Ask Ubuntu General Room

12:24 AM

any environment variable can be changed temporarily in front of a command?
like, for example, say I want to connect via ssh to a server using a different hostname, I could simply write
HOSTNAME=mypc ssh ...?

I'm sorry if I'm asking too much on chat, I don't know if it's ok to write a new question for small things like this

Serg

> There's an unconfirmed hostage situation in the Meridien and Negresco hotels in Nice.

this ain't over yet folks

Android Dev

@NathanOsman - Hello!

Serg

@AndroidDev he is not online

Android Dev

@Serg Oh. Well do you have a second to look at some lines from my Apache log?

Serg

I can take a look, but I don't know anything about Apache , so that probably is sort of pointless :)

Android Dev

12:35 AM

@Serg - Well, my Apache log shows some suspicious activity from IPs in Brazil, India, and China. Here are the lines from the Brazil IP for example: paste.ubuntu.com/19436860

Serg

@AndroidDev ah, probably botnet mafia is scanning your server for holes or something. User Agent string is said to be mozilla, but it's probably not firefox - probably just script. I use the same thing with one web app right now. Can't tell you much more

@AndroidDev those strings are hex

Here's how last one looks like when converted to text

-dallow_url_include=on-dsafe_mode=off-dsuhosin.simulation=on-ddisable_functions=""-dopen_basedir=none-dauto_prepend_file=php://input-dcgi.force_redirect=0-dcgi.redirect_status_env="yes"-dcgi.fix_pathinfo=1-dauto_prepend_file=php://input-n

Nathan Osman

@AndroidDev I'm here now.

Anything I can help you with?

Android Dev

@NathanOsman We're discussing if my server was compromised.

Serg

I don't know what those things do, but somebody is trying to pick your Apache and PHP specifically with some form of brute-force attacks

Nathan Osman

Oh my.

That's not good.

Serg

12:42 AM

By the way, if you want to see some of those strings here's how you do it: tr -d '+%' < data.txt

Then copy hex to hex to ascii converter rapidtables.com/convert/number/hex-to-ascii.htm

Android Dev

@Serg Yes, I did a lookup on the IP and other people are complaining of brute-force attacks from it.

Nathan Osman

Are you running PHP through mod_php or FastCGI?

Android Dev

@NathanOsman I'm running it though whatever Wordpress uses as default.

@NathanOsman @Serg - But what I'm really worried about is the IPs from China: paste.ubuntu.com/19437762

Serg

Doesn't matter where IP is from. Probably fake , masqueraded as Chinese IP

Nathan Osman

@AndroidDev How did you install WordPress?

Android Dev

12:45 AM

@NathanOsman From the .tar.gz archive.

Nathan Osman

You must have had PHP installed before that though.

Do you have any idea how you installed PHP?

Was it with apt-get?

Android Dev

@NathanOsman Via apt-get

But check the comment on the IP lookup: whatismyipaddress.com/ip/180.76.15.16

Serg

probably installed as dependency

Android Dev

Did you see the comment?

Serg

@AndroidDev that chinese thing is OK

This is Baidu Spider

Nathan Osman

12:48 AM

What is the output of this command:

dpkg -S php

Serg

It's a web-crawler thing

same as Google

Nathan Osman

That will tell us which PHP packages you have installed.

Serg

brb, dont freak out

Nathan Osman

Oh wait.

Wrong command.

Here's the correct one:

Android Dev

@Serg I'm not, there was no personal information on it anyways :)

Nathan Osman

12:49 AM

dpkg -l | grep php

The other one searches filenames, not package names.

Android Dev

@NathanOsman Give me a second while I SSH to the server...

Hmm.

I need to switch computers here, hold on.

@Serg @NathanOsman I'm back.

Running command now

Mkay,

Php-gettext

Php5

Php5-cli

Php5-common

Php5-gd

Php5-json

Php5-mcrypt

Phu5-mysql

Php5-readline

Phpmyadmin

Libapache2-mod-php5

@NathanOsman @Serg There you go.

Nathan Osman

Ah.

So you are using mod_php

In that case, you really have nothing to fear from the /cgi-bin URLs.

(Although you didn't necessarily need to worry even if you weren't.)

Android Dev

@NathanOsman But what was that about my server getting brute-forced?

Nathan Osman

It happens to all public-facing servers.

Mine is constantly under attack.

SSH login attempts (which always fail since password login is disabled), FTP login attempts, etc.

So just the fact that you're getting people brute-forcing your web server is no cause for alarm.

Android Dev

@NathanOsman I restricted my SSH by IP.

Nathan Osman

1:01 AM

That's another good idea.

IanC

how much wordpress charge for renting a server?

