- main - earth.li

forensic specialists
by Peter Alcibiades 08 Aug '11

08 Aug '11

Does anyone have a firm or person they have used for forensic investigations and would recommend? I have a disk (ntfs) which I am looking at and need a professional with a track record to help with. Data recovery. Yes, I did make a clone using dd and worked on that in my bumbling way, so the original is pretty much as was when obtained. I've got quite a bit of stuff off but suspect a secure delete tool was used on some parts. It would be nice to get this confirmed if possible. Peter

2 1

[ALUG Announce] ALUG Norwich Pub Meet Thursday 11th August
by Viperfang 08 Aug '11

08 Aug '11

ALUG Announce Please send announcements to Announce(a)lists.alug.org.uk Unsub, change settings via http://lists.alug.org.uk/mailman/listinfo/announce ----- Hello Aluggers, Our monthly ALUG Norwich social meeting will be held this Thursday, 11th August at The Coach and Horses (82 Thorpe Road, Norwich, NR1 1BA). The meeting officially starts at 8pm, although some people may arrive earlier. More information on those people can be found on the list and the IRC channel. If you are unsure if you will recognise us then make yourself and your intent to attend known by either posting on list or visiting us on IRC so we can look out for you rather than hiding in the corner. Optionally you could ask at the bar if they know where the geeky computer weirdos are and they'll point you in the right direction (seriously!). Another possibility is look for heaps of electronics on a table that may possibly look like movie props that would used for detonating explosives. Feel free to bring electronics/laptops/gadgets to the meet, you will by no means be alone. Ben Bewick aka Viperfang NB: This mail is automated, please refer to the usual sources for more information. ALUG Contact Details: Website : http://www.alug.org.uk/ IRC : #alug on irc.alug.org.uk List : http://lists.alug.org.uk/mailman/listinfo Twitter : http://twitter.com/anglianlug Identica: TBA Facebook: http://www.facebook.com/group.php?gid=2381613902 ----- Send discussion replies to main(a)lists.alug.org.uk (Reply-To set) Unsub, change settings via http://lists.alug.org.uk/mailman/listinfo/announce

1 0

Can't cope with these new fangled GUIs - help wanted with Thunderbird IMAP/SMTP setup
by Chris G 05 Aug '11

05 Aug '11

I'm trying to get Thunderbird to connect to a fairly standard E-Mail account and I'm failing miserably at the moment. The apparent problem is that I don't seem to be able to tell Thunderbird that the user name for both IMAP and SMTP authentication is user(a)isbd.co.uk. I've gone into manual setup for the account and changed the user name to user(a)isbd.co.uk but now when I tell Thunderbird to get mail it says:- Enter your password for user@isbd.co.uk@mail.gridhost.co.uk which is fairly stupid! How do I get Thunderbird to allow me to set the user name to something which isn't <user>@<name of domain>? The correct mail server to use *isn't* related to the name of the domain where the user's mailbox is. The domain for the user's mailbox is isbd.co.uk but the mail server (if you're using SSL) is mail.gridhost.co.uk. -- Chris Green

5 8

Obscure PHP / FTP issue
by Mark Rogers 04 Aug '11

04 Aug '11

Not sure if anyone here will be able to shed some light on this but Google isn't helping. I have some PHP code that opens a connection to an FTP server (running Pure-FTPd), writes a few lines to a file, then closes the connection. In other words: $fh = fopen('ftp://user:pass@ftp.example.com/test.csv','w'); for ($i=0;$i<=100;$i++) fputs($fh, "blah blah blah\r\n"); fclose($fh); The problem is that when I look at the uploaded file it's contents have been truncated. Putting a suitably long sleep() before the fclose "solves" this for some definition of "suitably long" but obviously isn't a real solution. Inserting an fflush($fh) makes no difference. I'm not sure if this is a PHP issue (specifically with the FTP wrappers to fopen/fclose), or a generic FTP issue, or a problem specific to Pure-FTPd. I have however tried to two different servers running very different versions of Pure-FTPd with the same effects. If there was a standard issue here I'd have found something with Google, surely? Otherwise I don't know where to go looking? -- Mark Rogers // More Solutions Ltd (Peterborough Office) // 0844 251 1450 Registered in England (0456 0902) 21 Drakes Mews, Milton Keynes, MK8 0ER

