webadmin-list — Webmin users mailing list

Re: [webmin-l] cannot start webmin

[Jamie C. <jca...@we...>]

On 9/Sep/2006 00:35 si...@km... wrote ..
> 
> Hi all,
> 
> I had installed webmin and was workin fine and was using it
> but now when i try to run it as usual http://ip address:port it says page
> cannot be displayed
> i had changed the default port of 10000 to 8080 but i still wanna check
> if
> thats the port i used.
> i need to know which file hold the port value i used at the installtion
> time so i can be sure and how can i change the port value without goin
> through the install program

You can see which port is in use by looking at the port= line in 
/etc/webmin/miniserv.conf. To make sure this has actually been applied,
run the commands /etc/webmin/stop ; /etc/webmin/start as root at the
shell prompt..

 - Jamie

Re: [webmin-l] etc/skel dont copy files

[Jamie C. <jca...@we...>]

On 9/Sep/2006 00:31 Petros Pap wrote ..
> Hello there
> I am new to webmin and i have install both webmin 1290, 1.297 in
> suse10, with 1.297 when i add new user don't copy files from etc/skel
> to new home directory.

Thanks for pointing this out - it is a bug in the 1.297 development
version, which I'll fix in the upcoming 1.300 release.

> Also i have small problem writing el - gr  with file manager, is any
> easy solution for this or you can point me what i have to look and try
> to change so i can write Greeks.
> Thank you in advise

I'm afraid I don't have experience with this, sorry ..

 - Jamie

[webmin-l] etc/skel dont copy files

[Petros P. <pp...@gm...>]

Hello there
I am new to webmin and i have install both webmin 1290, 1.297 in
suse10, with 1.297 when i add new user don't copy files from etc/skel
to new home directory.
Also i have small problem writing el - gr  with file manager, is any
easy solution for this or you can point me what i have to look and try
to change so i can write Greeks.
Thank you in advise
-- 
ppetros

[webmin-l] cannot start webmin

[<si...@km...>]

Hi all,

I had installed webmin and was workin fine and was using it
but now when i try to run it as usual http://ip address:port it says page
cannot be displayed
i had changed the default port of 10000 to 8080 but i still wanna check if
thats the port i used.
i need to know which file hold the port value i used at the installtion
time so i can be sure and how can i change the port value without goin
through the install program


Thanks and regards


Simon

Re: [webmin-l] Hundreds of cron /usr/bin/monitor.sh notifications followed by server crash

[<pr...@pr...>]

From: Prodos

Good afternoon.

First of all, many thanks to John Hinton who helped me
out with this problem both on this list and off-list.

Since getting this problem fixed is beyond my
(pathetically meagre) technical expertise I ended
up having to hire a Linux expert to do the remaining 
trouble-shooting and fixing.

It looks like John was spot on with his diagnosis.

There was some program on one of my sites that
was allowing some idiot to use it for spamming
and crashing my server - which cost me a lot of
time and money that I couldn't really afford to spend.

Grrrrrr. [Much seething and cussing.]

Well, back to work now.

The Late Crocodile Man taught us to keep smiling.

It's the Aussie thing to do!

=]:-)

Best Wishes,

PRODOS

http://prodos.thinkertothinker.com

Have a hug. Read Atlas Shrugged.

Re: [webmin-l] rollbacl in webminlog/acl_security.pl ?

[Jamie C. <jca...@we...>]

On 8/Sep/2006 16:40 Noah Romer wrote ..
> Is line 43 of webminlog/acl_security.pl really supposed to be referencing
> $_[0]->{'rollbacl'} ? There's no key by that name in the hash, though there
> is a key named 'rollback'.

You're right, that is a bug .. I'll fix it in the next release of Webmin.

 - Jamie

[webmin-l] rollbacl in webminlog/acl_security.pl ?

[Noah R. <nr...@wa...>]

Is line 43 of webminlog/acl_security.pl really supposed to be referencing 
$_[0]->{'rollbacl'} ? There's no key by that name in the hash, though there 
is a key named 'rollback'.

Thanks,
Noah
-- 
Noah Romer <nr...@wa...>
GPG Key Fingerprint: 944E C2F8 EBEC BCC7 EEA9  9381 1B21 0098 CC8D 45BA
The information transmitted may contain confidential material and is intended only for the person or entity to which it is addressed. If you are not the intended recipient, please delete the information from your system and contact the sender.



