<br><br><div class="gmail_quote">On Thu, Mar 25, 2010 at 3:43 PM, Neal Rhodes <span dir="ltr"><<a href="mailto:neal@mnopltd.com">neal@mnopltd.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>
Something odd today. <br>
<br>
Fedora Core 10 system dog slow. Yes, I should upgrade. Is there a drug you can legally take to help you forget the prior pain of Fedora upgrades? <br></div></blockquote><div><br>Alcohol (to steel the nerves) followed by system reinstall followed by lots more alcohol (to fight back the tears) and few Zanax (um, why not at this point?) for good measure. <br>
</div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div>
<br>
Top shows that whois is taking 80% of cpu. <br>
<br>
whois being called by fail2ban, which is about to cut off access to some wanker trying random passwords. It does a whois first to get some descriptive detail for the logs. <br>
<br>
It was trying to do: <br>
<blockquote>
17753 ? R 508:58 | \_ /usr/bin/whois 203.171.30.41<br>
</blockquote>
<br>
You can see it ate a pile of cpu. I killed it off and all seems to be ok. Inquiring minds are curious if those doing external ssh attempts are getting wise to the notion that fail2ban will spot them and then close them down, and are now attempting to either:<br>
<blockquote>
A. find/use a vulnerability in whois, or <br>
B. just make the whole fail2ban process hang for a while longer so they get more chances to guess. <br>
</blockquote>
<br></div></blockquote><div>Set up a cron that looks for long-running whois and kill it until you can cycle through the above process :-)<br> </div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>
<br>
</div>
<br>_______________________________________________<br>
Ale mailing list<br>
<a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
<br></blockquote></div><br><br clear="all"><br>-- <br>-- <br>James P. Kinney III<br>Actively in pursuit of Life, Liberty and Happiness <br><br>