The Comms Room

@MikeyB MF won't fess up if it's a BSD based appliance, but nmap -O says it's 100% probability of being Linux and support replied that -4 isn't a valid flag for the appliance's telnet.

Scott Pack

@Wesley What are you looking at?

Wesley

@MichelZ Is there anyone's sister that @ewwhite hasn't boinked?

2

MikeyB

@Wesley well maybe the telnet on that box is preferring the IPv4-compatible IPv6 address corresponding to the hit-nxdomain record. Same solution. Stop using OpenDNS.

Wesley

4:14 PM

Fortunately I don't have a sister.

MichelZ

me 2

and i'm far away from him :)

ewwhite

@pk. Most people from ETHS don't seem to be able to support themselves...

(no, that wasn't a dig on J.A.)

Kevin Soviero

@ewwhite ETHS?

Wesley

@MikeyB Mebeh.

ewwhite

I was a townie until November... just moved away from Evanston to Chicago.

so I had the joy of seeing all of the ex-cool kids from high school around town

pk.

4:16 PM

@ewwhite are you strangely proud of being from Evanston (warts and all) too? Evanstonians seem to be the proudest bunch of people for one reason or another

Wesley

@MikeyB I'm very tempted to rip the hard drive out of this effing thing, clone it, and twiddle it in a virtual machine just to figure out what the hell this thing is based on and why it sucks so hard.

pk.

@ewwhite i'm among them

Wesley

@ScottPack ur mom

MikeyB

@Wesley They're right. I agree with them. The problem is your DNS server is broken.

pk.

@KevinSoviero Evanston Township High School

ewwhite

4:17 PM

@pk. yes, extremely proud. It was a unique melting pot... racially and economically and politically diverse... good culture and history... Wonderful university.

Wesley

@pk. They're proud because they reached adulthood without eating a bullet.

Kevin Soviero

@Wesley (yet)

Wesley

@MikeyB okayface.mov

Scott Pack

@Wesley Meh.

Wesley

@KevinSoviero SOON.

@ScottPack Email appliance. I still say it sucks, but @MikeyB says I suck harder for using OpenDNS.

Scott Pack

4:18 PM

@ewwhite @pk. I'm pretty sure my sister-in-law grew up inEvanston.

@Wesley Oh, probably.

Wesley

@ScottPack Did @ewwhite boink her?

2

Kevin Soviero

@Wesley Can't we just agree that you all suck?

MikeyB

@Wesley What, precisely, is it doing wrong? It's handed two records as a result of the lookup, it prefers IPv6 first, tries to connect and SUCCEEDS.

Scott Pack

@Wesley It's entirely possible.

Wesley

Joel E Salas

4:19 PM

@MikeyB NOT OKAY

pk.

@ewwhite it's extremely diverse and still segregated in my ways. ebony ball? for real?

ewwhite

@Wesley likely no. I didn't boink anyone in high school.

MikeyB

@JoelESalas Explain to me why it's not OK to try IPv6 first and fail back to IPv4? If it was handed a valid IPv6 address, tried to connect and failed, then fell back to IPv4, OK.

Wesley

@MikeyB It's basing security / authentication on a DNS record. So it's failing on updating because "oh noes the DNS record isn't what I expect it to be" and then says "Invalid machine indentification. Please contact support at ##"

MichelZ

@MikeyB IPv6 is evil

Wesley

4:20 PM

And yes, the spelling error is actually in the error message: "INDENTIFICATION"

Scott Pack

@JoelESalas People keep talking about IPv6 but I'm still not convinced it actually exists.

4

Wesley

@ewwhite Did you boink @ScottPack's sister-in-law?

ewwhite

@pk. well, that's historical. Evanston's black community was insular. More like a rural small town than anything else. Being black and not originally from Evanston... I was excluded from the town's Black community. "Oh, you're not Ray-Ray's cousin!?!"

Magellan

@Wesley Indentification? You been learning Python?

Wesley

@Magellan Because whitespace should totally be parsed!

MikeyB

4:22 PM

@MichelZ The only problem is people fucking blaming problems on IPv6 when it's really PEBKAC or broken services like OpenDNS.

Magellan

@ewwhite why shouldn't Evanston be like every other little small town in the Midwest? Outsiders are shunned.