2 2

A new appp!
by ted.harding＠wlandres.net 02 Aug '11

02 Aug '11

First, my apologies for cross-posting (which I know will affect some of you), but this is one of those news gems which deserves the widest publicity. I just received my ISP Zen's latest News letter. One item therein is: Powerpoint politics There's a new political party in Switzerland and its sole aim is to have PowerPoint outlawed. The Anti-PowerPoint Party says banning the application would allow people to get back to doing some real work. In the party's blog, it claims that so many government institutions use PowerPoint that about 11 per cent of more than 4.1 million employees have to waste time on presentations on a regular basis. The ban might happen. Citizens can force a referendum on any subject in Switzerland. All it takes is 100,000 voters to sign a petition demanding one. URLs in the Zen article: [techeye.net: "Switzerland demands Powerpoint's death"]: http://zen-mail.co.uk/IJT-HCUP-3BFWEB-6SFFZ-0/c.aspx Sample quote: "Looking at the problem Europe wide, SAP thinks that Powerpoint costs the 110 billion Euros which is coincidentally how much the Greek debt bail-out will cost." [techeye.net: US Army declares war on Powerpoint"]: http://zen-mail.co.uk/IJT-HCUP-3BFWEB-6SFG0-0/c.aspx Sample quote: "Sam Nuxoll, a platoon leader in Iraq, seems to have shaken the Pentagon with a quote that said he was spending most of the war making Powerpoint slides. Instead of spending his time dodging bullets, he was making bullet points." ===================================== And I shall add one of my own favourite APP diatribes (much inspired by Edward Tufte, one of the great experts in the presentation of information, and a pioneer in formulating the principles of good presentation): http://services.exeter.ac.uk/cmit/media/audio/ Microsoft-Powerpoint-And-The-Decline-Of-Civilisation-BBCR4-2004-10-18.mp3 (equivalently: http://tinyurl.com/42al9e9 ) [BBC Radio 4, 18 October 2004. Duration 14 minutes. Which was a delightful surprise to me that day, with R4 casually on in the background] See also the Wikipedia article on Tufte: http://en.wikipedia.org/wiki/Edward_tufte There's a good (bullet-pointed???) summary of his views on PowerPoint in Section 2.2 "Criticism of PowerPoint". Best wishes to all! Ted. -------------------------------------------------------------------- E-Mail: (Ted Harding) <ted.harding(a)wlandres.net> Fax-to-email: +44 (0)870 094 0861 Date: 01-Aug-11 Time: 11:37:35 ------------------------------ XFMail ------------------------------

10 16

Missing files
by James Bensley 30 Jul '11

30 Jul '11

So I made a boo boo today... Like a fool I pulled my NTFS external USB drive out of my Ubuntu 10.04 laptop a second too early. I was moving some files from the laptop to the drive and just as the bar was reaching complete I pulled the USB cable out. It was a load of files and folders I had looped and "right clicked > cut". I would have thought that say the last file of the selection wouldn't be there because I interrupted the cut process right at the end but no, all the files aren't on the external drive and because it was a cut not a copy they are gone from my laptop. Anyone know how I can scan my external drive for the presumably unclosed files and "close them" or something data recovery-esq like that? -- James. http://www.jamesbensley.co.cc/

2 1

Re: [ALUG] Why is the time correct on my virtual machine?
by Mark Rogers 29 Jul '11

29 Jul '11

On 28 July 2011 17:39, Anthony Anson <tony.anson(a)girolle.co.uk <mailto:tony.anson@girolle.co.uk>> wrote: Is there any possibility of a crosslink with the two virtual machines? Both running in Virtual Box, mayhap? They are both inside vbox, yes. However, I installed ntpd on the second virtual machine and checked its time against the time server, and it was different, albeit only a few seconds. So coincidence is looking more likely? -- Mark Rogers // More Solutions Ltd (Peterborough Office) // 0844 251 1450 Registered in England (0456 0902) @ 13 Clarke Rd, Milton Keynes, MK1 1LG

