Ask Ubuntu General Room

9:00 PM

0

Q: When are the 2017 elections?

When are the 2017 elections? Is there a way to tell when the next one is? I checked the previous elections, but it didn't tell me when the next one is. Also how long are they?

Kaz Wolfe

$ cat /etc/opendkim.conf | tail
KeyTable                refile:/etc/opendkim/KeyTable
SigningTable            refile:/etc/opendkim/SigningTable

Mode                    sv
PidFile                 /var/run/opendkim/opendkim.pid
SignatureAlgorithm      rsa-sha256

UserID                  opendkim:opendkim

Socket                  inet:12301@localhost # Listen on 12301

opendkim  2995  0.0  0.1 114932  1380 ?        Ss   12:59   0:00 /usr/sbin/opendkim -x /etc/opendkim.conf -u opendkim -P /var/run/opendkim/opendkim.pid -p inet:12301@localhost
opendkim  2996  0.0  0.3 221580  3168 ?        Sl   12:59   0:00 /usr/sbin/opendkim -x /etc/opendkim.conf -u opendkim -P /var/run/opendkim/opendkim.pid -p inet:12301@localhost

cc @EliahKagan, just so you see this

Eliah Kagan

Thanks. That's /etc/opendkim.conf, though. Does this apply to options given with = in /etc/default/opendkim? (That's the file the instructions in that post are saying to modify.) The files don't seem like they use the same syntax.

Kaz Wolfe

let's see! more testing in prod! :D

Eliah Kagan

I'm also unsure if when the editor said "this will make opendkim stop running" they meant that it would quit or crash in a short time after the edit was made, or that it would not run when subsequently (re)started.

Kaz Wolfe

hm, it does fail to start.

interesting.

(reason given, invalid parameters)

Rinzwind

9:07 PM

@KazWolfe HA!

:=)

Eliah Kagan

Huh.

Kaz Wolfe

@Rinzwind you expected me to be perfect?

Eliah Kagan

That's weird.

Thanks for testing!

Kaz Wolfe

no problem, i should probably undo that rejection now.

Rinzwind

@KazWolfe no but I assumed the edit was valid >:-)

terdon

9:07 PM

@IanC Nice :) For extra portability, replace /home/$USER/ with $HOME. That way it will work even on systems where the home directories are somewhere else. Of, for that matter, for root.

Kaz Wolfe

@Rinzwind hey, it was still a command edit. those are pretty big no-nos.

Rinzwind

:D

@terdon and Unix and SCO

Kaz Wolfe

users should still post a comment and go through the normal chains instead of just suggesting a command edit.

IanC

@terdon thanks! I'll change that :)

Rinzwind

I know a company that put the in /usr/home/ :P so annoying

terdon

9:08 PM

@Rinzwind Yeah, and all sorts of enterprise/academia systems.

Kaz Wolfe

how to annoy seth: spell it AskUbuntu

Eliah Kagan

I can reapply the change from the edit.

Kaz Wolfe

yeah, that's probably the best, i wish we could go back and change our review votes sometimes.

Eliah Kagan

(I still have it up in review, so I think I can just do "Improve Edit" and that will let me apply it.)

Rinzwind

YES another rootkit topic \o/

Kaz Wolfe

9:11 PM

MINE

Rinzwind

no! already mine

Kaz Wolfe

wait, damnit, it's about how to avoid them.

terdon

@MadaraUchiha looks good. I added that you tried the classic ways of getting to a tty.

Madara Uchiha

👍

Rinzwind

@KazWolfe thanks for the upvote >:)

Kaz Wolfe

9:13 PM

@Rinzwind You deserve it, and I need to vote more.

Rinzwind

@terdon is it allowed to use github.com/ivyl/rootkit as a link on an answeer?

Kaz Wolfe

@Rinzwind Yes, provided you say "don't actually run this, research purposes only, blah blah blah"

chriswarrick.com/blog/2015/01/30/systemd-is-awesome

@NathanOsman --^

Rinzwind

@KazWolfe lol it has 86 forks :D

you know what is weird...

why does searching for rookits linux get me 1 actual rootkit and 100000000000000000 references to chrootkit and rkhunter :P

Kaz Wolfe

@Rinzwind none of which really change anything.

Rinzwind

yeah

86 scriptkiddies :=D

Kaz Wolfe

9:17 PM

@Rinzwind because linux has few rootkits? Mostly because users on Linux usually aren't total morons?

Eliah Kagan

I've applied the edit. Thanks to both of you!

