« first day (1476 days earlier)      last day (3791 days later) » 

12:00
not very smart though, because it can only validate if that md5sum gets displayed then on the site
I saw others that use ping -c 1 $their_ip - which they can track easier
@faker gets every single one of his servers pinging his ip
@Nick it's pretty smart, even if the servers can't ping external IPs, this will have a timeout of 1s. You can measure if the webserver takes 1s longer to respond
Updated:
bash.x86_64 0:4.1.2-15.el6_5.2
:o
# env X='() { (a)=>\' bash -c "echo echo vuln"; [[ "$(cat echo)" == "vuln" ]] && echo "still vulnerable :("
echo vuln
cat: echo: No such file or directory
No patch for CentOS as of yet...
@NathanC centos pushed patches hours ago
@NathanC yum clean all
@Iain Oh right...it's Debian...I keep getting confused with which server is which, lol
12:14
$ env X='() { (a)=>\' bash -c "echo echo vuln"; [[ "$(cat echo)" == "vuln" ]] && echo "vulnerable?"
bash: X: line 1: syntax error near unexpected token `='
bash: X: line 1: `'
bash: error importing function definition for `X'
echo vuln
cat: echo: No such file or directory
Uhhh
apt-get clean and an update installed it, though
@Nick You're patched
@NathanC ah
@NathanC that echo vuln confused me :p
@Nick is that the test for the follow-up patch?
@DennisNolte the test for the second exploit yes
ye fuck
12:18
@DennisNolte still not patched? :p
@Nick only the first one, not the 2nd.
hmmm I don't fully understand that. With second patch, isn't this supposed to be blocked too?
env X='() { (a)=>\' bash -c "echo echo $(id)";
apt-get install bash
Reading package lists... Done
Building dependency tree
Reading state information... Done
bash is already the newest version.
no squeeze-lts update as of yet :(
@DennisNolte check which version you have installed
@faker no idea
@DennisNolte Run a apt-get clean first, then try again. For some reason the package managers aren't grabbing the updated package
12:19
@faker it did run for me
t# env X='() { (a)=>\' bash -c "echo echo $(id)";
bash: -c: line 0: syntax error near unexpected token `('
bash: -c: line 0: `echo echo uid=0(root) gid=0(root) groups=0(root)'
it bails
I don't know if that is just the shell expanding it afterwards. Need to read more into it
8
A: How does the updated Shellshock vulnerability test for CVE-2014-7169 work?

billywI've been digging around the webs for a bit since I first posted this question. According the original discoverer of the bug, bash prior to the CVE-2014-6271 patch imported a function such as: foo=() { code } by replacing the equals sign with a space and interpreting it... which meant inter...

