Over the last couple of weeks, apache.org, php.net and sourceforge.net suffered the consequences of using weak authentication such as username and passwords. A staff member at SourceForge logged into his UNIX account at his ISP, and used ssh to connect to SourceForge. The ISP system had been compromised and the ssh client had been trojaned to capture usernames and passwords of outgoing connections.
This gave the attacker a shell account on SourceForge's systems from which root access was gained. The ssh client on SourceForge's systems was also replaced with a trojan which gathered usernames and passwords.
Later, a developer of Apache logged on to SourceForge's system and using the trojaned ssh client, he connected to apache.org using a normal password.
This provided the attacker with a shell account on apache.org which was later elevated to root access using a buggy OpenSSH 2.2 daemon. Again, the trojaned ssh client was installed, but apache.org run a digital checksum of all their binaries every night, and the intrusion was discovered.
What should be learned from this? Always use strong authentication. Ensure that you can trust the binaries on your systems.
It has also been a big day in OpenBSD land. Darren Reed recently clarified the license surrounding his IPFilter package which resulted in Theo removing ipf support from OpenBSD:
Remove ipf. Darren Reed has interpreted his (old, new, whichever) licence in a way that makes ipf not free according to the rules we established over 5 years ago, at www.openbsd.org/goals.html (and those same basic rules govern the other *BSD projects too). Specifically, Darren says that modified versions are not permitted. But software which OpenBSD uses and redistributes must be free to all (be they people or companies), for any purpose they wish to use it, including modification, use, peeing on, or even integration into baby mulching machines or atomic bombs to be dropped on Australia. Furthermore, we know of a number of companies using ipf with modification like us, who are now in the same situation, and we hope that some of them will work with us to fill this gap that now exists in OpenBSD (temporarily, we hope).
Heimdal was imported into OpenBSD, and support for BSD_AUTH has also been pulled in. More security problems were found in sendmail. I do believe I will be running qmail when the time comes.
I will be away for a few days. Consider this another chance to get to know the rest of my site.
My day was nothing much to speak of except for a brief discussion with Dave regarding my policy when it came to playing "pass the blame." -- I absolutely refused and he argued that I must to survive in the corporate world. I still absolutely refuse. I consider it part of my personal integrity. Good thing I am the boss, hm?
(I would quote a scene from "Scent of a woman" here but I am too tired and too drunk).
Spent the evening with Mick (that's Michael to you mortals). I had not seen him for almost three months, so we went out to dinner at Ming Court and a couple of pints. We discussed -- in no particular order -- sex, women, relationships, Billy Connelly, The Cure, Pink Floyd, girlfriends, life, Hannibal (the book and movie), work and more. Of all the people I know around the world, none other has the same appreciation for quality food and music as I.
I love the guy.
If you are thinking "Alex is gay" you are the kind of ignorant person I would enjoy beating to a bloody pulp. If you are thinking that women, sex and relationships are the same thing, you are the kind of ignorant person I would mock in public. Then, if you were lucky, I would beat you to a bloody pulp.
Then, if you begged, I would piss on you.
On the 24th I said I might share with you, my secret of recovery. So I will. When I am absolutely worn down, when I have no more energy, when I want to quit my job, when I want to beat project managers silly, when I fail to understand or teach, when I want to take a shotgun to every building in the world, there are certain people I turn to for hope and a renewed spirit.
There are currently two such people in the world: 1) my spirited girlfriend and 2) Mick. Neither of them have any idea what they mean to me. They may think they do.
If you work really hard at understanding (not necessarily agreeing with) my views, person and ways through questions and discussions you might become the third one. In the movie Tombstone, the following conversation takes place while Doc Holiday and others are being shot at, for following Wyatt Earp:
Turkey Creek Jack Johnson: Why do you do it?
Doc Holliday: Wyatt is my friend.
Turkey Creek Jack Johnson: Friend? Hell, I got lots of friends.
Doc Holliday: I don't.