Dennis Kaarsemaker

@ScottPack talk to @MichaelHampton :)

MichelZ

@ScottPack It does: Pinging star.c10r.facebook.com [2a03:2880:2050:1f08:face:b00c:0:1] with 32 bytes
of data:
Reply from 2a03:2880:2050:1f08:face:b00c:0:1: time=98ms

ewwhite

@Magellan no, just the black community there. it's a weird thing.

Scott Pack

@MichelZ I call shenanigans.

Wesley

4:23 PM

@DennisKaarsemaker No he's spiteful and abusive.

ewwhite

I grew up on the Jamaican and Haitian side of town... that was nuts.

Wesley

@ewwhite On the plus side, I bet you can twerk real good.

Joel E Salas

@ewwhite Do you like dancehall reggae

Wesley

No, I bet you can DAGGER real good!

Michael Hampton

The problem is OpenDNS serves bullshit records.

Magellan

4:23 PM

@ewwhite you sure? I've met perfectly pleasant pepole in small town that won't have a thing to do with you after an initial introduction once they've figured out that you're not related to anyone they need to stay on the good side of.

Scott Pack

@Magellan Or the south. Where I grew up meeting a new person resulted in two questions: "Who is your family?" "What church do you go to?". Frequently that data was requested even before your name.

Dennis Kaarsemaker

@MichaelHampton s/ serves.*//

Wesley

@Magellan That's 100% of Indiana. Ever been to Terra Haute? NEVER AGAIN.

Joel E Salas

@ScottPack They're covering indexes

Magellan

@ScottPack Pretty much. Midwesterners probably wouldn't even talk quite so much as that.

Scott Pack

4:24 PM

@JoelESalas My grandfather lived in that town for 60 years and was always considered an outsider to be wary of because he was born 30 miles away.

ewwhite

@JoelESalas Yes. Just google "wuk fah"

Magellan

@Wesley Ask @RyJones about Terre Haute.

Iain

@ScottPack and the significance of that (for the non USdians )?

Wesley

@ScottPack Well to be honest, you grew up in a third world country.

MikeyB

@MichaelHampton Did you see this bullshit: gist.github.com/Supermathie/11258633 ?

Fucking OpenDNS. hit-nxdomain is bad enough, but that shit is unacceptable.

Wesley

4:25 PM

@Magellan Shit, did I just insult his home town? Great, I'm going to die slowly in his sub-floor now.

Magellan

@Iain Furriners should probably avoid most small towns.

Joel E Salas

@ScottPack Imagine how wary they'd be of me!

Michael Hampton

@MikeyB Yeah, I saw that. That's utterly ridiculous.

Magellan

@Wesley Yes. =)

Wesley

@JoelESalas Yeah, the first question Kentuckians wouldn't ask you would be about your family or church, it would be "Are you done with my hedges already?"

Scott Pack

4:26 PM

@Iain Meaning your primary identity, and trust level, is dependent on which Christian sect you belong to and whether or not one of your cousins ever failed to say "Hello" to them.

Joel E Salas

@Wesley Kentuckians can't afford lawn care

ewwhite

@pk. are you in tech?

Wesley

@JoelESalas This is true.

Joel E Salas

@ewwhite looks like fun

Scott Pack

@Wesley @JoelESalas That's actually not true. They'd ask if his shift on the tabacco harvest was finished already.

Iain

4:26 PM

@ScottPack ok I think I get it

ewwhite

@JoelESalas That's what I like

Scott Pack

@Iain Watch the Top Gear episode where they road trip from Florida to New Orleans. It's sad because it's true.

Iain

@ScottPack I'll dig it out again some time on iPlayer ot Dave

pk.

@pk i am. i'm a sysadmin

MichelZ

@pk. talking to yourself is rude...

pk.

4:29 PM

@ewwhite where would you consider the jamaican/haitian side of town? howard?

Wesley

@MichelZ Wesley says it's fine. Right Wesley? Yep.

Iain

@MichelZ I dunno about rude but a little odd for sure

ewwhite

@pk. Custer and South Boulevard... on the wrong side of the tracks.

pk.

@MichelZ haha, my bad

ewwhite

and Custer was the gateway to the 'hood

Jacob

4:30 PM

@ScottPack They were really stupid for doing some of that stuff.

pk.