nope, for all i see still no package, even after apt-get clean (i did update against the first CVE though)
GNU bash, version 4.1.5(1)-release
gonna dig a bit
every fucking second i need for this shit will make my day longer, bah
@DennisNolte I heard someplace that squeeze wasn't getting the update...but I could be wrong
12:22
@DennisNolte GNU bash, version 4.3.11(1)-release on ubuntu
dont know if the versioning is different
@NathanC squeeze not ofc, as its EOL, but there is squeeze-LTS support which should handle exactly that
If all else fails, compile from source?
Have any of you experienced it?
@ewwhite no but it seems to be related to an undisclosed xen advisory.
@ewwhite vCenter 5.5 is vulnerable btw if you're using the suse appliance
esxi-vcenter:~ # env X='() { (a)=>\' bash -c "echo echo vuln"; [[ "$(cat echo)" == "vuln" ]] && echo "still vulnerable :("
bash: X: line 1: syntax error near unexpected token `='
bash: X: line 1: `'
bash: error importing function definition for `X'
still vulnerable :(
12:26
4.1-3+deb6u2 what the fuck, why do i have a different bash version on my prod server than the lts one of squeeze..
this sux
@NathanC My vCenter isn't public
@ewwhite Mine isn't either, but the exploit still needs to be squashed :P
And the appliance doesn't come with any repo's defined, so I can't just update it
sigh
That's really not a big deal
I'm not concerned
sup
Bob
Bob
@Iain such vuln. very buggy. much dangerous.
12:33
Raspberry pi as a personal backup server... would it work OK or be utterly slow?
@Nick: I use it as one.
@JourneymanGeek oh, how are you getting the data to it? rsync?
@Nick depends on the amount of data, a lot(100k+) of small files should be ok. but if you want to store a lot of changes (TB wise) , might be too slow on CPU + USB.
Bob
Bob
@Nick you'll be limited to USB2 speeds
which is pretty bad
@Nick: Its mostly windows boxen and in a home network, so I just expose samba shares
12:34
@DennisNolte never gone beyond 500GB of files ... for now its about 80GB
Forget any protocol that's CPU heavy
RPis should stay firmly where they were designed to be
@JourneymanGeek ftp?
I also have my root filesystem on the storage USB hdd since I've had shitty luck with having it on an SD card
@Iain which is?
12:35
@Nick teaching
@Nick: I tend not to use FTP ;p
@JourneymanGeek sftp :p
@Nick: Knowing what I know now, I'd go with a nuc class system ;p
@Iain you cant beat the 30 bucks price for a computer tho
@JourneymanGeek meh too expensive4meh considering I also need hard drives
@Nick you get what you pay for
12:37
@Nick dont forget the additional staff you will need
@Nick: eh, but to make it useful you need a bunch of stuff
@JourneymanGeek just a usb hub
You want a powered usb hub, external HDD, case....
You're also going to have trouble if you actually need to compile anything outside the repos
Your network speeds are limited to whatever the USB hub does as well, since you're getting internet through a USB -> ethernet bridge
I think the speed of a RPI would irritiate me.
I quite like the look of a NUC though, or a Gigabyte Brix.
@JourneymanGeek im just using the default pis one
o.0 dafaq
12:40
@Nick: for the case? So am I, but that's not counted in the 35 dollars ;p
Yeah, its USB 3.0 on a desktop -> Raspi
strange, my bash version for squeeze LTS is 4.1-3+deb6u2, which should fix all 3 CVEs
https://security-tracker.debian.org/tracker/CVE-2014-7187
However :
env X='() { (a)=>\' bash -c "echo echo vuln"; [[ "$(cat echo)" == "vuln" ]] && echo "vulnerable?"
echo vuln
vulnerable?

what am i missing?
Bob
Bob
#  env X='() { (a)=>\' bash -c "echo echo vuln"; [[ "$(cat echo)" == "vuln" ]] && echo "vulnerable?"
echo vuln
cat: echo: No such file or directory
that's on wheezy
posted on September 26, 2014 by SysAdmin1138

Strange as it might be to contemplate, but imagine what would happen if AWS went into receivership and was shut down to liquidate assets? What would that mean for your infrastructure? Project? Or even startup? It would be pretty bad....