This message has been scanned for compliance violations by the Defender e-mail appliance, powered by WaLaSystems. For more information, visit www.WaLaSystems.com 

Re: [webmin-l] Unusual Error

[Terry A. <hm...@oz...>]

>On 8/Sep/2006 15:07 Terry Allen wrote ..
>>  Hi again,
>>	In the Webmin logs, I spotted a couple of these attempts earlier today:
>>
>>  [20/Aug/2006:20:44:55 +1000] [66.160.144.222]
>> 
>>/unauthenticated//..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/etc/shadow
>>  : File not found
>>
>>  [20/Aug/2006:20:44:58 +1000] [66.160.144.222]
>> 
>>/unauthenticated/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
//etc/passwd
>>  : File not found
>>
>>	Now the log quite clearly states that the file wasn't found,
>>  but not having seen these before, I wonder is there anything I need
>>  to nail down or what they are trying to achieve apart from trying to
>>  get at the /etc files?
>
>Just make sure you are running Webmin 1.290 or later. If you had an
>older version, this attack may have managed to read your /etc/shadow
>file (in which case it wouldn't have reported 'file not found').
>
>  - Jamie
>
Hi again,
	Indeed, I am running 1.290. Quite a bizarre line.
-- 

	Bye for now, Terry Allen 
	___________________________________________________________________
hEARd

Postal Address:
	hEARd, 26B Glenning Rd,	Glenning Valley, NSW 2261, Australia
Internet -
	WWW: http://heard.com.au http://itavservices.com
EMAIL: hm...@oz...
Phone: Australia - 02 4388 1400 / International - + 61 2 43881400
Mobile: Australia - 04 28881400 / International - 61 4 28881400
-----------------------------------------------
Non profit promotion for new music - since 1994
-----------------------------------------------

Re: [webmin-l] Unusual Error

[Jamie C. <jca...@we...>]

On 8/Sep/2006 15:07 Terry Allen wrote ..
> Hi again,
> 	In the Webmin logs, I spotted a couple of these attempts earlier today:
> 
> [20/Aug/2006:20:44:55 +1000] [66.160.144.222] 
> /unauthenticated//..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/etc/shadow
> : File not found
> 
> [20/Aug/2006:20:44:58 +1000] [66.160.144.222] 
> /unauthenticated/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
//etc/passwd
> : File not found
> 
> 	Now the log quite clearly states that the file wasn't found, 
> but not having seen these before, I wonder is there anything I need 
> to nail down or what they are trying to achieve apart from trying to 
> get at the /etc files?

Just make sure you are running Webmin 1.290 or later. If you had an
older version, this attack may have managed to read your /etc/shadow
file (in which case it wouldn't have reported 'file not found').

 - Jamie

[webmin-l] Unusual Error

[Terry A. <hm...@oz...>]

Hi again,
	In the Webmin logs, I spotted a couple of these attempts earlier today:

[20/Aug/2006:20:44:55 +1000] [66.160.144.222] 
/unauthenticated//..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/etc/shadow 
: File not found

[20/Aug/2006:20:44:58 +1000] [66.160.144.222] 
/unauthenticated/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
/..
//etc/passwd 
: File not found

	Now the log quite clearly states that the file wasn't found, 
but not having seen these before, I wonder is there anything I need 
to nail down or what they are trying to achieve apart from trying to 
get at the /etc files?
-- 

	Bye for now, Terry Allen 
	___________________________________________________________________
hEARd

Postal Address:
	hEARd, 26B Glenning Rd,	Glenning Valley, NSW 2261, Australia
Internet -
	WWW: http://heard.com.au http://itavservices.com
EMAIL: hm...@oz...
Phone: Australia - 02 4388 1400 / International - + 61 2 43881400
Mobile: Australia - 04 28881400 / International - 61 4 28881400
-----------------------------------------------
Non profit promotion for new music - since 1994
-----------------------------------------------

Re: [webmin-l] How do webmin authenticates the users

[Jamie C. <jca...@we...>]

On 7/Sep/2006 00:36 Lei, Zhi Yong wrote ..
> Hi 
> I have a question of how webmin check the user is legal or not.
> I installed webmin 1.290 source code
> 
> I found that the server code (miniserv.pl) will call following code to
> generate the login web page:
> sub run_login_script
> {
> if ($config{'login_script'}) {
> 	system($config{'login_script'}.
> 	       " ".join(" ", map { quotemeta($_) } @_).
> 	       " >/dev/null 2>&1 </dev/null");
> 	}
> }

Actually, that function is for running a command after the user logs in.
It is not used by default, but was added to support sites that want to do
their own additional logging or whatever..

> now the case is I can't find where is the code in session_login.cgi to
> authenticate users. 
> in another words: i cann't understand how did webmin switch from login
> page to the main page if the users if legal and corretly inputed
> username and password,
> 
> the code in session_login.cgi :
> print "$text{'session_prefix'}\n";
> print "<form action=$gconfig{'webprefix'}/session_login.cgi
> method=post>\n";
> print "<input type=hidden name=page
> value='".&html_escape($in{'page'})."'>\n";
> print "<table border width=40%>\n";
> print "<tr $tb> <td><b>$text{'session_header'}</b></td> </tr>\n";
> print "<tr $cb> <td align=center><table cellpadding=3>\n";
> 
> the above code shows that after the user click login , the corresponding
> cgi script is still session_login.cgi , but i can't find the
> authenticate code
> in this file .and i am confused  :
>  after executing the session_login.cgi , which cgi file will be executed
> immediatelly by webmin ?

session_login.cgi actually just generates the login page. The real code for
authentication users is in miniserv.pl, starting at line 1134. It checks
various password files, PAM and configuration settings related to allowed users..