Android Dev

@NathanOsman This server has only been up for three days, so I haven't had an opportunity to "harden" WP & Apache.

@IanC Asking me specifically?

Nathan Osman

The defaults do a fairly good job of protecting you in the short term, providing you choose good passwords.

Serg

@AndroidDev so the PHP queries are the only thing I would worry about. Baidu Spider is legitimate service, so don't worry about that . Search engines such as google do this all the time - they search what websites are out there , and just index them. Google does that. Oh, and here's web page for Baidu Spider help.baidu.com/question?prod_en=master&class=Baiduspider

IanC

any one who knows, if you don't mind answering!

was just curious about how much it cost to keep a small server up

Android Dev

1:04 AM

@IanC This is an EC2 server.

Serg

@IanC digitalocean.com has like 10$ per month for servers , but you install wordpress by yourself

Android Dev

Free for a year

Serg

I have one server on digitalocean.com and wordpress there. Nothing special just hello world so far

Android Dev

Amazon EC2 is < $6 a month for t2.nano

IanC

cool

even though dollar is a bit high in my country

still payable

Android Dev

1:05 AM

And free for a year!

Zacharee1

@NathanOsman is the chat script server down?

Android Dev

@Serg But about the PHP queries...

Is there anything suspicious?

I don't like that some are POST instead of GET.

Nathan Osman

@Zacharee1 Hrm...

Zacharee1

This is cool accounts.google.com/signin/newfeatures?cbflow=promo-10-en

Nathan Osman

It actually crashed!

panic: send on closed channel

goroutine 35795 [running]:
panic(0x7072c0, 0xc82047e240)
        /usr/lib/go-1.6/src/runtime/panic.go:481 +0x3e6
main.(*RoomMap).broadcast.func1(0xc82047c270, 0xc82000e3c0)
        /home/nathan/go/src/github.com/nathan-osman/auchatstatus/roommap.go:42 +0x45
created by main.(*RoomMap).broadcast
        /home/nathan/go/src/github.com/nathan-osman/auchatstatus/roommap.go:43 +0xa1

O_o

Android Dev

1:09 AM

@NathanOsman ???

Nathan Osman

My chat script / server thing.

sechat.quickmediasolutions.com

Zacharee1

lol

Nathan Osman

Should be back up now. For the time being.

Zacharee1

> There are currently 0 users chatting in 0 rooms.

impressive :p

Nathan Osman

Give it a couple minutes.

Zacharee1

1:09 AM

I seez it

Nathan Osman

Everyone should reconnect.

Zacharee1

AU MOD!

hide!

Android Dev

Uhhhhh....

Why? Were discussing Ubuntu related things.

Zacharee1

@NathanOsman I really want to copy that constellation code and use it on my site :p

@AndroidDev you never know with them...

:p

Kaz Wolfe

@Zacharee1 that one was my fault

Zacharee1

1:11 AM

wut

oh yeah

Android Dev

@NathanOsman @Serg So what's the consensus on the PHP queries?

Nathan Osman

I don't think I saw them. Where are they?

Zacharee1

@AndroidDev bad. PHP is bad. anything mentioning PHP is bad. bad is bad. bad

3

edwinksl

phphphphphphphphphphp

Zacharee1

argh

Serg

1:13 AM

paste.ubuntu.com/19436860

Android Dev

@NathanOsman Serg de-obfuscated some earlier on, just before you came in.

Serg

@NathanOsman that ^

HEX coded , i deobfuscated one

Zacharee1

ew

Serg

didn't look at others

obviously somebody is embedding commands into them

Nathan Osman

@Serg What do they look like deobfuscated?

Serg

1:14 AM

-dallow_url_include=on-dsafe_mode=off-dsuhosin.simulation=on-ddisable_functions=""-dopen_basedir=none-dauto_prepend_file=php://input-dcgi.force_redirect=0-dcgi.redirect_status_env="yes"-dcgi.fix_pathinfo=1-dauto_prepend_file=php://input-n

This is last one from the paste link

Zacharee1

what's this about?

Serg

I didn't do others

Zacharee1

someone being h4xx0r3d?

Serg

@Zacharee1 botnet mafia is trying to hack @AndroidDev apache server

Ubuntu Questions on U&L

0

Q: Boyfriend hacked yahoo

I have tried for 2years to check my yahoo mail. I can't get any help from anyone. My boyfriend has hacked my accts and I believe he has somehow sabotaged me. Someone please help me.

Zacharee1

1:14 AM

oooh fun!

This ^

wtf ?

speaking of timing

This ^

what's this?

have a 3000x3000px THIS

Android Dev

1:16 AM

:)

@Serg So I really can't make any sense of that line.

