<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.28.1">
</HEAD>
<BODY>
Take one CentOS and call me in the morning.<BR>
Fedora is __Supposed_to_be__ a bleeding-edge experimental distro. <BR>
I gave it up for CentOS, even though CentOS has upgrades farther apart \\ I mean _Because_ CentOS has upgrades farther apart.<BR>
I know people running OpenSolaris because it has historically had long end-of-life, like 10 years. <BR>
<BR>
In the other hand, I generally test alpha flights of Ubuntu (in VMs, these days) for entertainment.<BR>
<BR>
Dr Wolf<BR>
<BR>
<BR>
<BR>
-----Original Message-----<BR>
<B>From</B>: Jim Kinney <<A HREF="mailto:Jim%20Kinney%20%3cjim.kinney@gmail.com%3e">jim.kinney@gmail.com</A>><BR>
<B>Reply-to</B>: Atlanta Linux Enthusiasts - Yes! We run Linux! <ale@ale.org><BR>
<B>To</B>: Atlanta Linux Enthusiasts - Yes! We run Linux! <<A HREF="mailto:Atlanta%20Linux%20Enthusiasts%20-%20Yes!%20We%20run%20Linux!%20%3cale@ale.org%3e">ale@ale.org</A>><BR>
<B>Subject</B>: Re: [ale] Known vulnerabilities in whois? (called by fail2ban)<BR>
<B>Date</B>: Thu, 25 Mar 2010 16:19:50 -0400<BR>
<BR>
<BR>
<BR>
On Thu, Mar 25, 2010 at 3:43 PM, Neal Rhodes <<A HREF="mailto:neal@mnopltd.com">neal@mnopltd.com</A>> wrote:
<BLOCKQUOTE>
Something odd today. <BR>
<BR>
Fedora Core 10 system dog slow. Yes, I should upgrade. Is there a drug you can legally take to help you forget the prior pain of Fedora upgrades? <BR>
<BR>
</BLOCKQUOTE>
<BR>
Alcohol (to steel the nerves) followed by system reinstall followed by lots more alcohol (to fight back the tears) and few Zanax (um, why not at this point?) for good measure. <BR>
<BR>
<BLOCKQUOTE>
<BR>
Top shows that whois is taking 80% of cpu. <BR>
<BR>
whois being called by fail2ban, which is about to cut off access to some wanker trying random passwords. It does a whois first to get some descriptive detail for the logs. <BR>
<BR>
It was trying to do: <BR>
<BLOCKQUOTE>
17753 ? R 508:58 | \_ /usr/bin/whois 203.171.30.41<BR>
</BLOCKQUOTE>
<BR>
You can see it ate a pile of cpu. I killed it off and all seems to be ok. Inquiring minds are curious if those doing external ssh attempts are getting wise to the notion that fail2ban will spot them and then close them down, and are now attempting to either:<BR>
<BLOCKQUOTE>
A. find/use a vulnerability in whois, or <BR>
B. just make the whole fail2ban process hang for a while longer so they get more chances to guess. <BR>
</BLOCKQUOTE>
<BR>
<BR>
</BLOCKQUOTE>
Set up a cron that looks for long-running whois and kill it until you can cycle through the above process :-)<BR>
<BLOCKQUOTE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE>
<BR>
_______________________________________________<BR>
Ale mailing list<BR>
<A HREF="mailto:Ale@ale.org">Ale@ale.org</A><BR>
<A HREF="http://mail.ale.org/mailman/listinfo/ale">http://mail.ale.org/mailman/listinfo/ale</A><BR>
See JOBS, ANNOUNCE and SCHOOLS lists at<BR>
<A HREF="http://mail.ale.org/mailman/listinfo">http://mail.ale.org/mailman/listinfo</A><BR>
<BR>
</BLOCKQUOTE>
<BR>
<BR>
<BR>
-- <BR>
-- <BR>
James P. Kinney III<BR>
Actively in pursuit of Life, Liberty and Happiness <BR>
<BR>
<PRE>
_______________________________________________
Ale mailing list
<A HREF="mailto:Ale@ale.org">Ale@ale.org</A>
<A HREF="http://mail.ale.org/mailman/listinfo/ale">http://mail.ale.org/mailman/listinfo/ale</A>
See JOBS, ANNOUNCE and SCHOOLS lists at
<A HREF="http://mail.ale.org/mailman/listinfo">http://mail.ale.org/mailman/listinfo</A>
</PRE>
<BR>
</BODY>
</HTML>