 - Jamie

[webmin-l] How do webmin authenticates the users

[Lei, Z. Y. <zhi...@in...>]

Hi=20
I have a question of how webmin check the user is legal or not.
I installed webmin 1.290 source code

I found that the server code (miniserv.pl) will call following code to
generate the login web page:
sub run_login_script
{
if ($config{'login_script'}) {
	system($config{'login_script'}.
	       " ".join(" ", map { quotemeta($_) } @_).
	       " >/dev/null 2>&1 </dev/null");
	}
}
=20
now the case is I can't find where is the code in session_login.cgi to
authenticate users.=20
in another words: i cann't understand how did webmin switch from login
page to the main page if the users if legal and corretly inputed
username and password,

the code in session_login.cgi :
print "$text{'session_prefix'}\n";
print "<form action=3D$gconfig{'webprefix'}/session_login.cgi
method=3Dpost>\n";
print "<input type=3Dhidden name=3Dpage
value=3D'".&html_escape($in{'page'})."'>\n";
print "<table border width=3D40%>\n";
print "<tr $tb> <td><b>$text{'session_header'}</b></td> </tr>\n";
print "<tr $cb> <td align=3Dcenter><table cellpadding=3D3>\n";

the above code shows that after the user click login , the corresponding
cgi script is still session_login.cgi , but i can't find the
authenticate code
in this file .and i am confused  :
 after executing the session_login.cgi , which cgi file will be executed
immediatelly by webmin ?


best regards .
Alex lei.

Re: [webmin-l] Hundreds of cron /usr/bin/monitor.sh notifications followed by server crash

[<pr...@pr...>]

From: Prodos
To: John Hinton

Dear John,

Good morning.

Thank you for your detailed notes (below).

I'll do my best to see if I can follow them when I get
back this afternoon.

By the way, over the last 12 hours my server
crashed twice (!!)

Question: Would you or someone else on this list be
willing to enter my WEBMIN and have a look around to
see if the problem can be located and fixed?

If so, how much would you charge, please?

Thanks very much for your help.

Best Wishes,

PRODOS

http://prodos.thinkertothinker.com

Have a hug. Read Atlas Shrugged.


> -------- Original Message --------
> Subject: Re: [webmin-l] Hundreds of cron /usr/bin/monitor.sh
> notifications followed by server crash
> From: John Hinton <web...@ew...>
> Date: Wed, September 06, 2006 11:19 pm
> To: Webmin users list <web...@li...>
> 
> pr...@pr... wrote:
> > From: Prodos
> > To: John Hinton
> >
> > Dear John,
> >
> > Howdy! Thanks for your reply ....
> >
> >
> >
> >   
> >> Is this under Sendmail in logwatch?
> >>     
> >
> >
> > Yes! Here is how it goes ...
> >
> >
> > [Below: From my logwatch]
> >   
> >>  --------------------- sendmail Begin ------------------------ 
> >>
> >>
> >>
> >> 12 messages returned after 4 hours
> >>
> >> 169 unidentified unknown users
> >>
> >> Connections Rejected due to load average::
> >>     Load Avg 12: 111 Times(s)
> >>     Load Avg 13: 51 Times(s)
> >>     Load Avg 131: 1 Times(s)
> >>     Load Avg 14: 59 Times(s)
> >>     Load Avg 15: 41 Times(s)
> >>     Load Avg 16: 23 Times(s)
> >>     Load Avg 17: 24 Times(s)
> >>     Load Avg 18: 19 Times(s)
> >>     Load Avg 19: 14 Times(s) 
> >>     
> >
> >
> > [Above: From my logwatch.]
> >   
> Something is causing very high server loads. Your Sendmail is set to 
> stop accepting email when the load hits 12, which is a pretty good place 
> to let it do that. You need to find out what is causing these high 
> server loads.. Generally server loads of 3 are OK, with spikes up from 
> there being acceptable. I personally like to have my systems run below 1 
> during normal load times. Things that will run server loads up are 
> oftentimes email related. SpamAssassin, ClamAV and the various 
> spam/virus filtering systems. When high loads of incoming email hit, 
> serverloads rise on a normal system. If a spammer sends out a bulk 
> message that might be hitting a bunch of your domains at once and 
> perhaps many email addresses good or bad for those domains, loads go up.
> 
> But, these loads are by no means limited to mail systems.
> 
> Most Redhat flavors have an application called top. From the command 
> line you just enter top. It will display server loads, disk IO, 
> processor and user loads and a list of processes which are active. It 
> refreshes at a set interval. I think it defaults to like 5 seconds. This 
> gives you an overview of what's happening on a system. You can leave it 
> running for a while, to see if loads are just hitting spikes or if they 
> are constantly high. Also, you can see if it's twenty mail functions or 
> most of the important processes that might be eating up resources.
> 
> Another program available in Redhat flavors is sar. It is not installed 
> by default, but I normally do install it. This program takes a snapshot 
> reading every ten minutes and holds the output for the current day, 
> which is a good way to establish normal operation.
> 
> The reason I pointed to email to start with, is because oftentimes it is 
> a compromised server which is sending spam and loads spike.
> 
> Within Webmin, you can go to System -> Running Processes and use the 
> various sort functions to see whats eating your resources. Note that as 
> you switch the order of display, webmin will show up at the top as it is 
> running to create that new display. Also, at the top of that page CPU 
> load averages are shown for the last 1 minute, 5 minutes and 15 minutes. 
> You may need to check this with some frequency to see those loads 
> change.. again, to determine if these are just spikes or if the load 
> stays high.
> 
> Best,
> John Hinton
> 
> -------------------------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> -
> Forwarded by the Webmin mailing list at web...@li...
> To remove yourself from this list, go to
> http://lists.sourceforge.net/lists/listinfo/webadmin-list