Nathan Osman

@AndroidDev I think you're alright. Those attacks really aren't going to work on your setup.

Serg

@AndroidDev I am no PHP-savvy person. I can only help you this much

@ThomasW. or @James know more about security context

Android Dev

So wiping the server and starting over shouldn't be necessary?

Zacharee1

@ThomasW. will tell you it's too insecure and that you need to hire a developer :p

Serg

@AndroidDev check your auth logs

Nathan Osman

1:18 AM

/var/log/auth.log

Serg

cat /var/log/auth.log

Zacharee1

whoa

> There are currently 4 users chatting in 11 rooms.

Serg

people try to pick my digitalocean server all the time , my auth log is just filled with failed authentications

Zacharee1

heh

Android Dev

@Serg A bunch of CRON entries.

Serg

1:20 AM

that's normal

Zacharee1

unlike everything/one else here

Android Dev

Uh-oh

Serg

uh-oh ?

Zacharee1

did they get in?

are they rming as we speak?

Android Dev

Let me look up this IP.

Serg

1:23 AM

Zacharee1

sigh

Serg

i don't think it's 'accidental'

Android Dev

False alarm.

Zacharee1

Well, it seems France is out for vacation options

edwinksl

consider canada for vacation

Zacharee1

1:24 AM

actually we're going there :p

Android Dev

But my log is filled with "bad username" entries.

Zacharee1

Going to Niagara Falls, then to Toronto, then Montreal, then Quebec City

Serg

yup , they're trying to pick your usernames @AndroidDev

Nathan Osman

That's nowhere near me.

Zacharee1

@AndroidDev sounds like the brute-force attacks my SSH server gets

@NathanOsman not by chance

;)

Serg

1:25 AM

let's SSH into my DO server , see what's going on there

Android Dev

@Serg How is that possible????

MathCubes

Hello

Zacharee1

@AndroidDev they're just trying random stuff

Android Dev

I have SSH locked to my home IP....

Serg

@AndroidDev scripts , of course !

Nathan Osman

1:25 AM

@MathCubes welcome.

Zacharee1

@AndroidDev then they'll never get in lol

Serg

they're just generating usernames and passwords and trying all of them

Zacharee1

unless there's IP spoofing now

Nathan Osman

I still don't know why they try when I have password authentication disabled.

Android Dev

But why is it even responding???

MathCubes

1:26 AM

Quick question would it be possible to run a program, and have another program stay on top of that?

Android Dev

Only I have the .pem file....

Zacharee1

@MathCubes what?

Nathan Osman

That's like continuously trying different key combinations to get through a door with a biometric lock.

MathCubes

For example, running Chrome in Kiosk mode with Team Viewer stay ontop.

Zacharee1

@AndroidDev to lead them on. Your server is a tease

Nathan Osman

1:26 AM

We have a word for that.

Honeypot.

Android Dev

So its good that it's faking them out?

Zacharee1

@MathCubes you mean have TV always stay in front of the Chrome window? Why?

MathCubes

Yea

Zacharee1

@AndroidDev if your internet can handle the traffic

IanC

alright, less than 100 pages to finish this bash book! :D

time to get ready to sleep

MathCubes

1:27 AM

So I can Scam those Windows scammers with Windows93.net

Android Dev

If Amazon's can handle it you mean

MathCubes

Tryed with Windows therers no way to disable Ctl, Alt, Del.

Android Dev

mean

Serg

Jul 14 21:26:56 sergs-first-server sshd[32517]: Invalid user joomla from 40.114.52.144
Jul 14 21:26:56 sergs-first-server sshd[32517]: input_userauth_request: invalid user joomla [preauth]
Jul 14 21:26:56 sergs-first-server sshd[32517]: pam_unix(sshd:auth): check pass; user unknown
Jul 14 21:26:56 sergs-first-server sshd[32517]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.114.52.144

Kek, somebody is trying joomla username

Zacharee1

OT? askubuntu.com/questions/798749/bash-event-not-found

MathCubes

1:29 AM

found this but need more

thepcspy.com/read/converting-ubuntu-desktop-to-kiosk

Zacharee1

Hey, that's Oli!

Android Dev

Flagged.

Serg

Ah, that's @Oli's website

Zacharee1

@Serg what have you done

you've summoned the beast

Android Dev

Ooops :)

😲

@Serg - And the CRON entries?

Nathan Osman

1:31 AM

@Serg the first line is missing a semicolon! And the barista object has no method request()!