Bob
Bob
4.2+dfsg-0.1+deb7u3
@DennisNolte did you delete the "vuln" file between patching and re-running?
Bob
Bob
12:49
@faker oh yea, that was fun
oh this is fun...file server just threw up all over itself
or "echo" file, can't remember
@faker thank you faker
So apparently the issue that my mouse was registering as a mouse+keyboard and blocking my actual keyboard was because I was plugging it in a USB 3 port... plugging it in USB 2 still registers as both but doesnt block my keyboard
Bob
Bob
O_O
12:50
@Nick gamer mouse?
I'm getting "maximum connections reached" for my network drive, but I haven't specified limits on either server...
@DennisNolte thats what it says it is... nothing fancy tho :p
those come with reconfigureable keys often do this as a "pseudo" keyboard for the usb driver.
which can get confusing depending on the rest of the setup.
@DennisNolte what extra keys? it just has the standard mouse + 2 back/forward keys and 2 + - DPI buttons control... nothing which I can customize
@Nick well i would certainly be more paranoid now.
12:52
@DennisNolte ehhh
on an not-that paranoid mode: i had a cheap mouse once with some virus included in the driver (actual virus, not false alert).
still funny to see that happening.
@DennisNolte the driver meaning the CD or the device itself?
@Nick CD, sry
Bob
Bob
@Nick probably shares a driver/controller with other devices
12:54
Fun times for a Friday...
ye, this friday is worse than some mondays..
People are getting locked out of file shares and I'm struggling to figure out why -_-
@NathanC CAL issue, maybe
@Basil Has never been a problem before.
I don't know much about Windows licensing, but I've never seen that and I have thousands of users simultaneously on my NAS
12:56
...now it works
-_-
ye great, shared hoster did not update against the 2nd/3rd CVE yet..
so much for having them work fast.
@Bob hmmm maybe the mouse itself did have one of the tiny cds forgetting the name :p but wont even bother to try inserting it... I dont have an opical drive anyway
@NathanC if that's a simultaneous user limit, it will be an intermittent problem
Bob
Bob
oh shit there's another VPS I forgot to patch O_O
input,hiddev0,hidraw2: USB HID v1.10 Mouse [BTL Gaming Mouse] on usb-0000:00:14.0-14/input0
input,hidraw3: USB HID v1.11 Keyboard [BTL Gaming Mouse] on usb-0000:00:14.0-14/input1

I'll propably add a udev rule to block it just because im paranoid
Bob
Bob
13:00
well that was a quick and easy patch
Logs are as helpful as always...
(not)
@NathanC ikr :p
Bob
Bob
P.S: This answer is from the person who originally discovered the bug :) — Ramesh 22 hours ago
:O
@Bob didn't you notice? :p
@DennisNolte I don't expect mouses coming with viruses in the firmware, do you? :p
@Nick actually i do, i know at least keyboards do, and as at least some gamers are sysadmins it might be a APT targetted at you specifically
13:08
@DennisNolte "me specifically" being someone that helps run a barely known company... -.-
Morning.
@Nick well, theres always the option to create some "bad" devices just in case one has to actually observe that person.
@DennisNolte also what could a keyboard virus do? if it ever activated it would be a red alert that something is wrong from the first move
@Nick its no virus normally, rather a logger.
:17865291 i do not know that.
@DennisNolte ah you were talking about keyboard viruses I was talking about mouse ones :p
13:11
@Nick well, if i remember correctly it was possible to relay data from one "device" to another, so imagine following.
@DennisNolte without any special system configuration?
@Nick we talk about APT here, so they know your config
well, paranoia aside, this is fairly "normal" these days for all i see.
/me tries to remember what APT stands for
ah fuck you google
@DennisNolte yea googling APT wont do any good :p
13:14
en.wikipedia.org/wiki/Advanced_persistent_threat
it does actually
i just wasnt 100% sure i do write it the correct way.
anyway, back to coding.
@DennisNolte I have no idea I haven't used any "modern" mouses in ages
@Nick I use an Evoluent. It's lovely.
but its drivers are crap so I don't use those anyway.
@Nick my last 5-6 mouses or so (higher price range) all had that, configureable keys though
i like the idea of having all the keyboard shortcuts on mouse
I'd rebind the forward/back keys but chrome uses them for navigation :p
so that you only actually need one hand, if you know what i mean.
Bob
Bob
13:17
Please spell it out.
Heh, now our primary DFS share is "not found"
@Bob wat
@DennisNolte yeah, makes it a lot easier when you're main healer in a raid
@Bob He's had his hand bitten off by a shark. Very sensitive about it. Don't mention it.
@KitFox I'm pretty sure it was a whale(uhh maybe?)
13:18
Whale couldn't do that.
Baleen isn't strong enough.
@Nick Nah, snake.
@JennyD yep, or for muting yourself when you need to sneeze.
Sharknado what got him.
stoping music if someone talks to you etc, its pretty nice, no need to change windows or something "old" as that.
You could just get the advanced neural link.
Bob
Bob
13:20
Ah yea, gotta watch out for those sharks.
I'm sure the rumors about Skynet are completely unfounded.
@KitFox ye, or use talk commands :)
twitches randomly
Is there a way to view a list of shares with their user limits on 2008r2?
A wild KitFox appeared. (well, not wild, not yet, unless we poke it with sticks)
13:22
Hi @tom.
I was feeling sad, so I decided to come here.
4
Good morning, then!
Good morning.
People are getting the "too many open files" messages all over the office...but there's no limits set
@MichaelHampton mirrorlist versus baseurl... what's the difference?
net config server shows the "Unlimited" amount
13:25
ifconfig is deprecated? thats a new
Hey, if the shell I use to manage a machine that uses bash won't allow me to run commands like export to test for shellshock, is there a way for me to test it by using a login argument with telnet or ssh?
@ewwhite A mirrorlist downloads a list of mirrors and yum picks one. If it's slow or down, it moves on to the next one. A baseurl is just one possible mirror and it won't move on to another one.
which takes precedence if both are defined?
@Nick Where have you been the last five years? :)
@ewwhite mirrorlist, I'm pretty sure
I think it's baseurl.
13:26
Well, I never actually attempt to use them both at the same time...
@KitFox That's probably the first time anyone has ever said something like that. So, welcome.
locking some systems down to my repo...
@NathanC I did that once by accident when I didn't release resources properly in a batch file operation. I overloaded the number of allowed open connections, and it caused that error on some clients.
and debating whether to entirely omit the mirrorlist line
Write a question on SF!
13:27
@KitFox When I feel sad I read SF and the Workplace and feel happy that I have a better life and job than most of the people who post there
5
@MichaelHampton no idea :p ... and I have no idea how to use ip :p why is it deprecated again?
@Nick It's 20 years old, and something better came along
@KitFox I looked at the affected server and it seemed normal...it's odd.
It wasn't even the server I booted off the DFS referral list (not like that was working, anyway)
@JennyD Yeah. That helps.
just found that question.... blantly off topic? :p
14
Q: Edit only alpha layer in gimp