Re: [webmin-l] Webmin users authenticating via PAM

[<fr...@ci...>]

Yikes - that was my very first thought, yet I think I managed to forget t=
o
cycle webmin after I tried that.  Works fine now.  Oops.

Thanks!

> There is your problem ... there are no references to pam_ldap.so in tha=
t
> file.
> You should copy /etc/pam.d/sshd to webmin , and then restart the Webmin
> server.
>
>  - Jamie
>
> On 6/Sep/2006 15:09 Fran Fabrizio wrote ..
>>
>> I should also add that Authen::PAM is installed, and the pam config fi=
le
>> looks like:
>>
>> #%PAM-1.0
>> auth    required        pam_unix.so     nullok
>> account required        pam_unix.so
>> session required        pam_unix.so
>>
>> Thanks,
>> Fran
>>
>> Fran Fabrizio wrote:
>> > For some reason, I cannot get Webmin users with PAM-based password
>> > authentication to LDAP working on my install.  Our LDAP-based users
>> are
>> > able to log into the server that hosts Webmin, but not Webmin itself
>> > when I configure them as Use Unix Authentication.
>> >
>> > The particulars:
>> >
>> > - Fedora Core 4 with webmin-1.280-1 RPM
>> > - PAM configured via authconfig to authenticate users to LDAP, which
>> > works for logging into the server itself
>> > - In Webmin Configuration -> Authentication, I've selected Use PAM f=
or
>> > Unix authentication
>> > - In Webmin Users, I've entered the names of 3 accounts known to exi=
st
>> > in LDAP and which work for logging into the server itself.  I've set
>> > these accounts to Use UNIX authentication.
>> > - IP access control is configured to allow from all addresses
>> >
>> > The LDAP-based logins all fail, with just a simple "invalid login fr=
om
>> > user fran from ip x.x.x.x" message in the /var/log/secure log file.
>> > Logins for users local to the server (namely, root) work fine.
>> >
>> > Anyone know 1. what I am missing and 2. how to turn on more verbose
>> logging?
>> >
>> > Thanks!
>> >
>> > -Fran
>> >
>>
>>
>> --
>> Fran Fabrizio
>> Senior Systems Analyst
>> Department of Computer and Information Sciences
>> University of Alabama at Birmingham
>> http://www.cis.uab.edu/
>> 205.934.0653
>>
>> ----------------------------------------------------------------------=
---
>> Using Tomcat but need to do more? Need to support web services,
>> security?
>> Get stuff done quickly with pre-integrated technology to make your job
>> easier
>> Download IBM WebSphere Application Server v.1.0.1 based on Apache
>> Geronimo
>> http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D120709&bid=3D263057&da=
t=3D121642
>> -
>> Forwarded by the Webmin mailing list at
>> web...@li...
>> To remove yourself from this list, go to
>> http://lists.sourceforge.net/lists/listinfo/webadmin-list
>
> -----------------------------------------------------------------------=
--
> Using Tomcat but need to do more? Need to support web services, securit=
y?
> Get stuff done quickly with pre-integrated technology to make your job
> easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geron=
imo
> http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D120709&bid=3D263057&dat=
=3D121642
> -
> Forwarded by the Webmin mailing list at
> web...@li...
> To remove yourself from this list, go to
> http://lists.sourceforge.net/lists/listinfo/webadmin-list
>

Re: [webmin-l] Webmin users authenticating via PAM

[Jamie C. <jca...@we...>]

There is your problem ... there are no references to pam_ldap.so in that file.
You should copy /etc/pam.d/sshd to webmin , and then restart the Webmin server.