Serg

kek , he's not that evil, probably should be happy his site is famoz

Zacharee1

Someone want to call this number and see who it is? 610-674-1624

It's the number that was in my PayPal account

when it was being used by someone else

Serg

O_o

nope, just nope

Zacharee1

I'm guessing it's a GVoice number

Since my money was being converted to Euros for the payments

and the EU doesn't use 610 numbers :p

aha

> 6106741624 is a VoIP number provided by Voxbone with an area code in PA

MathCubes

@Serg Yea that oli website. Any idea how to do what I want?

Zacharee1

1:37 AM

Whitepages says that number is at 419 N 9th Street, Allentown, PA

Serg

@MathCubes nope, i've never set up a kiosk , so ain't my specialty

MathCubes

Np

Edity

hello

Android Dev

@Serg - You were saying CRON entries are normal?

Serg

yup

Android Dev

1:43 AM

What are they, exactly?

Serg

cron is basically task scheduling service. By default there are some tasks running

Android Dev

@Serg Right. But why are they in the access log?

Edity

ooh, lovely discussion

what are you talking about?

Android Dev

@Edity We were discussing my server.

Edity

oh

what server?

Android Dev

1:46 AM

(There were IPs from China viewing it...)

Edity

coughcough Minecraft coughcough Eula?

Android Dev

With some obfuscated PHP code.

@Edity ???

@Edity - This is an Apache server.

Edity

oh

Android Dev

@Edity See: paste.ubuntu.com/19436860

@Zacharee1 What is it?

Zacharee1

Some new Google stuff

Android Dev

1:49 AM

@Zacharee1 Such as....

Zacharee1

Does the link not work?

Edity

Android Dev

@Serg I will have a look.

@Zacharee1 It works, but I didn't sign in

Zacharee1

well I'm too lazy to explain

Serg

2

Edity

1:59 AM

:P

Android Dev

@Serg I saw a shirt once that said, "everything you just said" | /dev/null

Serg

kek, i would love to have one of those

Edity

Android Dev

@Serg And I also saw a shirt that said Stack Overflow, but it was a stack of pancakes.

Serg

:3 that's the stack overflow everybody would like

even better, stack of bacon

bacon overflow

Zacharee1

2:02 AM

Nintendo was founded in 1886 as a playing card company

Serg

can we have bacon.stackexchange.com plz ?

Zacharee1

lol

everyone just posts pictures of bacon in the questions and answers

Edity

@Serg that should be replaced with cooking.stackexchage.com

Serg

no , bacon deserves it's own site !!!

I wonder if there's bacon tor sites :p

bacon.onion ?

Nathan Osman

I love you Windows:

2

Zacharee1

2:05 AM

@NathanOsman Why does that look exactly like those fake ad popups?

@Serg That sounds delicious

Nathan Osman

It's genuine.

Zacharee1

so I did have a tick on the back of my neck...

@NathanOsman I know. I have Windows 10 :p

Whoa. This guy just pronounced Dr. Seuss as "Dr. Zoice"

I mean, I guess it's German, but then wouldn't it be "soice"?

I always said "sewss"

I just seeked in Netflix to 0:60

Animaniacs' "Windsor Hassle" is pretty derogatory towards Queen Elizabeth

Actually, the whole royal family is portrayed as rather stupid

Edity

2:35 AM

O_o

Zacharee1

dupe askubuntu.com/questions/798768/nginx-offers-to-save-the-file

Serg

death toll is 80 in Nice,Fr.

2

Zacharee1

sigh, people

Edity

2:50 AM

yay pencils

Zacharee1

not the time

Edity

D:

Serg

3:03 AM

the amount of depressive is way too much in life

also the amount of stupid people

edwinksl

welcome to earth

where we are simultaneously capable of very great and very stupid things

TheXed

3:31 AM

I think I had the the worst work day ever...

I am not sure if I should even show up at work tomorrow...

edwinksl

what happened

TheXed

Okay so it all started yesterday...

I went to work...we started installing copiers blah blah...

went to our last location...

severe thunderstorms started to roll in...

so we get the copiers finished at 5pm (I get off at 3:30)

this was day 2 of installing copiers btw

So anyways I go out to my car and realize my keys are locked in my car...

it is pouring down rain...

so my wife drives the 30 mins to bring me the spare keys...

fast forward to today...

I am trying to wrap up some projects so I get in the school...

and I put my stuff on a filing cabinet in a classroom...

and I comeback about 2 hours later and the custodians have waxed the floor in the classroom with all my stuff in there...and my spare keys are locked in the car...

so now my car is sitting at the school, with the keys locked in the building, and in the car...

edwinksl

ooooooops

Edity

a series of unfortanate events

i feel bad

Serg

And that's why I carry spare keys in my wallet

TheXed

3:40 AM

Normally I wouldn't have had the spare keys in my car but I forgot to grab them and bring them back into the house last night...

and I never thought they would have waxed the floor with all my stuff in there...