KneticI'm trying to create a "corona" effect (like the sun's corona) in an image using gimp, but i'm having trouble editing only the alpha channel of the image. I want the RGB to be pure white (255, 255, 255) and the alpha layer to have a brush effect applied to it. I know how to use the brush, but no...

13:30
My favorite sys admin is leaving today.
Rebooted both servers...seems to have worked temporarily at least.
is anyone here running CentOS on Amazon EC2? I see there is a image for it but some people say it sucks because it only has one partition and can't be mounted into other instances. Should that worry me?
@faker Nope, actually running RHEL 7 in EC2
The "real thing"
@MichaelHampton No way... you know I don't ask questions on ServerFault!!!
3
@KitFox OK, that is sad news!
13:32
@MichaelHampton I'm trying not to get hung up on it.
@KitFox where is the sysadmin going?
He told me, but I can't remember. Somewhere down in Baltimore area, I think.
That's sad. He should be going somewhere more like Tahiti.
I don't think he's a Tahiti kind of guy.
Maybe he'll come back if they fire a bunch of other people.
@KitFox just wondering what prompted the departure
13:37
@MichaelHampton Brilliant idea. Please halp me. :)
0
Q: Is there any way to exclude a list of applications from Software Restriction Policies?

HopelessN00bAs a result of a number of recent Cryptowall outbreaks ay my current employer, I've been tasked with finding a way to stop it from happening again, basically. The obvious solution would seem to be Software Restriction Policies, for which I've set up a test GPO - Unrestricted security level, but ...