 - Jamie

On 6/Sep/2006 15:09 Fran Fabrizio wrote ..
> 
> I should also add that Authen::PAM is installed, and the pam config file
> looks like:
> 
> #%PAM-1.0
> auth    required        pam_unix.so     nullok
> account required        pam_unix.so
> session required        pam_unix.so
> 
> Thanks,
> Fran
> 
> Fran Fabrizio wrote:
> > For some reason, I cannot get Webmin users with PAM-based password 
> > authentication to LDAP working on my install.  Our LDAP-based users are
> > able to log into the server that hosts Webmin, but not Webmin itself
> > when I configure them as Use Unix Authentication.
> > 
> > The particulars:
> > 
> > - Fedora Core 4 with webmin-1.280-1 RPM
> > - PAM configured via authconfig to authenticate users to LDAP, which
> > works for logging into the server itself
> > - In Webmin Configuration -> Authentication, I've selected Use PAM for
> > Unix authentication
> > - In Webmin Users, I've entered the names of 3 accounts known to exist
> > in LDAP and which work for logging into the server itself.  I've set
> > these accounts to Use UNIX authentication.
> > - IP access control is configured to allow from all addresses
> > 
> > The LDAP-based logins all fail, with just a simple "invalid login from
> > user fran from ip x.x.x.x" message in the /var/log/secure log file. 
> > Logins for users local to the server (namely, root) work fine.
> > 
> > Anyone know 1. what I am missing and 2. how to turn on more verbose logging?
> > 
> > Thanks!
> > 
> > -Fran
> > 
> 
> 
> -- 
> Fran Fabrizio
> Senior Systems Analyst
> Department of Computer and Information Sciences
> University of Alabama at Birmingham
> http://www.cis.uab.edu/
> 205.934.0653
> 
> -------------------------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job
> easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> -
> Forwarded by the Webmin mailing list at web...@li...
> To remove yourself from this list, go to
> http://lists.sourceforge.net/lists/listinfo/webadmin-list

Re: [webmin-l] Webmin users authenticating via PAM

[Fran F. <fr...@ci...>]

I should also add that Authen::PAM is installed, and the pam config file 
looks like:

#%PAM-1.0
auth    required        pam_unix.so     nullok
account required        pam_unix.so
session required        pam_unix.so

Thanks,
Fran

Fran Fabrizio wrote:
> For some reason, I cannot get Webmin users with PAM-based password 
> authentication to LDAP working on my install.  Our LDAP-based users are 
> able to log into the server that hosts Webmin, but not Webmin itself 
> when I configure them as Use Unix Authentication.
> 
> The particulars:
> 
> - Fedora Core 4 with webmin-1.280-1 RPM
> - PAM configured via authconfig to authenticate users to LDAP, which 
> works for logging into the server itself
> - In Webmin Configuration -> Authentication, I've selected Use PAM for 
> Unix authentication
> - In Webmin Users, I've entered the names of 3 accounts known to exist 
> in LDAP and which work for logging into the server itself.  I've set 
> these accounts to Use UNIX authentication.
> - IP access control is configured to allow from all addresses
> 
> The LDAP-based logins all fail, with just a simple "invalid login from 
> user fran from ip x.x.x.x" message in the /var/log/secure log file. 
> Logins for users local to the server (namely, root) work fine.
> 
> Anyone know 1. what I am missing and 2. how to turn on more verbose logging?
> 
> Thanks!
> 
> -Fran
> 


-- 
Fran Fabrizio
Senior Systems Analyst
Department of Computer and Information Sciences
University of Alabama at Birmingham
http://www.cis.uab.edu/
205.934.0653

[webmin-l] Webmin users authenticating via PAM

[Fran F. <fr...@ci...>]

For some reason, I cannot get Webmin users with PAM-based password 
authentication to LDAP working on my install.  Our LDAP-based users are 
able to log into the server that hosts Webmin, but not Webmin itself 
when I configure them as Use Unix Authentication.

The particulars:

- Fedora Core 4 with webmin-1.280-1 RPM
- PAM configured via authconfig to authenticate users to LDAP, which 
works for logging into the server itself
- In Webmin Configuration -> Authentication, I've selected Use PAM for 
Unix authentication
- In Webmin Users, I've entered the names of 3 accounts known to exist 
in LDAP and which work for logging into the server itself.  I've set 
these accounts to Use UNIX authentication.
- IP access control is configured to allow from all addresses

The LDAP-based logins all fail, with just a simple "invalid login from 
user fran from ip x.x.x.x" message in the /var/log/secure log file. 
Logins for users local to the server (namely, root) work fine.

Anyone know 1. what I am missing and 2. how to turn on more verbose logging?

Thanks!

-Fran

-- 
Fran Fabrizio
Senior Systems Analyst
Department of Computer and Information Sciences
University of Alabama at Birmingham
http://www.cis.uab.edu/
205.934.0653

Re: [webmin-l] Hundreds of cron /usr/bin/monitor.sh notifications followed by server crash

[<da...@so...>]

Hey, thanks for the heads up on the "top" function. I didn't know 
about it and it's really useful. It even breaks out the process load  
across each of the CPUs so you can keep a status.

Sometimes monitoring someone else's question is useful ;-)


>> we return to your regularly scheduled programing<<

Date sent:      	Wed, 06 Sep 2006 10:50:56 -0400
From:           	Kris Deugau <kd...@vi...>
Organization:   	ViaNet Internet Solutions
To:             	Webmin users list <web...@li...>
Subject:        	Re: [webmin-l] Hundreds of cron /usr/bin/monitor.sh notifications
	followed by server crash
Send reply to:  	Webmin users list <web...@li...>
	<mailto:web...@li...?subject=unsubscribe>
	<mailto:web...@li...?subject=subscribe>

[ Double-click this line for list subscription options ] 

pr...@pr... wrote:
> [John:]
> 
>> If so, you have a very bad email 
>>problem going on... or something using up all the resources and 
Sendmail 
>>is gracefully allowing the other stuff to run....