Kaz Wolfe

no problem, sorry i nuked that out prematurely.

i need to be more careful

Eliah Kagan

Well, there's been no harm done -- plus, you actually then did the research for me to check into this, so I feel like that greatly outweighs the mistake. :)

Kaz Wolfe

oh yeah, thanks for reminding me. i should undo that.

and probably report it as a bug, that shouldn't be happening...

Eliah Kagan

Oh. Yes.

Especially if that's on a production box. :)

Rinzwind

9:25 PM

what is "oruga"?

@KazWolfe you had to post an answer hmm? >:)

there >:)

Kaz Wolfe

OpenDKIM fails to load when comments are present

Affects: OpenDKIM version 2.10.3 If a comment is present after the `SOCKET=` line in `/etc/default/opendkim` like below, OpenDKIM will fail to launch, citing invalid usage. # Command-line options specified here will override the contents of # /etc/opendkim.conf. See opendkim(8) for a complete list of options. #DAEMON_OPTS="" # # Uncomment to specify an alternate socket # Note that setting this will override any Socket value in opendkim.conf #SOCKET="local:/var/run/opendkim/opendkim.sock" # default #SOCKET="inet:54321" # listen on all interfaces on port 54321 #SOCKET="inet:12345@localhost" # listen on loopback on port 12345 #SOCKET="inet:12345@192.0.2.1" # listen on 192.0.2.1 on port 12345 SOCKET="inet:12301@localhost" # just a "harmless" little comment Relevant excerpt from journalctl: Jan 14 13:04:43 hostname systemd[1]: Starting DomainKeys Identified Mail (DKIM) Milter... -- Subject: Unit opendkim.service has begun start-up …

opendkim (Ubuntu)

Undecided / New

bug filed.

Eliah Kagan

I wish the original edit summary (by reinierkors) had been a little more detailed so it would've been easier to notice that the edit was valid. Like, with a link to documentation, or something. With that said, my impression is that we're not as strict about edits to code on Ask Ubuntu as on Stack Overflow, and are more likely to tolerate them on AU than on SO even without any prior discussion, provided they're necessary, correct, and reviewers can determine those things without excessive work.

(And, though not evidence of policy or consensus, I know I'm personally grateful for some such edits on my own posts, such as this edit that fixed a strange and embarrassing claim I apparently once made about escaping single quotes in bash. :) )

@KazWolfe Thanks!

Kaz Wolfe

Eh, I tend to almost immediately reject code edits, because I don't want to have to check if they work or not. Leave it as a comment, because it can really change the intent of a post. But that's just my own way of doing things, i don't know if there's even a site policy about it.

there should probably be a meta post for that...

wat.

to. is a valid domain name.

Byte Commander

9:43 PM

wat?

Kaz Wolfe

to.

valid domain.

Byte Commander

O.o

Kaz Wolfe

┌─[13:43:35]─[kazwolfe@WOLFSTORM]
└──> ~ $ dig to.

; <<>> DiG 9.9.5-3ubuntu0.10-Ubuntu <<>> to.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45325
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;to.                            IN      A

;; ANSWER SECTION:
to.                     85521   IN      A       216.74.32.107

;; Query time: 50 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)

Eliah Kagan

Yeah, because technically a fully-qualified domain name ends in a terminal . (though it may almost always be omitted). So -- assuming my understanding is correct -- it's a way to specify the fully qualified name consisting of just the to TLD. And there happens to be a web server accessible that way! to without the trailing . works with some software and not others; to. seems to be a much more reliable way to access it.

Byte Commander

So http://de. for example should be valid too?

Kaz Wolfe

9:45 PM

basically. still impressively confusing

@ByteCommander yes

Byte Commander

no server running there though

Kaz Wolfe

; <<>> DiG 9.9.5-3ubuntu0.10-Ubuntu <<>> de.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 259
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;de.                            IN      A

;; AUTHORITY SECTION:
de.                     1589    IN      SOA     f.nic.de. its.denic.de. 2017011489 7200 7200 3600000 7200

;; Query time: 56 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)

Eliah Kagan

12

A: Check if computer is connected to the internet

Bash + GNU utils, 8 5 bytes saved thanks to @Muzer. wget to. The other shell answers check the return code and echo some status output accordingly. This is unnecessary. The shell return code is already a usable Truthy/Falsey code and accessible in the $? parameter which is idiomatic for...

Kaz Wolfe

No A record.

Byte Commander

I wonder who has set that to. up and why.

Kaz Wolfe

9:46 PM

they just bound the TLD to something, no idea why.

ai. is another one

Eliah Kagan

Trailing Dots in Domain Names

Kaz Wolfe

it's just still sorta weird/interesting.

Eliah Kagan

Yes indeed.

