- Roundtable - muug.ca

Opinions on Fedora Server
by Alberto Abrao 25 Mar '20

25 Mar '20

Does anyone have experience with Fedora Server on a (semi) production setting? If yes, care to share your opinions? Thank you! Kind regards, Alberto Abrao 204-202-1778 204-558-6886

3 4

MUUG Meeting, April 14, 2020: CANCELLED
by Gilbert E. Detillieux 18 Mar '20

18 Mar '20

The Manitoba UNIX User Group (MUUG) will not be holding its next monthly meeting on Tuesday, April 14th: April 14, 2020: CANCELLED In light of the current concerns over COVID-19 and the risk of infection, and in keeping with a directive from the University of Winnipeg (which states "All discretionary events on campus currently scheduled until May 1, 2020 will be postponed."*), the MUUG board has decided to cancel the April 14th meeting. The board will be looking into ways we can provide a remote, virtual meeting for subsequent months, if the current public health circumstances continue. (Stay tuned for updates on future meetings.) * https://news-centre.uwinnipeg.ca/all-posts/uwinnipeg-update-on-covid-19-sit… For more information about MUUG, and its monthly meetings, check out their web server: https://muug.ca/ -- Manitoba UNIX User Group E-mail: <gedetil(a)muug.ca> c/o Gilbert E. Detillieux Web: http://muug.ca/ University of Manitoba Phone: (204)474-8161 Winnipeg MB CANADA R3T 2N2 Fax: (204)474-7609

1 0

Hacking Shaw email
by Rob Dyck 18 Mar '20

18 Mar '20

I have an odd question. The girlfriend's ex-mother-inlaw got herself in trouble with Shaw. She claims Shaw is holding her email and contacts hostage. We suspect she just hasn't paid her bill and got cut off. She asked my girlfriend to ask me how to get her email. Anyway to do that? Other than paying her bill? Rob Dyck

3 2

Question about physical hosting
by Grigory Shamov 12 Mar '20

12 Mar '20

Hi All, A theoretical question: is it still possible to host a physical server in Winnipeg somewhere? What would be the range of the hosting price per 1U, if there are no large traffic needs to it? Googling brought me https://www.datacentermap.com/canada/winnipeg/fiber-back-up-canada.html which lists a price from 2015, $190/U. Is it a right range or things became much cheaper since? I am interested in the order of magnitude of the prices. Thank you very much in advance! -- Grigory Shamov WestGrid Site Lead / HPC Specialist University of Manitoba E2-588 EITC Building, (204) 474-9625

4 3

MUUG Meeting, Tonight (Mar 10), 7:30pm -- FreeSWITCH Asterisk Clone
by Gilbert E. Detillieux 10 Mar '20

10 Mar '20

An update on tonight's meeting, which will take place as scheduled: Health Concerns In light of the current concerns over COVID-19 and the risk of infection, we ask that if you are currently experiencing any of the symptoms* (fever, cough, difficulty breathing, etc.), please stay home. All those attending should follow recommended guidelines** for hand hygiene and coughing/sneezing etiquette. * https://www.canada.ca/en/public-health/services/diseases/2019-novel-coronav… ** https://www.canada.ca/en/public-health/services/diseases/2019-novel-coronav… The Manitoba UNIX User Group (MUUG) will be holding its next monthly meeting on Tuesday, March 10. The meeting topic for this month is as follows: FreeSWITCH Asterisk Clone Troy Denton will present FreeSWITCH, "a Software-Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a versatile software implementation that runs on any commodity hardware. From a Raspberry PI to a multi-core server, FreeSWITCH can unlock the telecommunications potential of any device. Combined with our hosted cloud platform, SignalWire, FreeSWITCH can interconnect with the outside world and scale to any size." The group holds its meetings at 7:30pm on the second Tuesday of every month from September to June. (There are no meetings in July and August.) Meetings are open to the general public; you don't have to be a MUUG member to attend. ******************************************************************* Please note our meeting location for this month: *Room 1M28* Manitoba Hall, University of Winnipeg, entrance on Ellice Ave. between Spence and Balmoral St. Parking is available on the surrounding streets and in the lots on nearby streets. Look for signage once you're at the building, or ask a security guard. ******************************************************************* For more information about MUUG, and its monthly meetings, check out their web server: https://muug.ca/ Help us promote this month's meeting, by putting this poster up on your workplace bulletin board or other suitable public message board: https://muug.ca/meetings/MUUGmeeting.pdf -- Manitoba UNIX User Group E-mail: <gedetil(a)muug.ca> c/o Gilbert E. Detillieux Web: http://muug.ca/ University of Manitoba Phone: (204)474-8161 Winnipeg MB CANADA R3T 2N2 Fax: (204)474-7609

2 1

UDP bad checksum flood
by Scott Toderash 03 Mar '20

03 Mar '20

[10192947.300008] UDP: bad checksum. From 1.2.3.4:10398 to 3.4.5.6:5060 ulen 237 I started getting some of this yesterday on one host. I think that there is a way to use regex and fail2ban to block flood attacks like this. Does anyone have the recipe? It comes in on various ports. This example is port 5060 but the host does not have anything listening there.