> Sorry, I don't know what that means.

Literally, it means exactly what is says.  Either something is flooding 
sendmail with SMTP connections, or some other process or set of 
processes is/are hogging CPU/memory/disk (pick any one or more 
of the 
three - you'll need to investigate further) causing sendmail's load 
limits to activate and stop it from attempting to process more mail.

>>What does top or sar show for load averages over time?

> Ehm ... sorry, I don't know what that means.

Again, exactly what it says.  top is one program you can use in a 
shell 
to watch what processes are running on your system in realtime.  
sar is 
probably another;  I'm not familiar with it.

> Is that information in my logwatch? I couldn't see it.

Logwatch reports are WAY too late and far too condensed to be 
much use 
in tracking down what's actually happening.  (Among other things, all 
of 
the timestamps are stripped off, so you can't tell *when* something 
happened.)

> I can forward you the complete logwatch email privately if you like.
> But it's a long S.O.B. - and of course I don't want to waste your 
time.
> 
> Or do I find this information within my WEBMIN?

This isn't really a problem that can be usefully solved within 
Webmin, 
unless there's a Java-based monitoring module I don't know about. 
(Possible, but unlikely.)  You need to watch what's happening in 
realtime, without the filtering that logwatch needs to do so you don't 
just get a raw copy of all of your logs for the day.

Your basic problem is that for some reason, your server is trying to 
do 
too much at once for some indefinite amount of time, causing 
sendmail's 
load average restrictions to activate.

In order to get useful data, you'll have to sit and watch what's 
happening on your server in realtime - even digging through log files 
will only give you a partial picture.

Some things you can do to see what's going on are:
- Manually examine the mail log to see if you're getting flooded with 
SMTP connections around the times sendmail's load restrictions 
activate
- Check your other logs for the times sendmail has started rejecting 
connections to see what's going on with other processes
- Watch active processes with top running in a shell window.  A 
second 
window showing memory usage instead of CPU might be helpful;  
most 
problems I've encountered like this were due to memory starvation 
rather 
than CPU limits.  (Adding swap will NOT help, it just delays the 
inevitable, and often makes the problem worse when it shows up.)

Given that your server is crashing, you may need to temporarily 
disable 
one or more services as a brute-force way to discover which one is 
getting "attacked" (whether this is a real attack is another question).

-kgd

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, 
security?
Get stuff done quickly with pre-integrated technology to make your 
job easier
Download IBM WebSphere Application Server v.1.0.1 based on 
Apache Geronimo
http://sel.as-
us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
-
Forwarded by the Webmin mailing list at webadmin-
li...@li...
To remove yourself from this list, go to
http://lists.sourceforge.net/lists/listinfo/webadmin-list
******************************************************************************
***
Domains by SolvNet
http://solvnetdomains.com

Be a domain reseller and make cash
http://domainmiddleman.com

Domain name registration and hosting solutions.

http://solvnethosting.com

Re: [webmin-l] Hundreds of cron /usr/bin/monitor.sh notifications followed by server crash

[Kris D. <kd...@vi...>]

pr...@pr... wrote:
> [John:]
> 
>> If so, you have a very bad email 
>>problem going on... or something using up all the resources and Sendmail 
>>is gracefully allowing the other stuff to run....

> Sorry, I don't know what that means.

Literally, it means exactly what is says.  Either something is flooding 
sendmail with SMTP connections, or some other process or set of 
processes is/are hogging CPU/memory/disk (pick any one or more of the 
three - you'll need to investigate further) causing sendmail's load 
limits to activate and stop it from attempting to process more mail.

>>What does top or sar show for load averages over time?

> Ehm ... sorry, I don't know what that means.

Again, exactly what it says.  top is one program you can use in a shell 
to watch what processes are running on your system in realtime.  sar is 
probably another;  I'm not familiar with it.

> Is that information in my logwatch? I couldn't see it.

Logwatch reports are WAY too late and far too condensed to be much use 
in tracking down what's actually happening.  (Among other things, all of 
the timestamps are stripped off, so you can't tell *when* something 
happened.)

> I can forward you the complete logwatch email privately if you like.
> But it's a long S.O.B. - and of course I don't want to waste your time.
> 
> Or do I find this information within my WEBMIN?

This isn't really a problem that can be usefully solved within Webmin, 
unless there's a Java-based monitoring module I don't know about. 
(Possible, but unlikely.)  You need to watch what's happening in 
realtime, without the filtering that logwatch needs to do so you don't 
just get a raw copy of all of your logs for the day.

Your basic problem is that for some reason, your server is trying to do 
too much at once for some indefinite amount of time, causing sendmail's 
load average restrictions to activate.

In order to get useful data, you'll have to sit and watch what's 
happening on your server in realtime - even digging through log files 
will only give you a partial picture.

Some things you can do to see what's going on are:
- Manually examine the mail log to see if you're getting flooded with 
SMTP connections around the times sendmail's load restrictions activate
- Check your other logs for the times sendmail has started rejecting 
connections to see what's going on with other processes
- Watch active processes with top running in a shell window.  A second 
window showing memory usage instead of CPU might be helpful;  most 
problems I've encountered like this were due to memory starvation rather 
than CPU limits.  (Adding swap will NOT help, it just delays the 
inevitable, and often makes the problem worse when it shows up.)

