- main - earth.li

Trojans....
by Peter 19 Oct '23

19 Oct '23

I took some files today to a local print shop on a usb stick to get them printed. They have the very sensible procedure that, when given files on a stick, they first insert the stick into a laptop which is not on their network, and scan it. The stick is a Maxell FAT32, and my systems are Debian 11. To my horror they came back and said it had trojans! There were two phishbank.ajy JSI:trojan.cryos.3892 This last had three copies installed, the first only one. I'm pretty confident these are not false positives, they get their systems and network from a very competent IT shop. I don't know what AV they use. They are a windows shop of course, so it will be one of the usual windows AV products. So I am pretty sure these trojans were the real thing. They asked what did I want to do. Leave them alone, delete them? I said delete, after making a note of what they were. At the moment I am downloading and installing clamav for my Debian installation. I did a scan of the Windows 10 VM that I have running in Virtual Box, using the MS antivirus that comes with Windows, and it came up clean. I'm also proposing to insert the stick, hopefully now disinfected, into my Debian system, copy a few files to and fro, and go back to the shop to see if it has got itself reninfected from Debian. Unlikely, but it seems like a useful precaution. Should I be worried, and what else should I do? Be grateful for any thoughts. The only other thing about my Debian machine that I've noticed lately is that on one Wordpress site I sometimes get a 429 too many requests error, in Firefox. This happens on first clicking on a link on the site or first visiting it, so there has not in fact been more than one request. Don't see how that could be related but thought it best to mention, just in case. Peter

2 1

Using testdisk to fix a corrupt thumb drive
by Mark Rogers 12 Oct '23

12 Oct '23

I have a thumb drive which is formatted to FAT32 but not recognized in Windows. Using "testdisk" I can find the partition OK, but testdisk reports: Disk /dev/sdc - 30 GB / 28 GiB - CHS 29327 64 32 Current partition structure: Partition Start End Size in sectors Warning: number of heads/cylinder mismatches 255 (FAT) != 64 (HD) Warning: number of sectors per track mismatches 63 (FAT) != 32 (HD) 1 * FAT32 LBA 0 1 1 29327 63 32 60063712 [DATADISC] If I select the partition and view files then i see what I expect to see, and I can manually copy off individual files from there. So from a data recovery perspective I have everything I need. However, if I try writing the partition information back using testdisk the thumb drive is still not recognised in Windows and if I reopen it in testdisk it reports the same issues. I tried changing geometry to 255/63 as testdisk suggested, but then analyse says "Bad relative sector". What do I need to do so that the disk is recognised in Windows? Mark -- Mark Rogers // More Solutions Ltd (Peterborough Office) // 0344 251 1450 Registered in England (0456 0902) 21 Drakes Mews, Milton Keynes, MK8 0ER

2 1

Re: Weird freezes in Firefox
by Phil Ashby 11 Sep '23

11 Sep '23

On 11/09/2023 12:00, Peter<peter.northerly(a)gmail.com> wrote: > > Any ideas what this could be? Its happened a couple of times. > > I will be doing something perfectly ordinary in Firefox, like > shopping on Amazon was the last one. All of a sudden the mouse > cursor, as I move the mouse, turns into a broad black stream, which > makes a trail a half inch or so wide, quite jagged. Stays in place as > the mouse is moved on. In and out of the browser window. Its > impossible to close the window. More clicking brings up partial > truncated small windows. Right clicks have no effect. That sounds like the display output is frozen apart from a hardware mouse cursor. You should (hopefully) have something in an Xorg.log file (after a restart!) to help identify if the X server itself has died, or if Firefox has exclusively grabbed the screen then hung. As this only occurs with Firefox, then my hunch would be the latter. > The only thing I could find to do to get out of it was reboot. You could try Ctrl-Alt-Backspace (the default X server terminate 3-key-salute). If it's Firefox that has a problem you may get your login screen back. I have also used the magic SysReq keys (https://en.wikipedia.org/wiki/Magic_SysRq_key) to sync disk blocks then reboot which might get you more useful log file contents... > This is Debian 11, fluxbox, using the Nvidia drivers for their card. > Never happened with any other app, including not with any other > browser. Doesn't happen often, maybe three or four times over > several months. Another thing to try then: the nouveau drivers, although you will likely lose some performance depending on your particular card. > I shall be upgrading to Debian 12 fairly soon, so maybe that will > make it go away. But what could it be? And what would you do, other > than upgrading? I made the switch to 12 (bookworm) a couple of months back - all ok so far running sway atop Wayland with or without Xwayland support for older X11 apps (apart from Java, but that's another story entirely*) Good luck! Phil. * https://www.ashbysoft.com/articles/swingland/

