highest time to have Signal - no?
by lejeczek
hi everybody.
I see some good folks prepped Signal in "copr" but I'd say -
if any maintainer/developer is reading - it's the highest
time we had Fedora's official build of "Signal" available - no?
regards, L.
3 years, 2 months
auditd log processing tools?
by Alex
Hi,
I have a fedora33 system and would like to get more involved with
auditd. I understand the basics, but are there any tools to process
the audit.log file, to make it easier to process, read and display?
How about acting on specific events? What if I wanted to be alerted
somehow when sudo was run more than five times in some period? Perhaps
logwatch?
I've seen references to using it with splunk but are there open source
alternatives?
I'm also aware of aureport, which appears to be great for producing
summary reports, and maybe an event report, but what do people do with
this information to make it useful?
How do admins normally act on the information in the logs? Are they
just using it to investigate a specific event, such as when privileges
are escalated for some reason or ssh is being used?
It's otherwise just too much information - who cares that ssh is being
used or sudo was run, unless you thought that functionality was
disabled, for example.
Thanks,
Alex
3 years, 2 months
Identifying Firefox threads
by Patrick O'Callaghan
This may be slightly OT. If so, apologies.
I find that Firefox tends to slow down and consume more memory over
time, presumably because some tab is doing a lot of work. However the
usual process listings from 'top' or 'glances' just show a bunch of
fairly cryptic threads such as:
85.4 20.3 7.12G 3.11G 2704 poc 2h55:08 45 0 R 391K 0 /usr/lib64/firefox/firefox -contentproc -childID 5 -isForBrowser -prefsLen 291 -prefMapSize 29096
...
and so on, so it's hard to know which one is associated with which tab (or tabs).
Does anyone have a cheat sheet to help in pinning down the culprit(s)?
poc
3 years, 2 months
F32 not booting
by GianPiero Puccioni
Hi,
yesterday my laptop with F32 didn't boot.
It goes in emergency mode and creates a rdsosreport file
I usually don't do this but this time when I installed F I let the system create
the partitions and I think it's LVM with XFS but I'm not sure of the latter and
I am not familiar with this method.
Is there something to do to try to recover something about this, like the
files from /home as of course the USB stick I used for backups went crazy too
and I could recover only a fraction of it. It doesn't seem that it was the HD
that want all bad as the Win10 partition still works.
If I run lvm_scan I get this:
Scanning devices sda7 for LVM logical volumes fedora_shure/root fedora_shure/swap
ACTIVE '/dev/fedora_shure/root' [50.00 GiB] inherit
ACTIVE '/dev/fedora_shure/swap' [<3.88 GiB] inherit
inactive '/dev/fedora_shure/home' [<166.95 GiB] inherit
and in /dev/fedora_shure there is only root and swap
I'll attach both the rdsosreport and output of journalctl(as suggested by the
error message)
Thanks for any help
GiP
P.S. I sent this before but it went into "moderation" as it exceeded the 60K
limit, I gzipped the attachments and it should be fine now.
G
3 years, 2 months
Mail Reader -
by Bob Goodwin
I have Mail Reader listed in the menu on this computer. Can someone
tell me what the procedure is to make it read/speak some text?
It does not respond to the same number pad keys as Orca. Orca might
work if I could adjust the voice to something intelligible, the
default;;t seems to lose syllables from each word.
As it is I have to use an iPad and ask Siri to read messages. Not a good
system for me.
Bob
--
Bob Goodwin - Zuni, Virginia, USA
FEDORA-32/64bit LINUX XFCE Fastmail POP3
3 years, 2 months
rkhunter warnings
by François Patte
Bonjour,
Since the last update of f32, rkhunter send a lot of warning (in spite
of the --propupd I run after each update...):
Warning: Checking for possible rootkit files and directories [ Warning ]
Found file '/lib/libkeyutils.so.1.9'. Possible rootkit:
Sniffer component
Found file '/lib64/libkeyutils.so.1.9'. Possible rootkit:
Sniffer component
Found file '/usr/lib/libkeyutils.so.1.9'. Possible rootkit:
Sniffer component
Found file '/usr/lib64/libkeyutils.so.1.9'. Possible rootkit:
Sniffer component
Warning: The following processes are using suspicious files:
Command: abrt-applet
UID: 2995 PID: 2663
Pathname: 24376
Possible Rootkit: Spam tool component
Command: abrtd
UID: 0 PID: 1580
Pathname: /usr/lib64/libkeyutils.so.1.9
Possible Rootkit: Spam tool component
Command: abrt-dbus
UID: 0 PID: 3087
Pathname: /usr/lib64/libkeyutils.so.1.9
Possible Rootkit: Spam tool component
Command: abrt-dump-journ
UID: 0 PID: 1629
Pathname: /usr/lib64/libkeyutils.so.1.9
Possible Rootkit: Spam tool component
Command: auditd
UID: 0 PID: 1386
Pathname: /usr/lib64/libkeyutils.so.1.9
Possible Rootkit: Spam tool component
Command: chrome<-----------------this one repeated several
times--------->
UID: 11750 PID: 11749
Pathname: 24376
Possible Rootkit: Spam tool component
Command: cleanupd
UID: 0 PID: 2062
Pathname: /usr/lib64/libkeyutils.so.1.9
Possible Rootkit: Spam tool component
Command: cupsd
UID: 0 PID: 1525
Pathname: /usr/lib64/libkeyutils.so.1.9
Possible Rootkit: Spam tool component
Command: dnfdragora-upda
UID: 3025 PID: 2621
Pathname: /usr/lib64/libkeyutils.so.1.9
Possible Rootkit: Spam tool component
Command: evolution-addre
UID: 3025 PID: 3168
Pathname: /usr/lib64/libkeyutils.so.1.9
Possible Rootkit: Spam tool component
Command: evolution-alarm
UID: 3007 PID: 2571
Pathname: 24376
Possible Rootkit: Spam tool component
etc. etc.