Given that your server is crashing, you may need to temporarily disable 
one or more services as a brute-force way to discover which one is 
getting "attacked" (whether this is a real attack is another question).

-kgd

Re: [webmin-l] Hundreds of cron /usr/bin/monitor.sh notifications followed by server crash

[John H. <web...@ew...>]

pr...@pr... wrote:
> From: Prodos
> To: John Hinton
>
> Dear John,
>
> Howdy! Thanks for your reply ....
>
>
>
>   
>> Is this under Sendmail in logwatch?
>>     
>
>
> Yes! Here is how it goes ...
>
>
> [Below: From my logwatch]
>   
>>  --------------------- sendmail Begin ------------------------ 
>>
>>
>>
>> 12 messages returned after 4 hours
>>
>> 169 unidentified unknown users
>>
>> Connections Rejected due to load average::
>>     Load Avg 12: 111 Times(s)
>>     Load Avg 13: 51 Times(s)
>>     Load Avg 131: 1 Times(s)
>>     Load Avg 14: 59 Times(s)
>>     Load Avg 15: 41 Times(s)
>>     Load Avg 16: 23 Times(s)
>>     Load Avg 17: 24 Times(s)
>>     Load Avg 18: 19 Times(s)
>>     Load Avg 19: 14 Times(s) 
>>     
>
>
> [Above: From my logwatch.]
>   
Something is causing very high server loads. Your Sendmail is set to 
stop accepting email when the load hits 12, which is a pretty good place 
to let it do that. You need to find out what is causing these high 
server loads.. Generally server loads of 3 are OK, with spikes up from 
there being acceptable. I personally like to have my systems run below 1 
during normal load times. Things that will run server loads up are 
oftentimes email related. SpamAssassin, ClamAV and the various 
spam/virus filtering systems. When high loads of incoming email hit, 
serverloads rise on a normal system. If a spammer sends out a bulk 
message that might be hitting a bunch of your domains at once and 
perhaps many email addresses good or bad for those domains, loads go up.

But, these loads are by no means limited to mail systems.

Most Redhat flavors have an application called top. From the command 
line you just enter top. It will display server loads, disk IO, 
processor and user loads and a list of processes which are active. It 
refreshes at a set interval. I think it defaults to like 5 seconds. This 
gives you an overview of what's happening on a system. You can leave it 
running for a while, to see if loads are just hitting spikes or if they 
are constantly high. Also, you can see if it's twenty mail functions or 
most of the important processes that might be eating up resources.

Another program available in Redhat flavors is sar. It is not installed 
by default, but I normally do install it. This program takes a snapshot 
reading every ten minutes and holds the output for the current day, 
which is a good way to establish normal operation.

The reason I pointed to email to start with, is because oftentimes it is 
a compromised server which is sending spam and loads spike.

Within Webmin, you can go to System -> Running Processes and use the 
various sort functions to see whats eating your resources. Note that as 
you switch the order of display, webmin will show up at the top as it is 
running to create that new display. Also, at the top of that page CPU 
load averages are shown for the last 1 minute, 5 minutes and 15 minutes. 
You may need to check this with some frequency to see those loads 
change.. again, to determine if these are just spikes or if the load 
stays high.

Best,
John Hinton

Re: [webmin-l] Hundreds of cron /usr/bin/monitor.sh notifications followed by server crash

[<pr...@pr...>]

From: Prodos
To: John Hinton

Dear John,

Howdy! Thanks for your reply ....



> Is this under Sendmail in logwatch?


Yes! Here is how it goes ...


[Below: From my logwatch]
>  --------------------- sendmail Begin ------------------------ 
> 
> 
> 
> 12 messages returned after 4 hours
> 
> 169 unidentified unknown users
> 
> Connections Rejected due to load average::
>     Load Avg 12: 111 Times(s)
>     Load Avg 13: 51 Times(s)
>     Load Avg 131: 1 Times(s)
>     Load Avg 14: 59 Times(s)
>     Load Avg 15: 41 Times(s)
>     Load Avg 16: 23 Times(s)
>     Load Avg 17: 24 Times(s)
>     Load Avg 18: 19 Times(s)
>     Load Avg 19: 14 Times(s) 


[Above: From my logwatch.]



[John:]
>  If so, you have a very bad email 
> problem going on... or something using up all the resources and Sendmail 
> is gracefully allowing the other stuff to run....


Sorry, I don't know what that means.




> 
> What does top or sar show for load averages over time?
> 

Ehm ... sorry, I don't know what that means.
Is that information in my logwatch? I couldn't see it.
I can forward you the complete logwatch email privately if you like.
But it's a long S.O.B. - and of course I don't want to waste your time.

Or do I find this information within my WEBMIN?

Many thanks for your help.

Best Wishes,

PRODOS

http://prodos.thinkertothinker.com

Have a hug. Read Atlas Shrugged.