@ewwhite yep, the tracks literally were a dividing line from the "right" and "wrong" side there

ewwhite

@pk. and where do you sysadmin?

pk.

a private investment office - sawdust investment management

ewwhite

Ah, finance... kinda

pk.

it's technically a "family office" (something i didn't know existed until starting here)

ewwhite

4:37 PM

@pk. and you've been on Server Fault for years... you should have MORE reputation pointz

MikeyB

@Wesley Confirmed as OpenDNS bug: twitter.com/atoonk/status/459368878741532673

Wesley

@MikeyB Lulz, "nothing to do with shit services"

Shane Madden

@MikeyB How did they even do that accidentally??

pk.

@ewwhite a graph of my activity would be interesting. lots of peaks and valleys

Dennis Kaarsemaker

@ShaneMadden I accidently the DNS!

ewwhite

4:39 PM

@pk. I can't see anything!!

Wesley

@MikeyB I had to ping OpenDNS support the other day because a .tk domain for a client wasn't resolving at all. On any server. I checked zones and everything. Every other DNS service I tested against resolved it fine. Client went silent for a while, I waited... still no resolution after a week. Finally got OpenDNS to "flush caches" or whatever they said they did and then they responded with zone records, but still.

kce

@ewwhite - No one votes. The people that get upvotes are you.

ewwhite

kidding, of course

Shane Madden

@DennisKaarsemaker Seriously. Mangling the response from the authoritative...

ewwhite

@kce is that what happens?

kce

4:40 PM

@ewwhite - That's my theory.

pk.

@ewwhite burst activity :)

ewwhite

@kce I ask questions, too.

but nobody gives the right answer!!

Wesley

@ewwhite Just because you don't like ReiserFS doesn't mean it's the wrong answer!

=P

ewwhite

@Wesley :(

kce

@ewwhite - That helps. I've found that if I don't post my questions in the Comm Room they don't get much visibility. But enough of that.

ewwhite

4:42 PM

@kce Bounties... twitter

kce

You should put ServerFault under your skills section on your resume. You're just good at it.

pk.

@ewwhite twitter handle?

MikeyB

@ewwhite ermagerd I need to post on that.

ewwhite

@MikeyB Nobody answered quickly enough, so I found my own way... and have a good working SSSD solution for now.

But I have no idea what Windows 2012 R2 best-practices will be

Bob

in Root Access, 3 mins ago, by allquixotic

uh oh. SU just gave me a cloudflare error that the "host" is offline

ewwhite

4:45 PM

@pk. oh, it's on my LinkedIn... or o my MySpace page

Bob

@ShaneMadden ^

Magellan

@ewwhite You have a MySpace page? I didn't know you had a band.

MikeyB

@ewwhite I think I got SSSD working nicely on Ubuntu 14.04. Before that I was just using LDAP/rfc2307bis

Shane Madden

@Bob Hmmm, we'll check it

Bob

Also, @ShaneMadden, any particular reason SU was chosen?

@ShaneMadden Thanks.

kce

4:47 PM

@ewwhite - Don't mind me. I just like whining.

Shane Madden

@Bob Not sure on that, it was before my time

Nathan C

@Bob Works For Me™

Danila Ladner

@ewwhite what about sssd?

Bob

@NathanC Yea, it's working here too.

Looks like it was just a single occurrence.

Still, weird.

Oh, apparently he uses HTTPS for SE.

MikeyB

@ewwhite Did you notice that 'Server for NIS' being deprecated changes nothing? The RFC2307bis attributes will still be there.

Ladadadada

4:51 PM

@pk. First staircase I've ever seen in a rep graph. stackexchange.com/users/28008/pk?tab=reputation

Wesley

@Ladadadada I kind of have one: stackexchange.com/users/58029/wesley?tab=reputation

ewwhite

@MikeyB The schema will be there... but it needs to be accessible

I like being able to tell clients to enable or disable attributes per-user to allow Linux AD access

It's a simple GUI

MikeyB

@ewwhite The entire tab is gone? The way it reads to me is they'll just deprecate the NIS mess.

'cuz who gives a shit about NIS.

ewwhite

@MikeyB the schema change and the tab come with the installation of the "Identity Management for Unix" role

strugee

11 hours ago, by Dennis Kaarsemaker

it's like gentoo, but on more crack

MikeyB

5:08 PM

@ewwhite Right, which is separate than 'Server for NIS'

ewwhite

@MikeyB I never mentioned Server for NIS

Can someone help this doood?

0

Q: RHEL 6 iSCSI LUNs

I have a RHEL system set up as an iSCSI target with 2 luns shared out via one target via the following configuration in /etc/tgt/targets.conf (which I built following the commented out examples in /etc/tgt/targets.conf): <target iqn.2014-04.com.local.box:ESXi.target1> backing-store /dev/...