You might think me self-obsessed. That means you do not get it.
I returned home past midnight.
The news on the radio this morning reported of how a family living only a few miles from me (Mulhuddart) were attacked in their home late last night. The door of their house was kicked in at 2am and four men wearing dark clothes and ski masks stormed upstairs and proceeded to assault all four family members.
The newsreader specifically mentioned that no motive behind the attack has been established, which is bad. Similar attacks have taken place over the past few weeks and drugs do not appear to be involved. Either citizens around Dublin are pissing off the wrong people by accident, or someone is rehearsing assaults on people in their home for kicks or whatever reason.
I can deal with being attacked on the street. A number of options are available during such a scenario, especially if I am alone at the time. I can not cope with being attacked in my home and certainly not if anyone else is around. Short of killing every intruder, before they can hurt your loved ones, it would be a no-win situation.
What the fuck are you going to do if four men storm your house late at night and start beating and stabbing your family? You are weak, slow and disoriented from sleeping. If your bed is not a block of concrete, the soft material will slow your movements even further as you roll around trying to get out of bed. If you try to defend yourself, your family will probably suffer even more as a result. Hell, the intruders may decide to return later. They know where you live.
Violence breeds violence. Extreme violence breeds peace.
As with anything I am passionate about, I have a special place in my heart for poorly maintained servers and poorly written operating systems. This place in my heart has a label or sign on the door into that particular section. It reads: I told you so.
We care a lot.
Heimdal (a non-US Kerberos 5 implementation) was imported into OpenBSD over the weekend. Will watch changes closely. Theo also responded to my supportive email and in response to being labelled as arrogant he said:
I just cut through bullshit and get things done. It's not arrogant. It's called expediency. We can be nice to each other when it's over.
What is this talk about "nice"?
Dublin and Belfast are two very different creatures. The streets of Belfast are much cleaner than those in Dublin. The streets in Belfast become empty around 6PM when the shops close. Dublin is crowded until past midnight.
I found Belfast to offer familiar items at significantly lower prices than I was used to so I purchased some videos: "Godfather part one", "Godfather part two", "Legend", "Ordinary Decent Criminal", "The Hurricane" and "Dead Poets Society."
I also purchased CDs: "Greatest hits" by Texas, "Greatest hits" by Eurythmics, "Performance and cocktails" by Stereophonics, "On How Life Is" by Macy Gray and "Not That Kind" by Anastacia.
And I purchased "Black & White" and "Settlers IV."
Consider this.
And I'd give up forever to touch you 'Cause I know that you feel me somehow You're the closest to heaven that I'll ever be And I don't wanna go home right now And all I could taste is this moment And all I can breathe is your life And sooner or later it's over I just don't wanna miss you tonight And I don't want the world to see me 'Cause I don't think that they'd understand When everything's mad to be broken I just want you to know who I am And you can't fight the tears that ain't coming Or the moment of truth in your lies When everything feels like the movies Yeah, you bleed just to know you're alive And I don't want the world to see me 'Cause I don't think that they'd understand When everything's made to be broken I just want you to know who I am And I don't want the world to see me 'Cause I don't think that they'd understand When everything's made to be broken I just want you to know who I am And I don't want the world to see me 'Cause I don't think that they'd understand When everything's made to be broken I just want you to know who I am I just want you to know who I am I just want you to know who I am I just want you to know who I am
Holy sleepingbag, batman! The time is 5.30am and I am awake and out of bed. My headache is gone, my oversized, round, soft, cuddly tummy seems to want breakfast so all is well. I have a theory on my recovery that I might share with you later today.
I am headed for Belfast tomorrow morning with a friend and some of his mates and I will be returning Sunday afternoon. I have no idea what we will do there but the time away from work will certainly do me good. Knowing Tony he will probably suggest we go to a stripjoint which I will absolutely fucking refuse.
If I had a digital camera and some photography skills I could blow you all away with unreal pictures when I returned. Someone stop me before I go out and buy a digital camera today. Please. I have enough gadgets in my life.