2 1

Why is the time correct on my virtual machine?
by Mark Rogers 28 Jul '11

28 Jul '11

I have a server (running Ubuntu 10.04/Zentyal + VirtualBox). It's time is about 5 mins out (it doesn't seem to have any time sync built in). Hosted on it are two virtual machines, both with accurate times. One has (in root's crontab): */10 * * * * /usr/sbin/ntpdate -s uk.pool.ntp.org .. so that explains that one being correct. However the other one does not, and I can't see anything that would be keeping it in sync. I've looked in root's crontab, as well as all of /etc/cron*. There's no ntpd script in /etc/init.d. It's running Ubuntu 11.04 (server). How would this one be staying correct? -- Mark Rogers // More Solutions Ltd (Peterborough Office) // 0844 251 1450 Registered in England (0456 0902) 21 Drakes Mews, Milton Keynes, MK8 0ER

1 0

Pinging Server's 127.*.*.* subnet
by steve-ALUG＠hst.me.uk 25 Jul '11

25 Jul '11

Hi all, I was trying to add a extra IP address to my server's localhost because I wanted to run a apache virtual host on a separate IP address. I used sudo ip addr add 127.0.0.5/32 dev lo and then I could ping 127.0.0.5 successfully. When I'd finished, I ran sudo ip addr del 127.0.0.5/32 dev lo which didn't return any error messages. I than ran ping 127.0.0.5 and still got responses. I ran sudo ip addr del 127.0.0.5/32 dev lo again and it told me that it could not do it "RTNETLINK answers: Cannot assign requested address" It may be that the ip addr add has nothing to do with it, but on this machine, my server, I can ping any address I've tried in the 127.*.*.* range and get a response. Is this normal, or have I messed something up? If so, what have I messed up? Is there anything I can run that show's what's providing these ports? It's an Ubuntu machine, running dnsmasq, apache. Ubuntu 10.04.3 LTS Any ideas? Or am I being thick??? Steve

3 4

Network delay issue
by Stuart Bailey 22 Jul '11

22 Jul '11

I have a mid sized network, around 80 users. Most of these users are using windows clients, with a few macs. There are 3 Linux servers, 2 for file services (samba and netatalk), and one as domain controller (Samba) and email (cyrus / postfix). There is also a windows server used for Sage. We have recently started to notice periodic delays in network traffic. I am not aware of any changes to the network at the time when this problem started - it has been fine for 18 months or so. This has been noticed as follows: 1. remote ssh into Linux server - typing gets momentarily delayed, for about 5-10 seconds, then resumes. This occurs randomly, but typically every minute or so. 2. Remote desktop (to a windows client), freezes, and occasionally drops out. 3. File access to samba shares sometimes takes a very long time, or times out. Then a retry works almost instantly. 4. There is also a DOS (runs in XP command window) based database, whose files reside on a samba share. When scrolling through records, this occasionally freezes, then resumes. The delay periods are all fairly consistent - ie, they affect the above for roughly the same periods. I have monitored tcpdump from the Linux server whilst accessing the database, and can see server responses from samba to the DOS client, immediately before a delay occurs. I am certain the servers are not responsible, since it affects services on different machines, and can see samba packets from the server at the right time. Also, I've monitored the broadband traffic, and can see nothing unusual. The network has gigabit connections from the servers to 3 stacked switches. Fibre between buildings - although the problem affects all buildings. Clients are typically on 100M connections. the windows clients are all running NOD32 AV. RKhunter and chkrootkit are run on the servers overnight, and show nothing. I'm not sure what else to look for. I've monitored the servers with wireshark, and they look normal. Any ideas would be welcome, please. Stuart Bailey BSc (hons) CEng CITP MBCS LinuSoft (Managing Director) Linux Specialist & Software Developer ~~~~~~~~~~~~~~~~~~~~~~~ Phone: (0845) 658 3563 Direct: +44 (0) 1953 878162 Fax: +44 (0) 1603 858583 ~~~~~~~~~~~~~~~~~~~~~~~ http://www.linusoft.co.uk __________ Information from ESET Mail Security, version of virus signature database 6308 (20110719) __________ The message was checked by ESET Mail Security. http://www.eset.com

4 3