Kaz Wolfe

it's more a "we did because we could" thing, i guess.

if i had a TLD, i'd do that too, so...

Kdrumz

@KazWolfe so I did end up running rkhunter and it said this: imgur.com/a/xAXy0 I tried looking at the log file and it kept saying permission denied even when I ran as root.. Should I worry about it?

Kaz Wolfe

9:50 PM

the permission denied thing is curious...

can you read it with sudo less /var/log/rkhunter.log?

if not, try dropping into a root shell manually with sudo -s and run ls -la /var/log/rkhunter.log, post output back here

Kdrumz

The first command gave me a lot of output, still post?

Kaz Wolfe

no, that means it worked, and you can read it :D

Kdrumz

so now what should i do?

Kaz Wolfe

look at the logs, and find the suspicious file

Kdrumz

this is one of the warnings: [19:00:05] /usr/bin/lwp-request [ Warning ]

Kaz Wolfe

9:59 PM

there should be a line below that one

Kdrumz

[19:00:05] Warning: The command '/usr/bin/lwp-request' has been replaced by a sc
ript: /usr/bin/lwp-request: a /usr/bin/perl -w script, ASCII text executable

oh yep thats it

Kaz Wolfe

hm.

do file /usr/bin/lwp-request please

and dpkg -S /usr/bin/lwp-request

Kdrumz

okay here were two other ones [19:02:11] Info: Starting test name 'passwd_changes'
[19:02:11] Checking for passwd file changes [ Warning ]
[19:02:11] Warning: User 'postfix' has been added to the passwd file.
[19:02:11]
[19:02:11] Info: Starting test name 'group_changes'
[19:02:11] Checking for group file changes [ Warning ]
[19:02:11] Warning: Group 'postfix' has been added to the group file.
[19:02:11] Warning: Group 'postdrop' has been added to the group file.

Kaz Wolfe

those are okay.

Kdrumz

and these are the last ones i see: [19:02:11] Performing filesystem checks
[19:02:11] Info: SCAN_MODE_DEV set to 'THOROUGH'
[19:02:12] Checking /dev for suspicious file types [ Warning ]
[19:02:12] Warning: Suspicious file types found in /dev:
[19:02:12] /dev/shm/pulse-shm-3169641487: data
[19:02:12] /dev/shm/pulse-shm-4206271540: data
[19:02:12] /dev/shm/pulse-shm-1590133207: data
[19:02:12] /dev/shm/pulse-shm-3959205693: data
[19:02:12] /dev/shm/pulse-shm-4266681780: data

Kaz Wolfe

10:03 PM

yeah, those all seem normal.

Kdrumz

how do i back out so I can run: file /usr/bin/lwp-request

all i see at the bottom is (END)

Kaz Wolfe

either Q or Ctrl-C

also, read this too when you have a chance:

Byte Commander

q

Kaz Wolfe

1

A: Help, I May Have a Rootkit

If you use expert tools, also read the expert manual. You have warnings only, no errors... ;-) Furthermore, rootkits are the most nasty pieces of malware out there and can hide themselves even from rootkit hunters. Read the FAQ because the correct way of doing this is to boot from a live CD on...

Kdrumz

here is the first command output: kdrumz@kdrumz-ua:~$ file /usr/bin/lwp-request
/usr/bin/lwp-request: a /usr/bin/perl -w script, ASCII text executable
kdrumz@kdrumz-ua:~$

and i definitely will

and the second command: kdrumz@kdrumz-ua:~$ dpkg -S /usr/bin/lwp-request
libwww-perl: /usr/bin/lwp-request
kdrumz@kdrumz-ua:~$

Kaz Wolfe

10:06 PM

yeah, you're okay.

system is clean.

Kdrumz

ahh sweet, thanks for your help!

Kaz Wolfe

Also, everyone else, check out APT Browse, really useful tool.

Byte Commander

@KazWolfe has no xenial/universe or xenial/multiverse packages though...

Kaz Wolfe

@ByteCommander true, still good for quick lookups of main packages though, but not having universe is sorta annoying

still beats launchpad

Byte Commander

IF you don't filter the Debian repos out, probably most packages are still there through those.

terdon

10:26 PM

@Rinzwind Yeah, I don't see why not. As long as you don't say something like "here, use this to make your graphics driver work" :P

Byte Commander

11:45 PM

1

Q: How to stop USB full ubuntu install from probing hard disks?

I made an encrypted USB install of Ubuntu on a 32GB USB pendrive using LUKS encryption on the swap and actual install. How do I make it so no hard drives are mounted at boot or even probed for that matter. On the offchance the system running the USB key has linux on it, it would mount an unencryp...