Remember how I was talking about clockspeed the other day? I just synced with the remote time source, and this is how accurate clockspeed keeps my local clock:
before: 2001-05-24 06:25:26.628588000000000000 after: 2001-05-24 06:25:26.763116443847656249
Usually my local clock would drift several seconds during a day. Now there's less than 150 milliseconds drift over more than 48 hours.
"Why is this important?" you ask.
Having a reliable timestamp for your logfiles is very important in legal proceedings against computer criminals as it will allow you to correlate information about an attack from different network devices. With accurate timestamps, the defense lawyer will be unable to dispute what you present.
That handy piece of information comes absolutely free of charge because I am such a nice guy.
Judging from the 2.9 pre-release annoucement Theo sent out today, I am making a lot more money than he is. He suffers from the same flaky health that I do, it seems. Sent him supportive email.
Suffered from a mean headache for most of the day. The pain made it difficult to concentrate. I was surprised to find myself at home before 8pm.
Helped two clued-in students at Aalborg University by reviewing their fourth semester paper called "Multicast Spanning Tree extension for Optimised Link State Routing."
[22:11] <TSi> Det jeg egentlig ville sige var at vi skylder dig en tjeneste
eller to for at gi' dig tid til at læse og kommentere vores artikel.
[22:12] <GamleAlex> TSi, jeg nyder at hjaelpe folk der ved hvad de laver.
[22:12] <TSi> Tak =)
Ate garlic sausage sandwiches and a banana. I have deserved to sleep now.
Oh, bugger. A very brain-intensive day for me. Early to bed, I think.
Problems sleeping. Feeling strange. Lack of sleep means I finally got around to understanding clockspeed. Sweet.
I also discovered the securesoftware mailinglist hosted by Dan.
It will be next week before a price can be quoted to me on hosting of mongers.org, but the full price is much lower than anticipated. I may also be able to get a reduced rate as there is no administrative overhead for my employer. The possible need for a commercial venture has been eliminated.
Felt inspired to restructure some of the information available on my page as you may have noticed when looking at the splash page. No URIs were harmed during this re-allocation of words.
I know of three very good things to come out of Canada. They are OpenBSD, Zero Knowledge Systems and Does Humour Belong in Technology? (dhbit). Dhbit is a community of a) funny people who do a weekly live streaming MP3 radio show, and b) people who seem to like to listen to attituded, funny net radio shows with a hint of technology rants.
I was up until 5am this morning, listening to a live broadcast of dhbit, and the interesting thing is they have an IRC server where they interact with their listeners during the show. They start off with a roll-call, and it was amusing to hear a (sexy) female try to pronounce my IRC nick over the air.
Find audio archives and more information on their web site.
I also encountered a log file (titled "The Muppet Show") from #linux.dk a day I was not present in the channel. A number of my fans can be seen paying their respects. It is in Danish, and I link to it from the muppets page.
Attrition has decided to stop mirroring defaced web pages and concentrate on more important aspects of their web site. This pleases me.
Meant to get some work done on Dancer 4.16.1 but thanks to the routing capabilities of the WOL network I gave up. A number of outstanding bugs and things I want to change are becoming pressing matters.
Offered recommendations on how to improve host security on f-control.area51.dk. Gorm is clearly a firewall head not a penetration tester :) Stocked up the fridge with Coca Cola and 7up.
Made someone important smile and laugh.
I went to see "Along Came A Spider" starring Morgan Freeman. It annoys me ever so slightly that ever since he starred in Seven, he has been typecast into the role of a police officer with a skill in psychology. The roles he took on in "The Shawshank Redemption" and "Driving Miss Daisy" show his true talent.
Depressed by the quality of the plot, I dashed headlong into the local HMV music store, and emptied (yes, really) their shelves for Tori Amos material. I purchased "Little Earthquakes", "Under The Pink", "Boys For Pele", "From The Choirgirl Hotel", "To Venus And Back" and last but not least "Maximum Tori: The Unauthorized Biography of Tori Amos."