chkrootkit does not teturn any problem...
What is the problem?
Thank you.
--
François Patte
UFR de mathématiques et informatique
Laboratoire CNRS MAP5, UMR 8145
Université Paris Descartes
45, rue des Saints Pères
F-75270 Paris Cedex 06
Tél. +33 (0)6 7892 5822
http://www.math-info.univ-paris5.fr/~patte
FSF
https://www.fsf.org/blogs/community/presenting-shoetool-happy-holidays-fr...
3 years, 2 months
serious rkhunter warnings not seen before (by me).
by home user
I just finished doing my weekly patches for my F32 workstation. The
sequence (done as root):
1. rkhunter --check
(clean)
2. dnf --refresh upgrade dnf
(nothing to do)
3. dnf upgrade
(no hint of trouble)
4. reboot
(no hint of trouble)
5. rkhunter --check
(trouble!)
I put the rkhunter log file on the google drive; here is the link:
"https://drive.google.com/file/d/1asJQhjhffxOklGivzFLeKV5-gaEVCwYX/view?us...".
The file properties checks warning are common after a weekly patching;
ignore those.
The first warning of concern is line #1470:
"[12:33:02] Checking for file '/lib/libkeyutils.so.1.9' [ Warning ]
[12:33:02] Checking for file '/lib64/libkeyutils.so.1.9' [ Warning ]
[12:33:02] Checking for file '/usr/lib/libkeyutils.so.1.9' [ Warning ]
[12:33:02] Checking for file '/usr/lib64/libkeyutils.so.1.9' [
Warning ]".
The next is in line #1602:
"[12:33:08] Warning: Checking for possible rootkit files and directories
[ Warning ]
[12:33:08] Found file '/lib/libkeyutils.so.1.9'. Possible
rootkit: Sniffer component
[12:33:08] Found file '/lib64/libkeyutils.so.1.9'. Possible
rootkit: Sniffer component
[12:33:08] Found file '/usr/lib/libkeyutils.so.1.9'. Possible
rootkit: Sniffer component
[12:33:08] Found file '/usr/lib64/libkeyutils.so.1.9'. Possible
rootkit: Sniffer component".
Both warnings above are in the section
"[12:32:58] Info: Starting test name 'possible_rkt_files'
[12:32:58] Performing check of possible rootkit files and directories",
which starts at line 1388.
Below this section are numerous other warnings about other processes
using suspicious files.
My workstation was clean;
I patched;
now rkhunter says my system is contaminated.
I had nothing else running during the scanning and patching except a
terminal (in which I did the patching), ksysguard, and xeyes.
Are the warnings actual problems or false alarms?
If the problems are real, how do I fix? Re-installing is impractical.
Are there contaminated packages in the repositories?
thanks,
Bill.
3 years, 2 months
Mail Reader -
by Bob Goodwin
I have Mil Reader listed in the menu on this computer. Can someone tell
me what the procedure is to make it read some text? Bob
--
Bob Goodwin - Zuni, Virginia, USA
FEDORA-32/64bit LINUX XFCE Fastmail POP3
3 years, 2 months
What does this smartd nonsense mean?
by Tom Horsley
In my logwatch this morning (for the first time that I remember):
--------------------- Smartd Begin ------------------------
**Unmatched Entries**
Device: /dev/nvme0, --capabilites is set, mail will be suppressed. : 2 time(s)
Device: /dev/nvme1, --capabilites is set, mail will be suppressed. : 2 time(s)
Device: /dev/nvme2, --capabilites is set, mail will be suppressed. : 2 time(s)
What on earth does that mean? Google didn't seem to find any
examples of that message.
3 years, 2 months
