« first day (1319 days earlier)      last day (3662 days later) » 

12:00 AM
I wonder how much the vodka contributed to what we see
 
Curious - anywhere here work in a group where servers and networking is separated into different groups?
 
@cole yes
 
@cole yes
 
My question is - right now we use Infoblox for DNS
 
@cole Almost every employer you'll ever meet.
 
12:03 AM
Are you guys using Windows for DNS or an appliance like we are
 
@RyJones This (wonderfully hilarious) book might help you understand: amazon.com/Doppler-Erlend-Loe/dp/1781851050
 
@cole But there's a long-term plan to combine us into a single "infrastructure" group with a common manager. (but still separate leads, etc)
 
if using Windows DNS - does the networking team deal with it? or server team?
 
Server team, for god's sakes
 
@cole It's been my experience that if one uses an Appliance then it fits within Networks. If one uses a managed server (linux/bind or Windows) then SysOps.
 
12:04 AM
Right now our networking team is in charge of the DNS/Infoblox
 
@cole We use BIND on Linux with NS records for the AD sub-domain. The server team does the DNS changes. Networking submits tickets for what they want done.
 
@cole Windows DNS for internal/AD DNS handled by Server Ops, PowerDNS for public DNS handled by a dedicated Hostmaster
 
I personally think we should using AD-Integrated DNS
 
I barely trust the networking team with layers 1-3, certainly not 7
 
Network team delivers... well, core network services
 
12:05 AM
@RyanRies Are there any layers you trust to people not you?
 
So the issue is our smaller infobloxes can't handle all the host records
 
@ScottPack Not really... not if I want to be sure it was done right.
 
So, scarily - most sites unless they have a DC aren't in DNS
 
@RyanRies I eventually broke my wife of saying that line and replacing it with "not if I want to be sure it was done my way". That's at least more accurate.
 
@cole if you don't have any services that needs to be located through DNS there's no reason for site references
 
12:07 AM
@ScottPack Fair point... incoherent grumbling
 
@MathiasR.Jessen there's servers and such that we're responsible for at these sites.
remember - 5 sysadmins for 87 sites.
 
@RyanRies Not that your way may not be the right way, just that one phrasing is more technically accurate. :)
 
@MatthewIfe Internet died
 
np
re-attach
 
12:08 AM
Honestly, I'd just like to come up with a solid standard
 
@MathiasR.Jessen added to my to-buy list
 
@cole make sure Automatic Site Coverage is not turned off, DC's will by default register site-specific locator records for the sites they assume coverage of
 
@MathiasR.Jessen thing is - not every site has a DC (not even close)
 
@cole sounds like you should move to Portland
 
But my manager asked me to standardize DHCP/DNS
 
12:12 AM
@cole In that case AutoSiteCoverage is even more important ... if not, clients in DC-less sites will contact any/random DC
instead of the fastest/closest one
I'm sure @RyanRies can tell you all about that if he's not too pissed about the Network department :D
 
@cole Do you know what your manager means when he says that?
 
@MathiasR.Jessen Thanks I'll look into that - I think that really needs to be set ASAP
@ScottPack he wants me to come up with a plan to either go with AD-Integrated or Infoblox - or something else.
That's all he's told me. Not high priority but it's on my list of doing all the work
 
@cole But you know what he means by standard. Good.
 
@ScottPack yes, I asked what he wanted not what i thought he wanted.
But whenever I ask what he wants he usually defers to me and says "what do you think is best?"
Welp - I foobared Java on my Fedora installation trying to install 32bit alternative for Network Connect. /rage
 
Fucking Network Connect
 
12:23 AM
@ScottPack piece of shit.
 
So not even Pulse, eh?
 
Nope :(
I got it to work before I formatted my laptop because KDE was being flaky as shit and just some other shit wasn't working right - now I can't remember how the fuck I got it to work.
howdidibreakthissobadly
 
You installed KDE
 
@ScottPack I'm running XFCE
 
Sounds better.
Remember the good ole days when Gnome was useful?
 
12:26 AM
Yes :(
 
Have you looked at Mate?
 
@ScottPack briefly
I thought about it
 
So...weirdness. Updating nvidia driver and was hitting 7 MB/s over wifi. Speedtest doesn't crack 4 MB/s. Wut...
 
I don't know anyone else running it and I've always had really good luck with XFCE.
 
@cole Java. There's your problem.
 
12:32 AM
Java: Not even once.
 