"That'll be £94.94, sir."
I trust you have seen or heard of the numerous movies relating to the Internet that Hollywood spewed out during the nineties. "The Net", "Hackerz", "Sneakers" were all generally ill-informed and ridiculous to the extreme regarding the capabilities and characteristics of computers and related technology. One particular aspect I took notice of were references to young computer criminals shutting down the power grid of a nation.
Until today these references always made me roll my eyes and want to puke, but during the space of three seconds today, I was offered a view that changed my mind on intruders shutting down a power grid from "get real" to "Holy fuck. I wonder why it hasn't happened yet."
Sigh.
I have a headache.
Goodbye is actually not a word. It does not exist. Good-bye does, but they are clearly two different words. To think I have been wrong all these years. I would like to clarify that, anytime I have written "goodbye" except in these examples, I actually meant "good-bye."
For many years I have felt that dictionaries are underestimated pieces of .. dead trees.
Are you a duck person? If you are, take a look in my jokes repository. If you are easily upset by annoying ducks, you should probably not take a look. You were warned.
(No, today's entry does not really make sense. It is late, and my tummy has been upset for part of today so what do you expect?)
Woke up later than I should have. Shame on me.
I received a negative on my request for free hosting of mongers.org with my employer, which forces me to use the commercial offering and become a customer like anyone else. We are now working out the cost side of things. I do not expect this change in cost to reflect unreasonably onto the users. I plan to engage in micropayments before starting to charge users for their access.
The micropayment option could be teaming up with amazon.com and other suppliers, so anyone who wishes to support mongers.org can purchase goods from these web sites by first going to mongers.org, and clicking a link that carries the referrer log from mongers.org. There would be no change in price for the items you buy, but mongers.org would receive a percentage of the money you spend. That is not unreasonable, is it?
I could also offer quality DNS hosting for a nominal fee, as I seem to recall that many in #linux.dk (and elsewhere, I am sure) have a hard time finding reasonable secondary DNS hosting. If you can afford a machine, you can afford to pay a small fee to ensure others can find it.
I do not like the idea of charging for shell accounts, as my goal with mongers.org is to provide access to those who can make something of it.
Mmmmm. OpenBSD just created an SMP branch in CVS. With any luck, the next release will have support for multiple processor boards. Guess who will be buying a dual CPU motherboard for his new PC.
This is what OpenBSD on my supercomputer looks like:
load averages: 0.09, 0.09, 0.08 23:50:47 15 processes: 2 running, 12 idle, 1 zombie CPU states: 1.2% user, 0.0% nice, 0.8% system, 0.8% interrupt, 97.2% idle Memory: Real: 3460K/9712K act/tot Free: 1464K Swap: 1408K/64M used/tot PID USERNAME PRI NICE SIZE RES STATE WAIT TIME CPU COMMAND 11060 root 28 0 380K 1324K run - 0:01 4.05% sshd 20271 holsta 28 0 132K 872K run - 0:00 0.49% top 21213 holsta 18 0 376K 300K sleep pause 0:00 0.39% ksh 5728 root 10 0 560K 308K sleep nanosl 0:59 0.00% ipmon 30368 root 10 0 224K 396K idle nanosl 0:12 0.00% cron 16179 root 2 0 332K 976K sleep select 0:08 0.00% sshd 1260 root 2 0 104K 492K sleep select 0:09 0.00% syslogd 21986 root 3 0 344K 260K idle ttyin 0:02 0.00% csh 2997 holsta 3 0 376K 4K idle ttyin 0:00 0.00%1 root 10 0 340K 152K idle wait 0:00 0.00% init 13202 root 3 0 44K 4K idle ttyin 0:00 0.00% 31113 root 3 0 44K 4K idle ttyin 0:00 0.00% 1809 root 3 0 44K 4K idle ttyin 0:00 0.00% 4319 root 3 0 44K 4K idle ttyin 0:00 0.00%
This is the df -h output:
$ df -h Filesystem Size Used Avail Capacity Mounted on /dev/wd0a 62M 21M 38M 35% / /dev/wd0d 62M 2.0K 59M 0% /tmp /dev/wd0e 62M 25M 34M 42% /var /dev/wd0g 1.5G 215M 1.2G 15% /usr /dev/wd0h 566M 52M 486M 10% /home
What a beast, hm?