1 0

Weird freezes in Firefox
by Peter 11 Sep '23

11 Sep '23

Any ideas what this could be? Its happened a couple of times. I will be doing something perfectly ordinary in Firefox, like shopping on Amazon was the last one. All of a sudden the mouse cursor, as I move the mouse, turns into a broad black stream, which makes a trail a half inch or so wide, quite jagged. Stays in place as the mouse is moved on. In and out of the browser window. Its impossible to close the window. More clicking brings up partial truncated small windows. Right clicks have no effect. The only thing I could find to do to get out of it was reboot. This is Debian 11, fluxbox, using the Nvidia drivers for their card. Never happened with any other app, including not with any other browser. Doesn't happen often, maybe three or four times over several months. I shall be upgrading to Debian 12 fairly soon, so maybe that will make it go away. But what could it be? And what would you do, other than upgrading? Peter

1 0

Nextcloud upload and share from commandline
by Mark Rogers 11 Aug '23

11 Aug '23

Any nextcloud users here who are familiar with the API? All i want to do is have a script which uploads a file to my nextcloud server, creates a read-only share link for it, and outputs that link. So when I have a file that's too big or otherwise unsuitable for email, I can simply push it to nextcloud and paste the supplied link into my email instead. This seems like a fairly obvious use case but my attempts at Googling a solution have thus far failed me. Uploading a file from a script is easy and there are plenty of examples out there but creating a share link from that point has me (and ChatGPT, and Google Bard) stumped. Mark -- Mark Rogers // More Solutions Ltd (Peterborough Office) // 0344 251 1450 Registered in England (0456 0902) 21 Drakes Mews, Milton Keynes, MK8 0ER

2 2

MPC playback or file converter
by BD 26 Jun '23

26 Jun '23

Hi So I have this headless Debian machine serving miniDLNA on my network. There's good few hundred GB files in its library but I have a problematic bunch too. A very old cache of mpc files that don't want to play. Does anyone have a way to either force miniDLNA to transcode the files on the fly or to convert those file in place (preferably retaining files structure). Cheers, Bart

2 1

Viewing Quick Time videos on Linux?
by Bev Nicolson 24 Jun '23

24 Jun '23

I have two dvd's that use Quick Time. (Yes, they are rather old.) I wondered if there was any way of viewing them? Is there an alternative QT that could help here? Or would it depend solely of finding someone using Windows or Apple? Bev