@cole It's not as bad as some dependency hell issues with linux though
 
no idea wtf i did
 
Does it just throw up in a blaze of console error glory?
 
@NathanC broke in both Chrome and Firefox lol
 
oh, so just the plugins are broken
 
12:34 AM
Yeah
and I created the symlinks in the plugins directories
it's still all nope
 
afaik the plugins require the 32bit version of java
what distro?
 
Fedora 20
 
@NathanC that's...actually what I used and now my shit is broke :)
 
oh...lol
 
12:36 AM
hired consultant will teach them morals?! and no one here want to discuss how to make it more harder!!! where do you get these ideas!!! — atErik 2 mins ago
I love this guy
whoops
there we go
 
@cole Try the icedtea-web package
 
Bob
@TheCleaner NOOOOOOOOOOOOOOOO
@MarkHenderson I simply must know which designer she got her dress from! Oh noes, they're all sold out!
:S
 
@NathanC yeah I've tried that in the past and it did not go well lol
I had it working
 
@Bob rolls eyes
 
undo your changes? :P
 
12:40 AM
@NathanC doing that now actually.
 
Hello all
 
Anonymous
OpenBSD's stripped-down fork (read as: readable, maintainable) of OpenSSL will be called LibreSSL
 
Weee, fixed it
 
@PatoSáinz Old news
 
/rage
 
12:45 AM
So I just found out that our Windows 7 VM template is so old that it doesn't even have SP1 on it
 
 
Guess who gets to go through and update all our templates now. Sigh.
 
Any bakers in the house? I know there might be a foodie or two here.
 
@ewwhite finished an initial (sloppy in some parts) policy. But needs refinement and i've not really scrutinized how much of the access tried is really needed. Will still prevent stuff like an attacker writing into odd places in the filesystem and attempting to connect to odd network services and/or start stuff on odd network ports.
 
1:00 AM
@MatthewIfe it's strange because business software is never really focused on security
lots of holes in this package
 
Its just doing silly things.
Invoking ps -A in a C program seems ludicrous.
May as well have written a shell script.
 
@ewwhite I decided to continue college. I couldn't let @ewwhite down!
 
@MatthewIfe there's stuff like...
which literally runs... "ps -ef | grep <string>"
the string is supposed to be a user's ID...
 
@ewwhite Nope! Chuck Testa!
 
but can obviously be anything
 
1:04 AM
yeah i see.
 
it's meant to be followed by...
 
I wonder if its just best to not even bother with the setuid and simply run the whole user in user_t without adding extra policy.
 
Since you can run arbitrary comands anyway.
What happens if you run in one of the commands
the text $(/bin/bash)
or better still $(exec /bin/bash)
 
well, the users can't see the program screens I showed
but they CAN kill their own PIDs
 
1:06 AM
@ewwhite how do your produce clients feel knowing that you work for their competitors as well?
 
and superusers may enter an incorrect PID
usually, it's the PID for the SSH daemon
it's happened about 10 times
@MarkHenderson they don't seem to mind... it's so weird.
 
@ewwhite There's one particular industry here called Test and Tag, and we service the two largest providers in the industry, and they are constantly stealing contracts from each other, and they win these contracts based on the cost cuttings that our software provides them
It is super weird, but they both know that each other has our software, and they both came to us independantly and at the same time
 
@MarkHenderson The produce customers all have custom software. The source code only exists on their systems.
(there's no version control)
 
@ewwhite Wow, I hope your backups are tested thoroughly
 
so if client X needs program Y to do something, the programmers jump in and modify it on the spot
 
1:10 AM
You know how unbelievably scary that is, right?
 
@ewwhite using your trest box
i got a shell
 
sometimes customers will have years of changes made by programmers... then get an upgrade... and lose thousands of hours of custom work... because the programmer didn't check the software changes back in.
 
via the ppro
 
@ewwhite Oh that's bad
 
happens every time
 
1:11 AM
Long shot I know, but virtualise + snapshots before upgrades?
 
@MarkHenderson I'm pretty sure that @MatthewIfe getting a shell is bad too.
 
@MarkHenderson They take a copy of the old system and put it in another directory
@MatthewIfe how did you do it?
 
@Jacob Yeah I suspect it is
 
@MichaelHampton my wife is a power user of the software and her firm uses it...
so I get it from both ends.
4
 
1:13 AM
@MatthewIfe Great zero sanitation of input then. Sounds like code @MarkHenderson would do.
 
hostname -f reads from /etc/hosts correct?
 