I have received a number of bugreports for Dancer, but I have not had time to look at the cause yet. Version 4.16.1 is long overdue, as it is. Perhaps this weekend?
Got up, went to work. Returned home at 10pm. Fell asleep. So much excitement in one day.
All my documents should now include my style sheet, so I will be able to play with layout and colours. I briefly changed everything back to green like in the old days, and it was just not the same. I guess Sade was right: it is not as good as the first time.
Bumped into a chap tonight on IRC who me informed of a place where violations of the type of rules I have listed on my IRC document resulted in a server ban, so I rushed to find a small group of clueful people in a corner of the universe. I predict I shall spend much time there. I may even leave #linux.dk and flush my ignore list. Many people would like that.
Enabled content negotiation for my virtual host, which means all file extensions are now hidden from user agents (browsers). This feature, along with some planning on my part should keep my URI space much more stable in the future, so I no longer have to move or rename files. I will be able to change publishing mechanisms as much as I desire without bookmarks or search engines pointing to a file that no longer exist. Cool URIs don't change I tell you!
My next challenge will be to provide correct redirectors for all documents as I move from area51.dk to mongers.org in the (hopefully) near future.
Follow my example. I dare ya. I double-dare ya, motherfucker.
Douglas Adams passed away 11th May 2001.
I got out of bed before noon which is good considering the hour I went to bed.
One is really getting old and fat. Those of you who think sex on a regular basis is tough (when one has gone without it for a long time), should try rollerblading on a sunny day. Not only did my back start to hurt, but after less than 30 minutes of skating around, I felt my legs getting tired to the point of moving slower than comfort. If you have never had a pair of rollerblades on your feet: it involves a lot of shifting of weight, and if your legs are too tired to shift quickly, you will smash against the surface you were happily running on.
I am approaching my fourth year in Ireland, and today I saw something I have never seen in this country before. I saw two females sunbathing topless on a lawn next to one of the areas where I skate. Frankly, I had never expected this (the topless part, not the sunbathing) in Ireland, and I am willing to bet the two females were not Irish.
I went and bought VHS copies of Gladiator, Ronin, Scarface, Men In Black, Legend and Rain Man. Have I mentioned I love spending money?
I also called my bank as my credit card is going to expire next month, and I will be needing it. If I cancel my card now, and order another one they can get it to me within 4 working days. If I let my card expire, they will automatically send me a new one, but this could take up to 4 weeks. What the hell is wrong with these people? My travels and Internet purchases renders me helpless if I do not have my credit card. Fools.
Somebody on #linux.dk is a spineless chicken with poor taste (and worse spelling). He used the channel bot to set the following topic:
[23:10] *** Topic change by LinuxB0T on #Linux.dk: [2.4.4|]-[IRC evnent hvis
vi vinder iaften.. Mødes på rødhusplasen]-[http://irc.linux.dk]
So sad.
Speaking of sad, I realised that I am approaching my 7th year of using IRC. Holy IRC client, batman.
I was suspected/accused of being under the influence of alcohol, simply because I was honest. Took me a while to recover. What is the world coming to, if one can not be on the ball without having consumed alcohol?
Network details for mongers are still pending -- I had hoped to get the machine attached to the network so I could work on it over the weekend, and prepare it for users. But no.
The ESB (Electric Supply Board) are taking the piss. I had a power failure in the apartment (again) around 11pm, and although I was only leaving work around that time it took out my alarm clock (yay!) and my OpenBSD gateway. I should arrange penalty beatings for every time it happens. Imagine the size of my upper arm after a few months, if I actually went ahead and did it.