@ewwhite There was a thing about firing one of his co-workers.
@HopelessN00b Linux workstations.
@KitFox did the coworker deserve firing?
I don't know.
I should be less obvious.
@MichaelHampton My users can't even handle Windows 90% of the time. Linux is not an option.
13:38
I like the co-worker, but I don't work with him. I've got no idea if he does a good job.
It's a minor miracle that they all manage to dress themselves before coming into to work in the mornings.
Anyway, it put his loyalties in conflict and he decided he didn't want to work at a place that would do that to him.
@KitFox I certainly wouldn't want to work somewhere like that!
So now I have to find someone else to have lunch with.
Who has a motorcycle.
scowls
I hate making friends.
2
@KitFox But you're so good at it!
13:44
sup
laughs
Must be my fox charms.
@KitFox Friends are overrated anyway. Don't make friends, start calling up vendors... they're generally more available, and happy to pay for your food to boot.
5
Mmmm, food.
@HopelessN00b good argument
I actually know a really good vendor who tends to do things for good customers like hiring a couple strippers for a birthday bash... vendor relationships are definitely more rewarding than friendships. :)
13:50
"Image file must be <= 700 KiB" ... its 400 KB how much less
@Nick try below 70, or try >700
@DennisNolte scaled it all the way down to 400x400 and it worked(it was 2000x2000)
14:10
I don't know what this is that I'm eating, but it tastes good.
3
14:22
@NathanC my wrist has never been free :p
@NathanC I have absolutely zero use for a smart watch
@MichelZ neither do I ... ill stick to phones
Dammit, when will I learn to stop trusting MS defaults? Stupid default SRP locked me out of basically everything on my PC. :/
@HopelessN00b use a test vm...
14:24
^ totally true
@MichelZ yeah, that would have been the smarter approach, in retrospect. Using myself seemed easier than installing a bunch of Enterprise crApps on a test VM, though.
I wonder what would happen if doctors worked like that.
Bob
Bob
@Nick I still wear an analog watch :P
@Bob get over it
Bob
Bob
@MichelZ :(
14:28
@Bob I used to but I havent wore one for about 4 months now... welll ... my wrist has been free for 4 months :p
I think analog watches are sexy, but not as much as pocket watches on fobs.
@KitFox make an arduino watch ... sexier :p
Will it tick?
@KitFox if you attach a 12V buzzer with a 12V buttey yes... very loudly
sketches diagrams
14:35
Personally, I wouldn't mind a smart watch, seeing as how I wear an analogue one anyway... could be a useful way to avoid having to dig into my pocket for every little thing on my phone. Of course, so far, smart watches have been worse than my analogue watch, so hell with that.
I keep time using a very sophisticated prismatic sundial built into my spectacles.
Bob
Bob
@HopelessN00b Who doesn't want a watch they need to charge daily?
OK. That's a lie. I lied just then.
@KitFox Hi! LOL.
I dont understand,Please advise me some keyworks involve this issue so i can find best solution ? — Toi Lee 22 secs ago
14:40
Meh, eyes can be described as sophisticated sundials, I suppose. They're just not very accurate and come with obscenely buggy software.
Hi @Will.
@KitFox GET OUT!
Bob
Bob
urk
Debian jessie finally got the original incomplete patch, but the second one is still unfixed -_-
Let the fox stay. I've always wanted a cute, furry little pet I could use to infect interlopers with rabies.
@Bob Jessie? Has Debian started naming their releases after crazy ex girlfriends now? Jealous Jessie, Killer Katie, Loopy Laura ...
Bob
Bob
@HopelessN00b testing (8.0)
> The release after Wheezy was named Jessie, after the cowgirl in Toy Story 2 and Toy Story 3.
O_O
14:49
Oh, so just their test releases are named after unstable women? Seems appropriate.
Bob
Bob
> The unstable distribution is permanently nicknamed Sid, after the emotionally unstable next-door neighbor boy who regularly destroyed toys.
@NathanC yep. good way to find vulnerable systems. Just shut them down using DHCP :)
15:13
@MichelZ What kind of equipment gets DHCP addresses though? Laptops and desktops...
I don't think I have a single unix machine in my company that uses DHCP, other than the macs.