Wesley

@MikeyB So apparently at least one application on the appliance is requesting a AAAA record and the tech support was either unaware of it, or didn't seem to think there was a correlation. Instead, no, there must be some kind of packet tampering and ipv6 tunneling going on!

Hex is scaaaaary!

But I have the packet capture so they can eat it sideways.

Dennis Kaarsemaker

@Wesley 0xfear

Wesley

@DennisKaarsemaker Don't mess with deadbeef.

Dennis Kaarsemaker

@Wesley I prefer 0xcafebabe

Hexspeak

Hexspeak, like leetspeak, is a novelty form of variant English spelling using the hexadecimal numbers. Created by programmers who wanted a magic number, hexspeak words can serve as a clear and unique identifier with which to mark memory or data. Using hexadecimal notation, which includes the digits 0123456789ABCDEF, it is possible to spell several words. Further words can be made by treating some of the decimal numbers as letters - the digit "0" can represent the letter "O", and "1" can represent the letters "I" or "L". Less commonly, "5" can represent "S", "7" represent "T", "12" represen...

MikeyB

5:13 PM

@Wesley No, the connection is still happening over IPv4.

Dennis Kaarsemaker

0xDEAD10CC ("dead lock") is used by Apple in iOS crash reports, when application holds on to a system resource while running in the background.[1]

I'm wondering if that's '10CC' - 'Lock' or '10CC' - 'D(r)eadlock holiday'

MikeyB

$ ip -6 addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qlen 1000
    inet6 fe80::21a:4aff:fea8:79/64 scope link
       valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qlen 1000
    inet6 fe80::21a:4aff:fea8:73/64 scope link
       valid_lft forever preferred_lft forever
$ telnet ::ffff:216.16.235.2 80
Trying ::ffff:216.16.235.2...

@Wesley ^ NOPE no IPv6.

cole

Life is weird.

Wesley

@MikeyB Right, I know, but it's requesting a v6 address. So imagine the grimace on my face as I was trying to make them understand "No IPv6 is in this equation. It's simply a DNS query, over v4, that's returning a DNS AAAA response that in essence simply has a text payload representing a AAAA IP address but there's no IPv6 on the wire you filthy animals."

MikeyB

@Wesley Right, but the connection over "IPv6" will still succeed. They aren't doing anything wrong. The fault is entirely OpenDNS.

Dennis Kaarsemaker

5:17 PM

MichelZ

@MikeyB What's OpenDNS fault?

MikeyB

@Supermathie This is a bug and not supposed to happen. A fix will be pushed today. Nothing to do with 'shit' services ;)

Tweeted by atoonk on April 24, 2014 at 4:30 PM in reply to Supermathie

Wesley

@MikeyB What I fault them for is thinking that v6 is the problem when it obviously wasn't v6, it was their app failing on a AAAA record because they use it as some form of authentication, and they didn't force their app to query for A records. They assumed the default of a non-responsive AAAA record rather than explicitly defining their logic.

Having said that, yes OpenDNS sucks big wads and shouldn't tamper with zones

ewwhite

can I offer another bounty on this?

161

A: LVM dangers and caveats

Summary Risks of using LVM: Vulnerable to write caching in kernel and hard drive/SSD on kernels before 2.6.33, or in VM guests Harder to recover data due to more complex on-disk structures Harder to resize filesystems correctly Snapshots are hard to use, slow and buggy Requires some skill to c...

Wesley

I actually fault the appliance maker twice. Once for thinking it's a layer 4 problem, and once for assuming too much about query responses.

MikeyB

5:20 PM

@Wesley OK, fair enough. But still, expecting for them to define records on one side and get the same records on the other is not unreasonable. Oh, and that's not a "default of a non-responsive AAAA records". It specifically didn't exist until OpenDNS added it.

Michael Hampton

@ewwhite Yes

MikeyB

@Wesley That's not an assumption, that is well-defined behaviour they should be able to rely upon that OpenDNS is breaking.

Dennis Kaarsemaker

@ewwhite I find that answer mostly bullshit

Wesley

@MikeyB The assumption is that "Certainly our query will return a single-A record" when there is apparently an initial request for a AAAA record that they're not aware of.

MikeyB

@Wesley THAT'S NOT AN ASSUMPTION

Wesley

5:24 PM

@MikeyB Maybe I'm not terming it right. They don't know that their application is asking for a AAAA record first. So when a AAAA gets returned, the app doesn't handle it right.