I was catching up on OpenBSD mail, and a few days ago a new user posted a request for information about what features will be in version 3.0 when it is released around December. Note that 2.9 is only due for release on July 1, so he was getting slightly ahead of himself.
A minor flamewar resulted, and some users demanded a roadmap or a list of things that are pending, which is bold to do for something of OpenBSD's quality that you are not paying for, nor contributing to. The moaning users were encouraged to shut up and contribute. Someone commented that he could not believe OpenBSD development was ad hoc, and that there had to be a planning document. To this my cuddly toy, Theo de Raadt, responded:
I don't know where the myth of "planning" comes from.
I was on the floor. Theo kills me.
I also read more of "Expert C Programming". It was recommended to me by my evil coder, and I can only agree. The author is seriously skilled, and is an excellent writer and communicator of knowledge. He writes in the preface: "Expert C Programming should be every programmers second book on C." -- if you are an average C programmer this is a book to sleep with until you understand every page. The author headed up the compiler development team for Sun Microsystems for a number of years. Evil coder and I agreed that Mr. van der Linden might very well know what he is talking about.
"Some people say that you can't compare apples and oranges, but why not -- they are both hand-held round edible things that grow on trees. Once you get used to it, the fruit loops really seem to help. There is one other convention -- sometimes we repeat a key point to emphasize it. In addition, we sometimes repeat a key point to emphasize it."
Ate some cake that someone made for me. Went to bed around 5am.
Big fat cardboard box from Dell at doorstep. Contains big fat PowerEdge. Waiting for rack space and network details.
Interviewed two new possible candidates for the team. They are likely to read this, so I will comment no further. </torture> Merged some of the changes to the internal homepage I made this weekend, so I hope to commit most of these tomorrow.
I am listening to MP3 files copied onto my Jukebox. I have already grown used to my Sennheisers, and my Sony earphones are shite. Absolute fucking shite. Every silverlining has a cloud.
In the middle of all this, I woke someone up who preferred they had not been woken up. Noted for the future.
I have returned. I brought with me some Danish food to consume while making loud various noises. I also brought more Danish sweeties, and there is chocolate this time, Dave, so shut up and eat.
I also purchased two new toys: Sennheiser HD570 headphones and ARCHOS JB 6000 MP3 player. Due to complaints, I am going to remove the speakers I attached to my Windows 2000 machine in work, and use the HD570's. Keep your filthy fingers away from my headphones, boys. They were £120.
I almost bought a helicopter, but someone stole my attention (and something else, too).
I am told that my books have arrived, but the Dell PowerEdge has not. I took a peek at the web server logs again, and Google have been to visit. I am pleased to announce that searches for my name now brings up the Dominion as the first hit. Several of my technical documents also made it to the Google directory, which has increased the number of loads.
It will be a challenge to handle redirects to the new machine and domain correctly, but I shall strive to set an example for others to follow when they need to move home page.
I am flying to Denmark tomorrow, and will be returning Wednesday. My diary will be neglected until then. You should use this breathing space to get to know the rest of my site.
Listened to muppets protesting against corporate greed. Some people have too much time on their hands.
Meant to go home, but ended up discussing DOS memory segments and C programming with Jerry. Do you hate when that happens, too? Our chat turned to books, so I cruised onto amazon.co.uk and bought "Expert C Programming" and "The C Programming Language, edition 2".
So it is 3am GMT, and I am still in work, and I am hungry. Fuck.
I reached critical mass on the auld Windows 2000 system today. 9 gigs of disk filled. I remember when I bought my first 127MB harddrive. It was huge. Absolutely fucking huge. A year later I had still only used 40MB.
Due to various technical problems, I added a "usage note" to my IRC rules. I do not want to repeat myself in the diary as it might change, and we would all really hate absolete diary entries, would we not? If you talk to me on IRC, read it.