@Nick I feel like those are auto-generated
@NathanC same
@NathanC but still
The fact that this was a top result in google is alarming
Bob
Bob
@Nick What the what.
@Bob ikr
Bob
Bob
15:21
@Nick Search terms?
norepro
@Nick my brain... it hurts
@Bob ofc no repro google relies on cookies and previous search to sort results :P
but it was something like "shellshock browser" or "shellshock desktop" tyring to see if there have been any successful attacks on desktops.
Bob
Bob
@Nick That says things about your search history.
@Bob ermmm -.-
Bob
Bob
It was 3/4 the way down the page for me.
Hrm.
15:25
@Bob thats still pretty high for such a stupid article
Bob
Bob
Pretty sure this qualifies as spam.
right then... back to coding java
Bob
Bob
> the site is filled with auto-generated or keyword-stuffed content that seems to make no sense
@NathanC more likely, it's crap content generated by Mechanical Turk for clickbait farms.
don't know what it is :) — rockyraw 23 mins ago
Bob
Bob
15:28
Please report it, if you actually want it to be removed.
Don't know what cat is?
@Bob I will later
$5 says he's running WAMP, in production, exposed to the Intertubes.
Bob
Bob
@MichaelHampton It's an animal in the family Felidae
@ChrisS windows 8 running apache with php + mysql
even better
Bob
Bob
15:31
@Nick ...what do you think WAMP is?
@Bob windows server? I am talking desktop version :p
Bob
Bob
@Nick No.
@Bob Windows + Apache + something + PHP?
Bob
Bob
It's prepackaged Apache, MySQL and PHP for Windows.
Bob
Bob
15:32
Typically runs on Windows client.
@Bob thats what im saying :p
Bob
Bob
@Nick It has nothing to do with Windows Server.
At all.
It's third-party software, and usually you find it run by people without a clue.
facepalms I meant that he must use windows 8 as the server OS
@Nick Windows + Apache + MySQL + PHP (and sometimes Perl)
15:33
@cole That... is utterly stupid.
Also, ain't no WAMP developer got money for Windows 8. He's probably running that on Win95, less OS overhead means more speeeeed!
@MichaelHampton Security Analyst sent it to me and was like "uh"
Bob
Bob
@cole ...???
@cole For realz? WTF is wrong with people.....
@Bob yeah got forwarded to the security analyst at work lol
15:36
Norton: For people who can't even.
5
Bob
Bob
I can't find a single correct thing in that analogy.
I'm just glad ESXi isn't vulnerable.
is working from home tomorrow HOOORAAAH
Shellshock isn't even a particularly hard vulnerability to understand... You have variables, they hold data. Shellshock is a bug where that data gets run as a program.
@Nick me too, except it's Saturday and that just makes me sad.
15:38
@cole its saturday what makes you sad? :p ... no work on sunday
Oh dear, our production website has a visible phpinfo() file...
Bob
Bob
@ChrisS User: You lost me at "Shell".
@Nick that I will be working.
@cole meh theres Sunday for that
@Nick and working Sunday.
working all the days
15:39
@cole ohhhhh ermmm good luck brave soul
@cole Me too.
I have the pager on Sunday.
I'm on-call 24/7 now
@cole suxxxxx
@cole 4 o clock at night mission critical servers go offline
At least I'm safe from shell shock, since I only use GUIs like Windows explorer and not those insecure hacker shells like Linux has.
15:44
@HopelessN00b had a worker at my company (accountant) call me back at the heartbleed days panicked about being "infected with heartbleed"
@cole Best thing I ever did for 24/7 on-call was learn a bunch of exploits for our Cisco routers. "Oh, damn, I can't connect to the server... router must be down again. Wake up the network guy and call me back when he's got it fixed."
@HopelessN00b lol
Oh, yes, lol. Because I was joking. Definitely joking, and not something I actually do to asshole employers who think IT guys should work unpaid overtime because... well, they just should.
I never understood how in some countries you don't get paid for being on-call
@HopelessN00b Yeah, you Windows people only have to worry about the dozen other vulnerabilities that come out every month.
15:52
@faker Same way anything happens, really. People let 'em get away with that, so they keep doing it.

« first day (1476 days earlier)      last day (3791 days later) »