kevin brosnan dot net

Detecting SSH logon attempts Ubuntu 9.10

December 22, 2009 at 5:26pm
tagged: , with 0 Comments

I've been running a SSH server on my Ubuntu box for several years. Lets see who has been trying to get in.

awk 'gsub(".*sshd.*Failed password for (invalid user )?", "") {print $1}' /var/log/auth.log* | sort | uniq -c | sort -rn | head -10

1153 root 
     43 test 
     23 linux 
     19 tester 
     19 guest 
     18 testing 
     17 administrator 
     15 roor 
     15 postfix 
     14 user

So has anyone but myself been able to log in...

awk 'gsub(".*sshd.*Accepted password for (valid user )?", "") {print $1}' /var/log/auth.log* | sort | uniq -c | sort -rn | head -2

17 Kevin_Brosnan

No, I'm the only user on the system using SSH. Good!

How often did the same IP try and access my computer?

 awk 'gsub(".*sshd.*Failed password for (invalid user )?", "") {print $3}' /var/log/auth.log* | sort | uniq -c | sort -rn | head -10

834 - 121.242.167.256 
    432 - 121.242.65.256 
    381 - 85.128.10.256 
    225 - 12.172.224.256 
    216 - 190.81.104.256 
    134 - 119.192.138.256 
     68 - 94.103.155.256 
     59 - 62.181.56.256 
     31 - 116.28.64.256 
     25 - 85.17.154.256

The first and last scripts I found at the Securing SSH Fedora guide and modified to work with the Ubuntu log files. Some data presented here has been partially anonymised.

Upgrading to Ubuntu 9.10 - Gave up waiting for root device

November 13, 2009 at 9:07pm
tagged: , with 0 Comments

I upgraded my trusty Ubuntu box the other week. Sadly all was not smooth. After the packages had been downloaded and upgraded I rebooted the box. Tried connecting to the box via SSH…no response…dug out a VGA cable and was greeted by the following.

Gave up waiting for root device
  Common problems:
    - Boot args (cat /proc/cmdline)
     Check rootdelay= (did the system wait long enough?)
     Check root= (did the system wait for the right device?)
    - missing modules (cat /proc/modules;  ls /dev) $drive_uuid

Alert! /dev/disk/by-uuid/$drive_uuid does not exist. Dropping to shell! setup=0x3400, size =0x3a9480]

initrd          /boot/initrd.img-2.6.31-14-386
  [linux-initrd @0x38b500, 0x837dc0 bytes]
BusyBox v1:1.13.3 (Ubuntu 1:1.13.3-1ubuntu7) built in shell (ash)

Enter help for a list of builtin commands.
(initramfs)

Unfortunately the suggested steps in the error message did not turn up anything useful. For those who can't read geek it suggests running the following commands.

cat /proc/cmdline

This will spit out some info, in this case I was interested in the UUID.

Check rootdelay= (did the system wait long enough?)

It is not mentioned in the error message but rootdelay is a GRUB option. It tells the computer how long to wait in seconds before looking for boot devices. Try adding or increasing the number given in /boot/grub/menu.lst by editing the kernel lines of the file. This did not help in my case.

kernel /boot/vmlinuz-2.6.31-14-386 root=UUID=1c64e5c6-750c-4687-fcec-89906c8a46b3 ro quiet splash rootdelay=30

The next thing it says to check is the root values in GRUB. From my /boot/grub/menu.lst I got.

root (hd0,0)

In my case this is still an IDE hard drive so I know the device is on the primary channel and is the master so this checks out. I then checked the UUID listed for the hard drive in the error message, GRUB ( cat /boot/grub/menu.lst), and cat /proc/cmdline. Alas all these matched.

Poking around the GRUB menu.lst file I noticed that the lines to boot the 9.04 kernel (linux-image-2.6.28-16) were still present. Testing these I found that the recovery mode option worked and gave me access to my hard drive. Small step forward. Something was wrong with GRUB and I set about to find how to reinstall it. My Google-fu was strong and shortly I found grub-install --recheck /dev/sda. Running the grub-install resulted in a message that the filesystem was read only. This is easily solvable by mount -o remount, rw /. Rebooted once more and was greeted by the 9.10 boot splash screen…finally.

Summary

I was able to fix the problem by running the following commands in the 9.04 recovery shell. Using a Ubuntu bootable CD should also work.

mount -o remount, rw /
grub-install --recheck /dev/sda

Hide ‘Search Bookmarks and History’ in Firefox’s address bar

July 9, 2009 at 12:00am
tagged: , with 0 Comments

A Firefox user in #firefox asked if you can hide the grey text ‘Seach Bookmarks and History’ in the address bar. screenshot of Firefox showing the text I created the following userChrome.css code that hides the text by turning it white. If you use a dark theme you should change the color: line to match the address bar color.
@namespace url("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"); textbox[empty="true"] .textbox-input-box { -moz-appearance: none !important; color: #fff !important; } screenshot of Firefox showing the userChrome.css applied

Ubuntu New Wave GTK theme and Firefox

April 24, 2009 at 11:01pm
tagged: , with 1 Comment

I upgraded to Ubuntu 9.04 yesterday and one of the new features is a theme called New Wave. Here is what the file browser looks like.

Nautilus file browser displaying the New Wave theme

Upon starting Firefox I was greeted by black text on a grey menu bar.

Firefox browser displaying the New Wave theme

Thankfully Firefox can be customized with CSS by creating a userChrome.css file in the chrome folder of your Firefox profile.

Firefox browser displaying the New Wave theme with the userChrome.css fix

The userChrome.css code

@namespace url("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"); /* set default namespace to XUL */

/* menu toolbar text color */
menu > label.menubar-text {
  color: #fff !important;
  -moz-appearance: none !important;
}
/* menu toolbar text color when menu is open */
menu[open="true"] > label.menubar-text {
  color: #1A1A1A !important;
  -moz-appearance: none !important;
}

This fix also works on Komodo Edit 5.1 and SeaMonkey 2.

Mozilla build error: Ogg support on Linux requires the alsa library

August 16, 2008 at 5:20pm
tagged: , with 3 Comments

checking MOZ_PANGO_LIBS... -lpangocairo-1.0 -lcairo -lpangoft2-1.0 -lpango-1.0 -lfreetype -lz -lfontconfig -lgobject-2.0 -lgmodule-2.0 -ldl -lglib-2.0  
checking for gnome-vfs-2.0 >= 2.0 gnome-vfs-module-2.0 >= 2.0... checking for gconf-2.0 >= 1.2.1... checking for libgnome-2.0 >= 2.0... checking for libgnomeui-2.0 >= 2.2.0... checking for dbus-glib-1 >= 0.60... yes
checking MOZ_DBUS_GLIB_CFLAGS... -I/usr/include/dbus-1.0 -I/usr/lib/dbus-1.0/include -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include  
checking MOZ_DBUS_GLIB_LIBS... -ldbus-glib-1 -ldbus-1 -lgobject-2.0 -lglib-2.0  
checking for snd_pcm_open in -lasound... no
configure: error: Ogg support on Linux requires the alsa library
*** Fix above errors and then restart with "make -f client.mk build"
make[1]: *** [configure] Error 1

Disable OGG support in your .mozconfig via

ac_add_options --disable-ogg

. If you want OGG support install libasound2-dev via

sudo apt-get install libasound2-dev

Main Pages

Home