February 2020 - Roundtable

How does on get the date function to work in Libre Office spreadsheet?
by eh＠eduardhiebert.com 08 May '23

08 May '23

Hi, I've formatted the cells as date mm/dd/yy and entered the values as is. Also tried by preceeding with equal sign in case deemed to be a formula but neither works. I assume a difference between two days yields the difference in days, correct? Or are the formula different than plain math? Eduard the Osborne guy at last meeting

4 6

UDP bad checksum flood
by Scott Toderash 03 Mar '20

03 Mar '20

[10192947.300008] UDP: bad checksum. From 1.2.3.4:10398 to 3.4.5.6:5060 ulen 237 I started getting some of this yesterday on one host. I think that there is a way to use regex and fail2ban to block flood attacks like this. Does anyone have the recipe? It comes in on various ports. This example is port 5060 but the host does not have anything listening there.

2 2

weird apache hit
by Trevor Cordes 24 Feb '20

24 Feb '20

I have a mystery hit on my apache server that is giving weird results that by config should never happen... and I can't figure it out. What's happening is very rarely a hit will "break out" of the dirs that I think all hits should be limited to. And I can't reproduce it with telnet tests. Somehow a hit is getting access to /var/www/html/ when that should be impossible. Yes, it's my document root in the global area, but immediately in my virtualhost for that IP and port I redefine docroot to a sub dir of that. There should be no way someone can hit the site and get to the original docroot. Yes, I am probably going to change the default global docroot to just be the same as my subdir one in the virthost, but I really want to figure out why the request can break out the way it is. The only thing weird about the hit, based on my customized logging details, is that they are hitting a ServerAlias of the virthost, which is a bit odd because that particular alias isn't public knowledge (though it's not really hidden either). Oh ya, and the IP is in HK and is trying fuzzing attacks again me. Here's the hit (IPs/hostnames changed): 1.2.3.4 - - [17/Feb/2020:02:40:07 -0600] "GET / HTTP/1.1" 403 199 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0" 80 9-w1.foo.com /var/www/html/ Note port 80, note the serveralias they hit us with, note the resulting directory /var/www/html Here's the error it generates: [Mon Feb 17 14:43:13.444291 2020] [autoindex:error] [pid 16365:tid 140334311606016] [client 2.3.4.5:54603] AH01276: Cannot serve directory /var/www/html/: No matching DirectoryIndex (index.phtml,index.html,index.phtml,index.php) found, and server-generated directory index forbidden by Options directive It's ok it's forbidden (in fact, might have saved my bacon) as I have dirindex forbidden globally. The thing is no hit should ever be trying to find a index.html in /var/www/html! When I try to recreate the hit to match the above manually with telnet, no matter what I do I can't get the serveralias to match their hit: telnet foo.com GET / HTTP/1.1 Host: 9-w1.foo.com User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0 Gives me a log result which matches what I expect the correct behaviour to be: 50.71.247.87 - - [17/Feb/2020:15:48:21 -0600] "GET / HTTP/1.1" 302 136 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0" 80 www.foo.com proxy:fcgi://localhost/var/www/html/Foo/Live/index.phtml What on earth are the other parameters or headers they are passing in that results in a different result than my test? I'm truly stumped. I could try to capture packets of a hit, but the "attacks" only happen 2-3 times a day and always from different IPs in Asia.

6 12

Bitcoin talk from the Long Con
by athompso＠athompso.net 13 Feb '20

13 Feb '20

2 1

Shaw blocking port 25 on business line
by Gerald Brandt 11 Feb '20

11 Feb '20

Hi, I've been fighting with Shaw for days on this. I have what they call a business account with 8 static IPs. I can telnet mail.shaw.ca 25 and get a connection. So, inside their network, SMTP works. If I try to telnet to any other server on port 25, i get no connection. e.g. telnet to google email servers fails, telnet to my server in Montreal fails.). To test that port 25 was open, they had me start Firefox, login to gmail, and send an email from my gmail to my gmail account. that was proof they weren't blocking port 25... Yeah. Right now, in order to get email out, i am using mail.shaw.ca as a relay. That is not supported, so they are asking me to not do that. I told them if I don't use them as a replay, i can't get email out. They did not understand. Does anyone have any idea how to get these guys to understand what is going on? Am i using the wrong terminology? I can't see how I can make it any clearer to them that they are blocking port 25 access to any system outside of their network. Gerald

7 19

Seeking rides to MUUG meetings to/from East Kildonan
by Hartmut W Sager 10 Feb '20

10 Feb '20

Hi folks. I am seeking rides to MUUG meetings to/from East Kildonan during the cold season. I live at the corner of Watt & Munroe. Can anyone help? I've been a MUUG member since 1988, but over the decades, I have had ever increasing difficulties operating in our cold climate, so I've had to miss most MUUG meetings for a number of years now. For this coming meeting on 11 Feb 2020, I would only need a ride back home after the meeting, since I have an appointment downtown (and very nearby the UofW) in the late afternoon and will be staying in the area right through to the MUUG meeting. Oh, I do need a smoke-free air during such rides (I'm quite allergic to smoke). Thanks! Hartmut W Sager - Tel +1-204-339-8331

2 1

MUUG Meeting, Feb 11, 7:30pm -- Performance Tuning the MUUG Server, Bare-Minimum Samba
by Gilbert E. Detillieux 04 Feb '20

04 Feb '20

The Manitoba UNIX User Group (MUUG) will be holding its next monthly meeting on Tuesday, February 11. The meeting topic for this month is as follows: Performance Tuning the MUUG Server Adam Thompson will talk about the recent Debian updates to the MUUG server that triggered a wave of unexpected upgrades and performance tweaks. pecial attention will be paid to the ZFS filesystem and Apache-to-Nginx conversion. Other collaborators will be introduced and their roles in this work described. Daemon-Dash: Bare-Minimum Samba Kevin McGregor will show you how to setup Samba file sharing in 5 minutes: for when you need files shared in a hurry and don't care about much else. The group holds its meetings at 7:30pm on the second Tuesday of every month from September to June. (There are no meetings in July and August.) Meetings are open to the general public; you don't have to be a MUUG member to attend. ******************************************************************* Please note our meeting location for this month: *Room 1M28* Manitoba Hall, University of Winnipeg, entrance on Ellice Ave. between Spence and Balmoral St. Parking is available on the surrounding streets and in the lots on nearby streets. Look for signage once you're at the building, or ask a security guard. ******************************************************************* For more information about MUUG, and its monthly meetings, check out their web server: https://muug.ca/ Help us promote this month's meeting, by putting this poster up on your workplace bulletin board or other suitable public message board: https://muug.ca/meetings/MUUGmeeting.pdf -- Manitoba UNIX User Group E-mail: <gedetil(a)muug.ca> c/o Gilbert E. Detillieux Web: http://muug.ca/ University of Manitoba Phone: (204)474-8161 Winnipeg MB CANADA R3T 2N2 Fax: (204)474-7609

1 0

PostgreSQL vs MariaDB
by Alberto Abrao 04 Feb '20

04 Feb '20

I am in the process of rebuilding my Nextcloud setup. My current one uses MariaDB, which is the recommended one by NextCloud. I had a few issues that needed database repair since then, but other than that it works fine. That said, as I am going to do it all from scratch - my aim is to set it up integrated with e-mail - I was wondering if I should use PostgreSQL instead. I know nothing at all about databases, so I was wondering if one - or many - of our wise fellows here could chime in and give an informed opinion on the matter. Thanks! -- Kind regards, Alberto Abrao 204-202-1778 204-558-6886

4 4