MikeyB

@Wesley The app is handling it right. It's trying to connect and succeeding, it's just getting handed shit data.

Notice the difference:

○ → host -t aaaa updates.mailfoundry.net
updates.mailfoundry.net has no AAAA record

○ → host -t aaaa updatesasdasdf.mailfoundry.net
Host updatesasdasdf.mailfoundry.net not found: 3(NXDOMAIN)

Wesley

At least that's what I'm understanding from their support emails. They assume that any AAAA response is because my firewall is tunneling something somewhere. They don't think that their app is asking for a AAAA record. Now certainly that's not a problem if the DNS provider doesn't insert shit into their zone on the fly

MikeyB

@Wesley Yeah that's just failure on their part to understand IPv6 (which is kind of sort of reasonable given they haven't yet implemented it) but throwing up their arms about it is kind of weak.

Wesley

@MikeyB Correct. They get a response and connect to the IP address. I fault the programmatic logic that even asks for an IPv6 AAAA record. I wouldn't deal with anything dual stack unless I actually had the infrastructure to support v6.

But yes, OpenDNS is 99.9999999% at fault here.

I'm just all ragey that my systems were called into question because someone else shat themselves over seeing a IPv6 address. =P

@DennisKaarsemaker Oh and tell me more.

@MikeyB Oh and furthermore, I write detailed observations on the problem, and even include a case summary, and I get no response. I'm less inclined to cut them slack because they're just not nice people. Even though in this case the original problem isn't their fault, necessarily.

So in other words, I'm an asshole.

MikeyB

@Wesley Yeah that's an independent issue :D

Shane Madden

5:30 PM

@Wesley What's the base OS? It's probably doing that by default

Wesley

@ShaneMadden It's apparently Linux, a 2.6 kernel as per nmap's OS profiling.

MikeyB

@ShaneMadden Yeah that's just the resolver. No issue there.

Wesley

It's a black box appliance that I do not have shell access to.

Dennis Kaarsemaker

@Wesley "Vulnerable to write caching in kernel and hard drive/SSD on kernels before 2.6.33, or in VM guests" - no worse than without lvm. "Harder to recover data due to more complex on-disk structures" - ahbullshit. And that's what backups are for. "Harder to resize filesystems correctly" translation: I can't read manpages, mommy help!

"Snapshots are hard to use, slow and buggy" - I find them easy to use, but I'll grant that they're not the fastest. Haven't seen bugs yet and we use them a LOT "Requires some skill to configure correctly given these issues" - well yes, that's what your boss is paying you for goddammit

We use lvm on about 8000 servers and have yet to have our first problem caused by it.

Shane Madden

@MikeyB Well, my guess is the app is using the OS's name resolution, which by default is sending both the A and AAAA queries in the same transaction. The fact that OpenDNS is adding crap into the response that doesn't work, I blame OpenDNS and not the software vendor (even though they seem to not understand what the OS they built on is doing).

Wesley

5:33 PM

@DennisKaarsemaker Lawl. Yeah the on disk complexity seems to only be an issue for filesystem designers or forensic examiners. Just take backups, you shouldn't be parsing a filesystem's raw datastructures unless you're part of a law enforcement investigation, and if you are you'll have mega expensive tools and consultants to work with.

@DennisKaarsemaker And just because something is slow doesn't mean it's bad. It's just a different tool with a different use-case.

@DennisKaarsemaker And when is requiring skill to configure something considered a negative? "Just give me the clicky clickies!"

Dennis Kaarsemaker

exactly. That answer is a truckload of fail that should never have gather so many upvotes and even a bounty

Wesley

@ShaneMadden Yes, that's a good summary. It's a dual stack OS apparently and everything would work fine if OpenDNS didn't muck with things. I just got all panty-twisted over them not liking seeing a v6 address and assuming somehow v6 was to blame.

@DennisKaarsemaker Write a better answer. I'll give you a bounty.

Has to be at least 1500 words.

Dennis Kaarsemaker

@Wesley ah see, that's where my laziness strikes :)

Wesley

And direct some ire to RichVel

Dennis Kaarsemaker

besides, I'm fighting perl tentacles today

Wesley

5:37 PM

@DennisKaarsemaker 200 rep. Do I hear an answer for 200 rep!