@MatthewIfe hmm, doesn't work for me
 
unless dns is first in nsswitch.conf
 
works for me.
 
@Jacob Unfortunately I suspect you are right
 
1:14 AM
@DanilaLadner On what platform. On Solaris it sets the hostname
 
its ;/bin/bash
 
oh, ;
 
the semi colon ends the 'grep' input and starts the new comand.
 
@Jacob rhel
 
@MatthewIfe What about && /bin/bash ?
@DanilaLadner yes
 
1:15 AM
I just pwned @ewwhite. Thats life objective 57 done.
 
@MatthewIfe hey, I wouldn't even want that command there
 
@Jacob the entry field only takes so many text spaces. Just happens that that fits.
 
it's like they don't know pgrep and pill exist
and don't get me started on the setuid programs...
there's one called killpid
 
dont tell me these things, i'm going to root you
 
with source code
 
1:18 AM
I'm glad someone else is doing this.
 
@MichaelHampton doing what?
 
@ewwhite hackin your servers
 
@ewwhite Rooting your boxes.
 
@Jacob oh, they get hacked on the regular.
3 hours ago, by ewwhite
Developer in October: I've setup the "testuser" Linux account at Engorged Banana Produce on Production as well as on the "setsys 1" environment. (Login & Password are both "testuser".) Eric wants this linux account to log directly into the 'setsys 1' environment. Can you update the bash profile script to do that?
 
@ewwhite Was that as melodramatic as it appeared to be?
 
1:20 AM
@Jacob no, it happens...
I just service the accounts...
and keep it running
 
oh
 
I did offer the software company some performance and better practices advice.
and they feel that they've evolved enough without me to handle that on their own
(i've been gone for 6 years)
@MatthewIfe Done hacking things?
Nope... you're looking up the man page for setuid
 
i am trying to use passwordless ssh whenever possiible.
 
@DanilaLadner ok?
 
@ewwhite Just curious, how do those boxes get hacked?
 
1:27 AM
7 mins ago, by ewwhite
3 hours ago, by ewwhite
Developer in October: I've setup the "testuser" Linux account at Engorged Banana Produce on Production as well as on the "setsys 1" environment. (Login & Password are both "testuser".) Eric wants this linux account to log directly into the 'setsys 1' environment. Can you update the bash profile script to do that?
then...
3 hours ago, by ewwhite
[root@Engorged_Banana ~]# su - testuser
************************** C O P Y *****************************
-bash: /ppro/ppro1/bin/setpsttn: No such file or directory
/ppro/ppro1
-bash: /ppro/ppro1/bin/ALIAS.TXT: No such file or directory
-bash: /ppro/ppro1/bin/CLEANUP.TXT: No such file or directory
cat: /ppro/ppro1/bin/DBCENV.TXT: No such file or directory
cat: /ppro/ppro1/bin/DBCENV.TXT: No such file or directory
cat: /ppro/ppro1/bin/DBCENV.TXT: No such file or directory
-bash: /ppro/ppro1/bin/rundbc: No such file or directory
 
@ewwhite sorry :)
 
bleeping iphones trying to get contacts off...
@MarkHenderson I'm test & tag certified, which software?
 
@Andrew We have a piece of software that interfaces with WinPATs and ummm
Some other POS Access-based application
We do workorder management, so we interface their systems together into our system and they do everything from our system
 
nice.
 
ssh root@50. wait, how the hell did you get a /26?
 
1:31 AM
@ewwhite now I'm root
fnar
 
@MichaelHampton ??
 
@ewwhite Your IP netblock is recorded as a /26
 
@MarkHenderson heh, wavecom are based in Adelaide and we have one of their testers... thinking about WinPATS but also something simpler
 
@MichaelHampton yeah, I have a /26 there.
 
@Andrew Wavecom! Thats the one
 
1:33 AM
@ewwhite I mean, did you have to give the CEO a lifetime pass to Brazzers to get those IP addresses?
 
So our client actually hired a software guy to replace the WaveCom software and talks to the PAT tester via Bluetooth directly, downloads the SSS file and then transfers the results to us, and we process them and generate a report
 
@MichaelHampton I get a /26 whenever I establish colo.
for this type of setup
 
@ewwhite
beh, doesn't show it in the chat. Nevermind.
 
that's nasty
 
I got root really really easily.
I mean, really easily.
 
