anyone tell me how awesome it was?

Hey let me tell you about this screen thing :iia:

# ? Feb 20, 2012 12:49

Bruce Hussein Daddy: Dec 26, 2005; I testify that there is none worthy of worship except God and I testify that Muhammad is the Messenger of God

spankmeister posted:

You'll have to configure a new "array" with just the one disk in it (usually using JBOD) or if you can plug it into another disk controller on the motherboard and put that controller in AHCI mode. (or IDE emulation if AHCI is not available).

Don't put your current controller in AHCI or IDE mode because you will break your array.

There are like 6-8 slots for drives on the server, is it possible some of the other ones will "just work" (have a different controller)? I read up a little bit (google) on JBOD and didn't find anything that seemed like it would help?

quote:

Hmm, strange. What distro are you running?

I have no idea (what that means).

# ? Feb 20, 2012 14:00

nonathlon: Jul 9, 2004; And yet, somehow, now it's my fault ...

A vague problem or situation: years and years ago, at an old workplace, I wrote a few bioinformatic web-services and installed them and some software on a server for other people to use. Time rolls on, I move onto another job. So recently-ish, my old employer ask me if I can do some some quick and easy contracting work for them: write a new webservice and install it on the server. Sure, I say.

Of course, when I get to look at the server, it starts to get sticky. I go to use or install the usual set of tools (git, rvm, ruby) and get a rude surprise. No one has done anything to it since I left. It's running RHEL3. It hasn't got yum or any useful package manager. And all the usual package repositories seem to have disappeared a year or two ago. Crap.

So, here I have several conflicting instincts:

- Don't mess with things, everything is working now
- But trying to deploy a new Rails/Hobo app without git and rvm is going to hurt
- But trying to install git manually sent me into a spiral of dependencies
- Surely there must be a RHEL3 repo out there somewhere.

Other possibly salient facts - server is on intranet, so is not "at risk". Thank god. I know just enough sysadmin / Linux setup voodoo to hurt myself. I can't get local IT help. I don't want to spend too much time on this because I'm not getting paid for it.

Gut instincts or opinions on what I should do?

# ? Feb 20, 2012 14:13

spankmeister: Jun 15, 2008

Bruce Hussein Daddy posted:

There are like 6-8 slots for drives on the server, is it possible some of the other ones will "just work" (have a different controller)? I read up a little bit (google) on JBOD and didn't find anything that seemed like it would help?

Well, probably not because you seem to have some Dell server, which has a hardware RAID solution built in.

You should be able to find a manual for your specific controller on Dell's website, if you search for the model server you have.

I don't have any personal experience with Dell controllers, but HP is similar and how it works is basically this:

When you boot the server at some point some text will pop up saying: "Dell 5/i RAID controller" or something along those lines. It will have a keyboard combination you need to press to get into the menu. Once you're there you can configure a new array with the new disk.
The array which should be JBOD (or RAID1 with one disk which is basically the same thing) and once you've done that it should show up in linux.

Be sure to leave the currently configured array untouched.

But yeah, look up the manual.

quote:

I have no idea (what that means).

A distro or distribution is a pre-packaged version of linux. There's Red Hat, Ubuntu, Debian, SUSE etc...

Type these commands to find out:

uname -a
cat /etc/issue

and maybe:
cat /etc/redhat-release
cat /etc/SuSE-release

spankmeister fucked around with this message at 14:24 on Feb 20, 2012

# ? Feb 20, 2012 14:22

ewe2: Jul 1, 2009

outlier posted:

So, here I have several conflicting instincts:

- Don't mess with things, everything is working now
- But trying to deploy a new Rails/Hobo app without git and rvm is going to hurt
- But trying to install git manually sent me into a spiral of dependencies
- Surely there must be a RHEL3 repo out there somewhere.

Other possibly salient facts - server is on intranet, so is not "at risk". Thank god. I know just enough sysadmin / Linux setup voodoo to hurt myself. I can't get local IT help. I don't want to spend too much time on this because I'm not getting paid for it.

Gut instincts or opinions on what I should do?

Grab the data, wipe it, install a fresh dist. Anything else is too painful and risks breaking things badly. Annoying, but there's no telling when you'll be called back to do something else, so solve the problem now.

# ? Feb 20, 2012 14:48

Morkai: May 2, 2004; aaag babbys

Longinus00 posted:

Don't forget to update rc.d if you're manually adding init scripts.

http://manpages.ubuntu.com/manpages/hardy/man8/update-rc.d.8.html

Yup, forgot to put that in there. If you don't do this you'll be pulling your hair out trying to figure out why daemons won't start. I made that mistake ONCE. Never again.

Social Animal posted:

I just wanted to mention that I started playing around with screen as an alternative to nohup and... wow. Why didn't anyone tell me how awesome it was?

dtach is another thing like that, useful sometimes when screen is overkill.

Morkai fucked around with this message at 15:05 on Feb 20, 2012

# ? Feb 20, 2012 15:03

Bruce Hussein Daddy: Dec 26, 2005; I testify that there is none worthy of worship except God and I testify that Muhammad is the Messenger of God

spankmeister posted:

Awesome, thanks.

