Tag Info

Hot answers tagged

2

SSHd does not ban IP addresses. Whenever it encounters an authentication failure, it adds an entry to its log, and keeps going. Other pieces of software, however, may read these logs afterwards and ban IPs according to their rules. The most common daemon used for such a task is fail2ban. Fail2ban works with jails. Each jail is associated to a service, a log ...


2

This sure looks like malware that isn't hiding itself very well. Well-written malware would infect the kernel and arrange to hide itself completely from the task list. This one clumsily disguises itself as the innocuous uptime, but does a bad job of it, and uptime is suspicious anyway because it wouldn't be running for such a long time. If you confirm that ...


1

The answer is here: status="0" pidofproc $pidfile $daemon >/dev/null || status="$?" So status_of_proc calls pidofproc which sets $base. This variable value is set in the current shell and so its value persists when pidofproc returns to status_of_proc. For example: fn1() { unset var; fn2; echo "$var"; } fn2() { var=set; } fn1 OUTPUT set In the ...


1

There is also a package designed for saving and restoring the iptables rules. You should get the desired results if you install iptables-persistent


1

You don't need to install Expect on the server. Write an Expect script instead of running expect from a shell script. Have the Expect script itself spawn the SSH client, connect to the server and then loop through the numbers. To save yourself some effort you can record a session where you log in to the server and try some number with autoexpect. Save the ...


1

/boot/nnfwcjkwna does not look ok to me. Check out the process's pid and type: ls -l /proc/pid-number/exe Example: This way you will see the full path of the executable. Go there and check out the contents with ls -al. For binary files viewing use: strings file | more And then use space to browse down. Check out to see new opened ports and identify ...


1

You can also use pstree or ps auxf to find out which process is running which. (Maybe that output is more readable.) As you suspect any malware you should also check for processes trying to communicate on the network. You can also use netstat -tupln to check if any unexpected process is listening for remote connections. Similarly netstat -tupn will show ...


1

Well, technically, 1024MiB is outside if it's only 1024MiB large and you consider the end to be inclusive... Try unit s and print free, that should you show exactly what's available to the sector and let you create a maximum size partition. It probably won't show correctly with unit mib since there's too much rounding going on. Also, you can just use 100% ...


1

It seems your network configuration isn't matching your subnet declaration in dhcp.conf. Make sure that you have an IP address from the 10.10.1.0/24 subnet configured. You can check this using: ip a If you don't see such an IP address try adding it to e. g. eth0: ip a a 10.10.1.200/24 dev eth0 After that try again fixing the package: apt-get install ...


1

There is sslh. It can multiplex the connections depending on what type of client is asking. So if a webbrowser comes along it will forward it to nginx and if a ssh client tries to connect forward it to the sshd. The README.md will hook you up with a nice explanation on how it has to be configured.


1

That IP parameter is actually a kernel parameter, given by your bootloader. If you're seeing the kernel attempt autoconfiguration, there's either already one specified or your kernel has been built with a default to try autoconfiguration. Try removing the "ip" kernel parameter or specifying "ip=none" and see if that does what you want. That should be good ...


1

[a very late answer, but added for others that might follow] limiting which interfaces you run ntpdate for might be useful, but it sounds like your major problem is lack of functioning realtime clock hardware, hence the huge initial offset. I suggest you look into the fake_hwclock package. From the package description: Package: fake-hwclock (0.5) ...



Only top voted, non community-wiki answers of a minimum length are eligible