1:36 AM
@MatthewIfe it's not difficult
 
I know. I ran sudo -i from the shell.
 
@MatthewIfe that's on purpose
 
Seeing as a) I can spawn a shell then b) run sudo I'd consider all your boxes at the moment wide open.
 
@MatthewIfe meh.
I'm not paid to secure them
so I'm trying my best to get all of these sites to close SSH
 
who runs ipv6 in the shop?
 
1:44 AM
@MatthewIfe BTW, the sudo was because the user was in sudoers
as well as the developer accounts
 
We had some issue with security...mostly because of the mentality of "we don't have that much important data, so who would want to hack us?"
thankfully we weren't actually hacked...and i corrected some bad things to reduce the chances
 
I actually only had ONE targeted produce system hack
from a rival produce company
 
"from a rival produce company" i like this bit.
 
@ewwhite We had an issue with a sister company...the GM quit and founded a rival company across the street and started pillaging employees from the old company
 
@DanilaLadner well, not quite...
 
1:47 AM
that company is your client too
 
and guess what...no contract
 
one produce company was also the only Taxi company in Charleston West Virginia
and there was a Taxicab activist who was very upset that this Taxi company didn't enforce the use of passenger seat belts...
so he threatened them and said he was going to hire a hacker to ruin their Taxi/Produce business
and he did!
 
hmm, interesting.
 
@MatthewIfe Done for now? I'm assuming you have a couple of IRC servers and a penis-enlargement spam bot running by now..
 
So, did they enforce seat belt use following said hack?
 
1:52 AM
@ewwhite thatll do for now
theres a possible root exploit that can be done without using sudo
cause killpid makes no effort to unset environment variables.
 
@MatthewIfe oh, I've had people run local exploits as well...
get in as user tony:tony
or scp a file in
or ftp...
all sorts of silliness
execute in /var/tmp
 
@ewwhite I can definitely get root
but its destructive for me to do it to you
so i wont do that
 
@MatthewIfe It's time for you to go to bed. SSH access is being turned off.
 
lol ok :)
make sure you dont have /ppro/bin as 777 and the setuid binary as 666
since I can simply overwrite the binary to execute some arbitrary code that spawns a shell as root
 
break into root shell
 
1:58 AM
@MatthewIfe that's been done before... not on that binary, but on another script
 
@ewwhite I've logged off :)
Remind me not to pay for something from whoever runs that company ;)
 
mmhmm...
@MatthewIfe Wait dude... you left something behind!!
root      29291  0.1   0.0     896  504 pts/4    S      19:47    0:09 ./ssh-scan  300
root      30855   0.1  0.0    896   504 pts/4    S      19:48    0:08 ./ssh-scan  300
root      31985   0.1  0.0    896  504  pts/4     S     19:49   0:07 ./ssh-scan    300
root      1614  0.1   0.0     896  504 pts/4    S      19:51    0:08 ./ssh-scan  300
root       1929   0.1   0.0   904   496 pts/4    S      19:51    0:09 ./ssh-scan  300
 
like f prrofpoint gives sudo for less, haha stupid mofos, so easy to get root on the appliance.
 
@ewwhite dont look at me :)
i did leave some goodies in tmp
@ewwhite If you're not actulaly kidding, i'd check the lstart on those processes if I were you.
 
@MatthewIfe I'm joking... it's from a post-mortem from another hack.
 
2:03 AM
I tried to LD_PRELOAD the binary but it seems the linker doesn't (rightly) export certain environment variables even if they are declared.
seeing as binary is 666 anyhows its probably besides the point to try to be too smart about the whole thing.
 
@MatthewIfe ♬ Six! Six! Six! Permissions of the beeeeeast! ♬
Also, calling @HopelessN00b
Can you do something about that?!
 
@MatthewIfe it's in the developer's manuals... they "chmod 666" everything
 
chmod 888
 
if there are any standard user commands that also allow you to input a variable
i guess they can spawn shells too. Didnt check that though.
 
a bunch of lpr and cups commands
 
2:08 AM
Make sure the developers know that they are also my wife now then ;)
time to sleep night guys.
 
:(
 
@Wesley Of course! With a SuperUSer diamond, I can, and will clean out that review queue by deleting the crap.
 
@HopelessN00b Delete all the SuperUsers!
 
Just the ones who need deleting. :)
 
@HopelessN00b Everyone but me.
Okay @JourneymanGeek can stay.
 