Linux [domain-deleted] 2.6.18-8.el5 #1 SMP Fri Jan 26 14:15:14 EST 2007 x86_64 x86_64 x86_64 GNU/Linux

Red Hat Enterprise Linux Server release 5 (Tikanga)

# ? Feb 20, 2012 15:39

Postal: Aug 9, 2003; Don't make me go postal!

spankmeister posted:

Yeah if you run SSH open to the internet port scanners WILL find you and they WILL try to bruteforce you.

Just don't be dumb and use 1234 as your root password and you should be fine.

A better solution would be to disable root logins through SSH and use a regular account to connect. Edit /etc/ssh/sshd_config (or the same file in the appropriate location for your distro) and ensure the following line is set appropriately:

PermitRootLogin no

Then setup your /etc/sudoers so that you can sudo from your regular account to do anything you'd do as root.

The fail2ban (or alternatively denyhosts) recommendation is good in addition to this. You can set the number of failed attempts and then ban that IP from connecting using either hosts.deny or firewall rules.

Additionally, if you want visibility into your system, setup logwatch and have it email you daily summaries of system activity. There is a section for sshd that will show you IPs and usernames attempted.

# ? Feb 20, 2012 15:45

spankmeister: Jun 15, 2008

Bruce Hussein Daddy posted:

Red Hat Enterprise Linux Server release 5 (Tikanga)

Well there you go.

RHEL5 doesn't support ext4 (at least your kernel version doesn't), so go with ext3.

Postal posted:

Yeah I agree completely but didn't want to go into it.

# ? Feb 20, 2012 15:45

Postal: Aug 9, 2003; Don't make me go postal!

spankmeister posted:

Yeah I agree completely but didn't want to go into it.

I don't get many chances to nerd out in Linux security any longer, so I take them where I can get them.

# ? Feb 20, 2012 16:02

PS. Love the cabin: Dec 30, 2011; Bee Lincoln

Why is it so hard to find a decent xfce theme?

# ? Feb 20, 2012 16:22

Bruce Hussein Daddy: Dec 26, 2005; I testify that there is none worthy of worship except God and I testify that Muhammad is the Messenger of God

Thanks Winter Park Tech!

http://www.youtube.com/watch?v=nKiOECFu1HE&feature=related

I think I'm going to buy another identical drive, RAID them together like my original 160mb drives almost exactly like the dude in this video, then extend the logical volume onto the new virtual drive.

If that is stupid or I am missing something someone please let me know.

# ? Feb 20, 2012 16:35

spankmeister: Jun 15, 2008

Bruce Hussein Daddy posted:

Thanks Winter Park Tech!

http://www.youtube.com/watch?v=nKiOECFu1HE&feature=related

I think I'm going to buy another identical drive, RAID them together like my original 160mb drives almost exactly like the dude in this video, then extend the logical volume onto the new virtual drive.

If that is stupid or I am missing something someone please let me know.

Good idea but what kind of drive did you buy? Because desktop drives these days are unsuitable for RAID-controllers due to the TLER-problem. I won't go into that but desktop drives have a tendency to drop out of arrays.

# ? Feb 20, 2012 16:47

Bruce Hussein Daddy: Dec 26, 2005; I testify that there is none worthy of worship except God and I testify that Muhammad is the Messenger of God

spankmeister posted:

Good idea but what kind of drive did you buy? Because desktop drives these days are unsuitable for RAID-controllers due to the TLER-problem. I won't go into that but desktop drives have a tendency to drop out of arrays.

Dell 1TB 7.2k 3.5" SATA drive 3Gbs for PowerEdge 2970

# ? Feb 20, 2012 16:53

spankmeister: Jun 15, 2008

Bruce Hussein Daddy posted:

Dell 1TB 7.2k 3.5" SATA drive 3Gbs for PowerEdge 2970

Those are absolutely fine.

# ? Feb 20, 2012 17:02

Longinus00: Dec 29, 2005; Ur-Quan

Postal posted:

A better solution would be to disable root logins through SSH and use a regular account to connect. Edit /etc/ssh/sshd_config (or the same file in the appropriate location for your distro) and ensure the following line is set appropriately:

PermitRootLogin no

Then setup your /etc/sudoers so that you can sudo from your regular account to do anything you'd do as root.

The fail2ban (or alternatively denyhosts) recommendation is good in addition to this. You can set the number of failed attempts and then ban that IP from connecting using either hosts.deny or firewall rules.

Additionally, if you want visibility into your system, setup logwatch and have it email you daily summaries of system activity. There is a section for sshd that will show you IPs and usernames attempted.

It was mentioned previously but you should also disable password logins and go with public key authentication.

# ? Feb 20, 2012 17:25

dont skimp on the shrimp: Apr 23, 2008

outlier posted:

A vague problem or situation: years and years ago, at an old workplace, I wrote a few bioinformatic web-services and installed them and some software on a server for other people to use. Time rolls on, I move onto another job. So recently-ish, my old employer ask me if I can do some some quick and easy contracting work for them: write a new webservice and install it on the server. Sure, I say.