4 6

Dnsmasq appears to be setting 2 default routes
by Srdjan Todorovic 13 Jun '23

13 Jun '23

Hi all, I'm trying to get some dnsmaq stuff working on my desktop machine (Kubuntu). I've got a wifi interface that is my default (and only) route to the Internet. I've also got a wired ethernet interface that I want to use to: - provide DHCP service to a headless server - provide NAT to that headless server so that it can connect to the internet I've setup a dnsmasq config (using the defaults, but with some tweaks), but whilst it does actually serve DHCP to a laptop (for testing), it appears to set 2 default routes on my desktop, and I can no longer get onto the Internet. Routing table while dnsmasq was running: srdjan@serenity:~$ route Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface default dsldevice.lan 0.0.0.0 UG 100 0 0 enp37s0 default dsldevice.lan 0.0.0.0 UG 600 0 0 wlp38s0 link-local 0.0.0.0 255.255.0.0 U 1000 0 0 docker0 172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0 192.168.1.0 0.0.0.0 255.255.255.0 U 600 0 0 wlp38s0 dsldevice.lan 0.0.0.0 255.255.255.255 UH 100 0 0 enp37s0 192.168.2.0 0.0.0.0 255.255.255.0 U 100 0 0 enp37s0 I'm not sure this is correct. Dhcp-option 3 and 6 were left as default, but I would have expected the impact of those to be felt on the client machine trying to get the IP address, and not the "server" (desktop). Perhaps option 3 might make sense to set to the same address as the wifi router? Once I tore down both enp37s0 and wlp38s0, and reconnected on wifi using the KDE network manager, did I manage to get back onto the internet. Of note, the default config uses: interface=enp37s0 port=0 dns-range that is on a different network to the usual wifi one Has anyone got any suggestions please on what plainly stupid thing I'm doing with my setup? Thanks, Srdjan

1 1

Spam
by steve-ALUG＠hst.me.uk 27 May '23

27 May '23

Hi y'all My mailserver has started getting a lot of spam in the last few days. Basically, people are sending emails with loads of random email addresses - approx 90+ per email. They're not getting through - they get rejected then blocked. I wondered if anyone else has noticed anything similar? I'm not entirely sure of what this gets them. The occasional spam getting through can't be worth it. Or are they trying a scattergun approach to try and find valid email addresses or accounts? Or are they trying to overwhelm mail servers to exploit bugs in them? Or something else? Anything I should do? I'm getting quite close to saying "ah to ${badplace} with it, lets use a commercial mail-server", but I'm quite attached to the features I have with mine. For my email accounts, I can have unlimited email suffixes on them e.g. example(a)mydomain.invalid example-mailinglist(a)mydomain.invalid example-somecompany(a)mydomain.invalid example-ALUG(a)mydomain.invalid etc - anything after the "-" can be specified. I use this so that I can work who spams email address, or leaks my email address to spammers, and for easy blockage. Does anyone provide a service like this for less than megabucks? Steve

5 11

Isolating a smart TV
by Peter 11 May '23

11 May '23

I just got a smart TV (android based), and going through the install process discovered that if you connect it to Internet it transmits a truly astonishing amount of data to a company based in Ireland, which is in turn a subsidiary of another company in Turkey. Neither of which I have previously heard of. I didn't particularly want the smarts, but there don't seem to be any dumb ones available any more, and our old one had expired in its sleep so we had to get something. There is basically nothing you do on this box that is not logged, if you have connected it. Heaven knows what they do with it when they have it. You watch Eurovision, and turn to another channel after 15 minutes, its logged to your particular box and IP address and hardware. Probably every commercial where you turn the sound down is logged (that's just my guess, I don't know it for sure). So I haven't connected it to our router and am using it like a dumb TV. But my question is, is it possible to put this device and only this device through something like pi-hole and so isolate it from the LAN, and also block it from sending data to these companies? Because I would quite like to be able to watch youtube music on it, but not at the price of sending my musical tastes to Turkey in real time! I see on Amazon that you can get fanless industrial mini-pcs for about 70.00. Or there are NUCs on ebay for around 50.00. The industrial ones have two network ports. Would it be possible to get one of the industrial ones, connect one of the ports to the TV, the other to our router, and install pi-hole so as to put the TV into a LAN zone of its own, and also to use pi-hole to block any transmissions to the company? I'm not clear how this would (or would not) work. Essentially, can you have the pi-hole box sit between the TV and the LAN so that the rest of the LAN is unreachable from it and it blocks unwanted calling hime? How should one handle addressing in this case? If you think it would work, that would be enough to encourage me to have a go and try and stumble through it. Any hints most welcome! Or suggestions for how to get the same result in some other way. Peter

3 2