Dennis Kaarsemaker

kce

It's been a while since I've done AD. Is it normal to have very peak-y CPU usage?

Wesley

@DennisKaarsemaker 250 rep?

@kce Only if you see a few dozen instances of pronhax.exe in your process list.

@kce And I've never seen peaky CPU usage like that on a DC, no.

Shane Madden

@kce That seems excessive. What process is using the CPU? And what's the security log look like?

kce

@Wesley, @ShaneMadden - Yeah me either. It's SVCHost.exe running DHCP, EventLog and LMHOSTS.

Wesley

5:41 PM

@kce tasklist.exe /svc to see what your svchosts are wrapping

@kce Gotcha

opendns-suxors

kce

Hmm. Looks like both our DCs are doing this.

Shane Madden

@kce Check if there's big spikes in logs in the event log. My guess is something reading the event log - is there a monitoring system or similar that would be doing that?

Chris S

@kce Is the host machine heavily loaded? Might be starving the vCPUs causing those spikes.

kce

So we're broken but at least consistently.

Wesley

@kce You sound like a dominatrix.

NOT THAT I WOULD KNOW.

kce

5:43 PM

@Wesley - I have many talents.

Dennis Kaarsemaker

Wesley

I should make my own email appliance.

kce

@ChrisS - Does not appear so. I'll cook up a question so you guys can soak up the that sweet, sweet rep.

pk.

@kce check this social.technet.microsoft.com/Forums/en-US/…

Chris S

Has chat always had colored backgrounds to the text box?? I though they were white for some reason.

pk.

5:47 PM

@kce some people claimed their event log was hitting a limit, others claimed dhcp corruption

Dennis Kaarsemaker

@ChrisS yes

Kevin Soviero

@kce I should create an account to ask stupid questions, then use my real account to answer them and mark as correct... It's a perfect plan!

Dennis Kaarsemaker

well, can't say anything about 'always', but at least since I joined

kce

@KevinSoviero - That's what I do!

MikeyB

@kce turn on kernel time

Kevin Soviero

5:49 PM

@DennisKaarsemaker You know as well as I do that you've been part of this site since before you were born... Chuck Norris style.

MikeyB

@ChrisS Yeah. Did you tilt your monitor and see them finally? :)

Tanner

@ChrisS I never noticed until I switched screens. Real easy to white them out.

Nathan C

@kce Process Explorer lets you view which threads are causing spikes

might narrow it down more

Michael Hampton

@ChrisS Yes they did. You may have had a miscalibrated monitor.

Wesley

Easter egg: DSL router patch merely hides backdoor instead of closing it. Fun fun fun.

Chris S

5:54 PM

http://en.wikipedia.org/wiki/Cocka-doodle-doo <-- I don't know why that's funny, but it made me laugh.

MikeyB

@Wesley Yeah, nice job Netgear, eh?

@Wesley We'll find out if my sister unexpectedly pops out a little mocha baby.

Wesley

@MikeyB I have a similar story that I haven't posted on my blog yet. Not quite to the level of backdoory-ness, nit there's a CenturyLink router made by Zyxel that will hijack any traffic to any IP address that it routes for on port 4567 and 51080.

BigHomie

@NathanC +1

ewwhite

who wants a Puppet challenge?

Wesley

@MikeyB So for example, I had a client with a /29. If you went to the DSL modem/router's IP address:80 you got the remote admin page. Then if you turned off remote administration, but went to IP:4567 you'd get the HTTP (not s) login for the... remote admin page. Then if you went to any one of the other /29 addresses even if it was an address that wasn't assigned to any host over port 4567, you'd get that same HTTP admin page.

Dennis Kaarsemaker

5:57 PM

@ewwhite exec{"no": command => "userdel ewwhite", onlyif => "getent passwd ewwhite" }

MikeyB

@Wesley facepalm Oy.

Chris S

@Wesley Security++

Wesley

@MikeyB It took six weeks of emailing CenturyLink before, finally, I got a phone number to call and the answer was "Nothing can be done about it for that modem. You need a PK5001 model." and I had to have a tech come out and replace the modem.

Mathias R. Jessen

@kce Windows Server 2008?!!?!???! *cringes*

Wesley

@ChrisS The port scan on the thing showed about ten different PCI-failing vulnerabilities on the two ports that were forced open and scooping up traffic bound for any one of the /29 addresses.

kce

5:59 PM

@MathiasR.Jessen - Yeah. Everything is on Server 2008. :D

Transcript for