2 2

MUUG Meeting, Mar 10, 7:30pm -- FreeSWITCH Asterisk Clone
by Gilbert E. Detillieux 03 Mar '20

03 Mar '20

The Manitoba UNIX User Group (MUUG) will be holding its next monthly meeting on Tuesday, March 10. The meeting topic for this month is as follows: FreeSWITCH Asterisk Clone Troy Denton will present FreeSWITCH, "a Software-Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a versatile software implementation that runs on any commodity hardware. From a Raspberry PI to a multi-core server, FreeSWITCH can unlock the telecommunications potential of any device. Combined with our hosted cloud platform, SignalWire, FreeSWITCH can interconnect with the outside world and scale to any size." The group holds its meetings at 7:30pm on the second Tuesday of every month from September to June. (There are no meetings in July and August.) Meetings are open to the general public; you don't have to be a MUUG member to attend. ******************************************************************* Please note our meeting location for this month: *Room 1M28* Manitoba Hall, University of Winnipeg, entrance on Ellice Ave. between Spence and Balmoral St. Parking is available on the surrounding streets and in the lots on nearby streets. Look for signage once you're at the building, or ask a security guard. ******************************************************************* For more information about MUUG, and its monthly meetings, check out their web server: https://muug.ca/ Help us promote this month's meeting, by putting this poster up on your workplace bulletin board or other suitable public message board: https://muug.ca/meetings/MUUGmeeting.pdf -- Manitoba UNIX User Group E-mail: <gedetil(a)muug.ca> c/o Gilbert E. Detillieux Web: http://muug.ca/ University of Manitoba Phone: (204)474-8161 Winnipeg MB CANADA R3T 2N2 Fax: (204)474-7609

1 0

weird apache hit
by Trevor Cordes 24 Feb '20

24 Feb '20

I have a mystery hit on my apache server that is giving weird results that by config should never happen... and I can't figure it out. What's happening is very rarely a hit will "break out" of the dirs that I think all hits should be limited to. And I can't reproduce it with telnet tests. Somehow a hit is getting access to /var/www/html/ when that should be impossible. Yes, it's my document root in the global area, but immediately in my virtualhost for that IP and port I redefine docroot to a sub dir of that. There should be no way someone can hit the site and get to the original docroot. Yes, I am probably going to change the default global docroot to just be the same as my subdir one in the virthost, but I really want to figure out why the request can break out the way it is. The only thing weird about the hit, based on my customized logging details, is that they are hitting a ServerAlias of the virthost, which is a bit odd because that particular alias isn't public knowledge (though it's not really hidden either). Oh ya, and the IP is in HK and is trying fuzzing attacks again me. Here's the hit (IPs/hostnames changed): 1.2.3.4 - - [17/Feb/2020:02:40:07 -0600] "GET / HTTP/1.1" 403 199 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0" 80 9-w1.foo.com /var/www/html/ Note port 80, note the serveralias they hit us with, note the resulting directory /var/www/html Here's the error it generates: [Mon Feb 17 14:43:13.444291 2020] [autoindex:error] [pid 16365:tid 140334311606016] [client 2.3.4.5:54603] AH01276: Cannot serve directory /var/www/html/: No matching DirectoryIndex (index.phtml,index.html,index.phtml,index.php) found, and server-generated directory index forbidden by Options directive It's ok it's forbidden (in fact, might have saved my bacon) as I have dirindex forbidden globally. The thing is no hit should ever be trying to find a index.html in /var/www/html! When I try to recreate the hit to match the above manually with telnet, no matter what I do I can't get the serveralias to match their hit: telnet foo.com GET / HTTP/1.1 Host: 9-w1.foo.com User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0 Gives me a log result which matches what I expect the correct behaviour to be: 50.71.247.87 - - [17/Feb/2020:15:48:21 -0600] "GET / HTTP/1.1" 302 136 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0" 80 www.foo.com proxy:fcgi://localhost/var/www/html/Foo/Live/index.phtml What on earth are the other parameters or headers they are passing in that results in a different result than my test? I'm truly stumped. I could try to capture packets of a hit, but the "attacks" only happen 2-3 times a day and always from different IPs in Asia.

6 12

Bitcoin talk from the Long Con
by athompso＠athompso.net 13 Feb '20

13 Feb '20

2 1

Shaw blocking port 25 on business line
by Gerald Brandt 11 Feb '20

11 Feb '20

Hi, I've been fighting with Shaw for days on this. I have what they call a business account with 8 static IPs. I can telnet mail.shaw.ca 25 and get a connection. So, inside their network, SMTP works. If I try to telnet to any other server on port 25, i get no connection. e.g. telnet to google email servers fails, telnet to my server in Montreal fails.). To test that port 25 was open, they had me start Firefox, login to gmail, and send an email from my gmail to my gmail account. that was proof they weren't blocking port 25... Yeah. Right now, in order to get email out, i am using mail.shaw.ca as a relay. That is not supported, so they are asking me to not do that. I told them if I don't use them as a replay, i can't get email out. They did not understand. Does anyone have any idea how to get these guys to understand what is going on? Am i using the wrong terminology? I can't see how I can make it any clearer to them that they are blocking port 25 access to any system outside of their network. Gerald

7 19