Of course, when I get to look at the server, it starts to get sticky. I go to use or install the usual set of tools (git, rvm, ruby) and get a rude surprise. No one has done anything to it since I left. It's running RHEL3. It hasn't got yum or any useful package manager. And all the usual package repositories seem to have disappeared a year or two ago. Crap.

So, here I have several conflicting instincts:

- Don't mess with things, everything is working now
- But trying to deploy a new Rails/Hobo app without git and rvm is going to hurt
- But trying to install git manually sent me into a spiral of dependencies
- Surely there must be a RHEL3 repo out there somewhere.

Other possibly salient facts - server is on intranet, so is not "at risk". Thank god. I know just enough sysadmin / Linux setup voodoo to hurt myself. I can't get local IT help. I don't want to spend too much time on this because I'm not getting paid for it.

Gut instincts or opinions on what I should do?

Tell them that after you got a look at their current system you won't be able to make this happen without a major overhaul, which might gently caress something else up. Since you're not getting paid, you won't do it.

# ? Feb 20, 2012 18:08

Craptacular!: Jul 9, 2001; Fuck the DH

Bruce Hussein Daddy posted:

I know next to nothing about Linux, I am barely able to move around and do basic things. I have 2 problems.

I have a server that has run out of disc space. I kicked the can down the road a bit by deleting a bunch of stuff, but in a week or so I will be out again. I bought a 1 Terabyte drive, and was hoping to extend the volume to this drive using this dude's instructions

Let me get this straight: You're trying to copy a partition and it's data to another device?

Hook the new drive up into your computer, create and then boot up a GParted LiveCD, select the old partition and choose copy, switch to the new drive and choose paste. GParted will duplicate the partition on the new drive provided there's enough unpartitioned space, then you can adjust the size of the partition after it's copied to cover the additional space.

Admittedly, this is just how I did it as a consumer desktop person and not a server IT guy, but it was much easier than the CLI stuff in your link.

Craptacular! fucked around with this message at 23:20 on Feb 20, 2012

# ? Feb 20, 2012 23:09

Longinus00: Dec 29, 2005; Ur-Quan

Craptacular! posted:

Let me get this straight: You're trying to copy a partition and it's data to another device?

Hook the new drive up into your computer, create and then boot up a GParted LiveCD, select the old partition and choose copy, switch to the new drive and choose paste. GParted will duplicate the partition on the new drive provided there's enough unpartitioned space, then you can adjust the size of the partition after it's copied to cover the additional space.

Admittedly, this is just how I did it as a consumer desktop person and not a server IT guy, but it was much easier than the CLI stuff in your link.

It sounded like he wanted to extend a LVM partition onto another device. A bit different from what you're proposing.

# ? Feb 21, 2012 00:45

Social Animal: Nov 1, 2005

So after all the discussions of ssh security I decided to check the log on my server. I've got brute force attempts from a few people and it makes me feel unclean! I've got root login turned off and my username/pw is super tight. I feel like I should change the port to something like 4230 but overall is this something you have to live with? Should I do anything about the people attempting this? One of the IPs belongs to a range owned by a Ukrainian so it seems like a waste of time.

# ? Feb 21, 2012 06:03

angrytech: Jun 26, 2009

Social Animal posted:

So after all the discussions of ssh security I decided to check the log on my server. I've got brute force attempts from a few people and it makes me feel unclean! I've got root login turned off and my username/pw is super tight. I feel like I should change the port to something like 4230 but overall is this something you have to live with? Should I do anything about the people attempting this? One of the IPs belongs to a range owned by a Ukrainian so it seems like a waste of time.

Enable public key auth and disable password auth. :siren:

Mmake sure you can log in with your key before you disable the password
Changing ports is a million times less effective than just using a keyfile.

edit: The Something Awful Forums > Discussion > Serious Hardware / Software Crap > The Linux Question Thread: Use keyfile auth already

angrytech fucked around with this message at 06:32 on Feb 21, 2012

# ? Feb 21, 2012 06:25

Adbot: ADBOT LOVES YOU

# ? May 10, 2024 00:04

Tad Naff: Jul 8, 2004; _{I told you you'd be sorry buying an emoticon, but no, you were hung over. Well look at you now. It's not catching on at all!}

Social Animal posted:

So after all the discussions of ssh security I decided to check the log on my server. I've got brute force attempts from a few people and it makes me feel unclean! I've got root login turned off and my username/pw is super tight. I feel like I should change the port to something like 4230 but overall is this something you have to live with? Should I do anything about the people attempting this? One of the IPs belongs to a range owned by a Ukrainian so it seems like a waste of time.

Yeah, it's pretty much natural. If you're bugged there's fail2ban, but as long as your user/pw are tight and root login is disabled, there's not much else to be done. Changing your ssh port is possible, but not really scalable -- I find it's too much to remember which port applies on which machine. I, too, want some kind of reverse-lookup slapping mechanism.

Ed: ^^ that's also good too, but you'll still get the scanners in your log files.

# ? Feb 21, 2012 06:26

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Linux Questions Thread: a bunch of pitfalls, but technically it's possible

«‹›1028 »