2:21 AM
@ewwhite I can't get in with my brazzers login
 
I forgot my password, can you reset it? The username? It's root. OK, thanks!
 
@MichaelHampton Of course I can reset your password... but only if you provide your credit card number and bank account information as proof of your identity.
 
2:46 AM
Prime example of HopelessN00b's "slow motion trainwreck" questions here:
-1
Q: Is it possible to have a webserver serve pages over the internet without a domain name/URL?

cruss puppyResearch tells me yes, but just wondering. Since I can easily setup server software and use my device as a light server for a few pages and relevant info, can't I not provide the address to the server without bothering to spend money getting a domain name? Is this possible? The reason is to no...

 
2:57 AM
@EEAA That guy..."i don't know what I want, but all your perfectly good answers are wrong"
 
@NathanC Yup.
 
he is just a fucking dickhead.
 
Jesus. That went real bad, real fast.
 
I am surprised you had so much patience to explain abc to him.
 
@DanilaLadner My patience was nearly out, which is why I performed a high-speed bailout. :)
 
3:04 AM
Lol. plus the answer of "LinuxDevOps" is just lol, stick to damn software development, boy.
or actually not.
 
3:21 AM
I'm so freeking sick of the term "DevOps". I'm almost more repulsed by that term than cloud now.
 
3:33 AM
@EEAA Now with Cloud Seating Technology!
 
yeah, very true.
 
hah
Cloud Butt Seating Technology
 
I tried that IP address ... can't connect. Was that an example or an actual server? — cruss puppy 2 hours ago
 
err...stupid markdown
 
Close reason: OP is a thickheaded idiot.
 
3:35 AM
How do you do a stupid strikethrough in these parts?
does this work?
Yup, there it is.
You know what also gets my goat? This:
0
Q: hyper-v linux guest udp packet loss

user640466Using a Hyper-V 2012 R2 host, I have (as a test) four CentOS 5 VMs running a UDP streaming application (a high rate of UDP unicast packet streams sent from the VMs to several 1000 "remote listeners"; under 1000 streams per VM with a total bandwidth of less than 20% of one GbE link). The Linux Int...

big friggin' blob of text.
I can't even bring myself to attempt reading through that to edit in some paragraphs.
 
@EEAA throw some bacon ipsum with no \ns in as an answer.
 
> Normally, both your asses would be dead as fucking fried chicken, but you happen to pull this shit while I'm in a transitional period so I don't wanna kill you, I wanna help you. But I can't give you this case, it don't belong to me. Besides, I've already been through too much shit this morning over this case to hand it over to your dumb ass.
Wow, that's about how I feel about moderating SF.
 
Guys... SF chat... you never let me down... shit's mad fucked up in my life right now and I need something funny to make me laugh... a Youtube clip, or a website, or something...
 
3:53 AM
 
:) Thanks
 
@EEAA People just burst out the question, but disregard any respect to potential responders. No CRs in the question because he is not even slightly concerned about the reader going through that forest of words. I hate such people.
 
^^^ why IT sucks. really.
 
@Wesley Linux DevOps is for pussies. I'm a proud senior DOS devops architect, like the rest of the real men.
 
@HopelessN00b CCP on CP/M or GTFO #[)ËvÓ|>s
 
4:24 AM
@MikeyB How drunk are you right now? =P
 
@MikeyB lol - and I promise that is one of the few times that an online 'lol' is literally true
 
I keep trying to fight the temptation, I don't want to be a buzz kill, but my girlfriend (together for ~6 years, living together for 5) is in the ICU.
 
@RyanRies Oh no man, what happened?
 
4:27 AM
Not 100% sure, but 75% sure that it's chronic liver failure. Like cirrhosis.
 
@RyanRies That just fucking sucks, man.
 
I keep asking the doctors/nurses things like "when's she gonna' get better," "how long do you think she'll be in here," etc., and they keep dodging the question.
 
@RyanRies That...is very bad news.
 
I didn't think she drank that much... but I guess it affects everyone differently. You best believe though that if she comes back home she's never taking another drink though.
 
@EEAA Just for you, dude. Now, if anyone could think of some on-topic questions to ask about PalmOS 1.0 cloud infrastructure, it'd help me a lot.
 
4:58 AM
I really want this term "devops" to go the fuck away.
 
@FalconMomot Not happening
 
oh, eventually, it will
 

« first day (1319 days earlier)      last day (3662 days later) »