Re: [webmin-l] Hundreds of cron /usr/bin/monitor.sh notifications followed by server crash

[John H. <web...@ew...>]

pr...@pr... wrote:
> From: Prodos
>
> Good afternoon.
>
> For two days in a row my server has crashed.
>
> Before it crashes I receive hundreds of notifications
> from my server.
>
> The subject line of each message is:
>
> Cron <root@prodos> /usr/bin/monitor.sh
>
> And the content of each message says this:
>
> Load Avegare check FAILED at 11
>
> [I presume this should be spelt "Load Average"?]
>
> ... but with different numbers.
>
> My most recent LogWatch says (among other things) this:
>
> Connections Rejected due to load average::
>    Load Avg 12: 111 Times(s)
>    Load Avg 13: 51 Times(s)
>    Load Avg 131: 1 Times(s)
>    Load Avg 14: 59 Times(s)
>    Load Avg 15: 41 Times(s)
>    Load Avg 16: 23 Times(s)
>    Load Avg 17: 24 Times(s)
>    Load Avg 18: 19 Times(s)
>
>    [And the list goes on and on]
>
>
> Does anyone have any idea what's happening
> and what could be done to fix this?
>   
Is this under Sendmail in logwatch? If so, you have a very bad email 
problem going on... or something using up all the resources and Sendmail 
is gracefully allowing the other stuff to run....

What does top or sar show for load averages over time?

JH
> Thank you for any assistance.
>
> =]:-)
>
> Best Wishes,
>
> PRODOS
>
> http://prodos.thinkertothinker.com
>
> Have a hug. Read Atlas Shrugged.
>
>
>
>
>
> -------------------------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> -
> Forwarded by the Webmin mailing list at web...@li...
> To remove yourself from this list, go to
> http://lists.sourceforge.net/lists/listinfo/webadmin-list
>
> !DSPAM:44fe6686185174533621264!
>
>   

[webmin-l] Hundreds of cron /usr/bin/monitor.sh notifications followed by server crash

[<pr...@pr...>]

From: Prodos

Good afternoon.

For two days in a row my server has crashed.

Before it crashes I receive hundreds of notifications
from my server.

The subject line of each message is:

Cron <root@prodos> /usr/bin/monitor.sh

And the content of each message says this:

Load Avegare check FAILED at 11

[I presume this should be spelt "Load Average"?]

... but with different numbers.

My most recent LogWatch says (among other things) this:

Connections Rejected due to load average::
   Load Avg 12: 111 Times(s)
   Load Avg 13: 51 Times(s)
   Load Avg 131: 1 Times(s)
   Load Avg 14: 59 Times(s)
   Load Avg 15: 41 Times(s)
   Load Avg 16: 23 Times(s)
   Load Avg 17: 24 Times(s)
   Load Avg 18: 19 Times(s)

   [And the list goes on and on]


Does anyone have any idea what's happening
and what could be done to fix this?

Thank you for any assistance.

=]:-)

Best Wishes,

PRODOS

http://prodos.thinkertothinker.com

Have a hug. Read Atlas Shrugged.

Re: [webmin-l] Access denied for user

[Munzir T. ( ) <mun...@gm...>]

On Monday 04 September 2006 19:51, Jamie Cameron wrote:
> There is actually a bug in Usermin that causes this.
> To fix it, you can either grant all mysql users access to the 'mysql'
> database, or upgrade Usermin from http://www.webmin.com/devel.html .
>

Thanks a lot Jamie. I upgraded usermin and the problem is magically gone ;)

-- 
Munzir Taha
Telecommunications and Electronics Engineer
Maintainer of Fedora Arabic Translation Project
https://listman.redhat.com/mailman/listinfo/fedora-trans-ar
Maintainer of the OpenBugs project page at
http://www.arabic-fedora.org/munzir/OpenBugs.html
Master CIW Designer, ICDL, MOUS, Linux+, LPI 101
Riyadh, SA

Re: [webmin-l] Host blocked by MySQL daemon on TCP monitor checks

[Jamie C. <jca...@we...>]

On 4/Sep/2006 14:41 Joaquim Homrighausen wrote ..
> 
> Something for the FAQ perhaps:
> 
> I wanted to see if two of our MySQL-servers were alive, so I added a quick
> 'n' dirty monitor (TCP, port 3306). Everything was grand until I installed
> a PHP application on the same server as Webmin (290). After that, I started
> getting "host blocked .. " errors in the PHP application logs. It took
> a while to figure it out, but when I did, I deactivated the TCP/3306 monitors
> and configured Webmin on the two MySQL servers instead, to be aware of
> binaries, paths, etc. Then I added a proper MySQL monitor on the "master"
> machine, and the problem never surfaced agin.
> 
> I don't know what data is sent when doing a "port ping", if it's just a
> socket, but MySQL thought Webmin was trying to do "something" anyway, and
> didn't like the number of attempts without success.

Hi Joaquim,
Thanks for the information - I didn't know that MySQL did this kind of host
blocking. To avoid this, I would recommend using the new 'SQL Query'
monitor type, which can login to a database server, make a query and check
the result..
 
 - Jamie