Box-Admins October 2012

box-admins@lists.squeakfoundation.org

7 participants
28 discussions

The story from the log files
by Chris Cunnington 29 Oct '12

29 Oct '12

Levente was right about the open proxy exploitation. [1] It has stopped now. [Editor's Note: No it hasn't.] The last one was at 7:52 on 23 Oct. This server is on CEST time, so subtracting six hours that would be 1:52 here in eastern North America. The GET requests display explotation when they are asking for a server that is not ours. The request for http://ad.yieldmanager.com is an example. I don't suppose there's any real damage, but it is my mistake. The open proxy exploitation was followed by many POST requests. [2] Notice the size of this log file: -rw-r----- 1 root adm 2173022665 Oct 25 14:20 other_vhosts_access.log What is that? To my eyes that's 2.02 Gigs of data collected over maybe ~72 hours. Many [2] are POST requests. I can't say what ajaxExecutors or ajaxBuildQueue is. It is definitely part of Jenkins, I'm just not sure what part. I'll look into it. Actually, I'm wrong. [3]. We're still being exploited as an open proxy. Those are the latest results from the log file. I've changed the stanza to and restarted: <VirtualHost *:80> ServerName www.squeakci.org ServerAlias squeakci.org ProxyRequests Off ProxyPreserveHost On ProxyPass / http://127.0.0.1:8080/ ProxyPassReverse / http://127.0.0.1:8080/ <Proxy *> Order deny,allow Allow from all </Proxy> </VirtualHost> And will check the log file again in two hours. Chris [1] 92.17.231.188 - - [23/Oct/2012:07:52:54 +0200] "POST /ajaxExecutors HTTP/1.1" 200 545 "http://squeakci.org/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/536.26.14 (KHTML, like Gecko) Version/6.0.1 Safari/536.26.14" www.squeakci.org:80 92.17.231.188 - - [23/Oct/2012:07:52:55 +0200] "POST /ajaxBuildQueue HTTP/1.1" 200 415 "http://squeakci.org/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/536.26.14 (KHTML, like Gecko) Version/6.0.1 Safari/536.26.14" www.squeakci.org:80 184.22.82.217 - - [23/Oct/2012:07:52:55 +0200] "GET http://ad.yieldmanager.com/st?ad_type=iframe&ad_size=300x250&section=300799… HTTP/1.0" 200 4982 "http://www.file4dvd.com" "Mozilla/4.0 (compatible; MSIE 5.01; Windows 98)" www.squeakci.org:80 184.22.82.217 - - [23/Oct/2012:07:52:56 +0200] "GET http://ad.yieldmanager.com/imp?Z=300x250&s=3007994&T=3&_salt=1911752854&B=1… HTTP/1.0" 302 712 "http://ad.yieldmanager.com/st?ad_type=iframe&ad_size=300x250&section=300799…" "Mozilla/4.0 (compatible; MSIE 5.01; Windows 98)" www.squeakci.org:80 184.22.82.217 - - [23/Oct/2012:07:52:57 +0200] "GET http://cookex.amp.yahoo.com/v2/cexposer/SIG=13rmsj29b/*http%3A//ad.yieldman… HTTP/1.0" 302 751 "http://ad.yieldmanager.com/st?ad_type=iframe&ad_size=300x250&section=300799…" "Mozilla/4.0 (compatible; MSIE 5.01; Windows 98)" www.squeakci.org:80 92.17.231.188 - - [23/Oct/2012:07:52:59 +0200] "POST /ajaxExecutors HTTP/1.1" 200 545 "http://squeakci.org/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/536.26.14 (KHTML, like Gecko) Version/6.0.1 Safari/536.26.14" www.squeakci.org:80 184.22.82.217 - - [23/Oct/2012:07:52:59 +0200] "GET http://ad.yieldmanager.com/imp?Z=300x250&s=3007994&T=3&_salt=1911752854&B=1… HTTP/1.0" 200 1806 "http://ad.yieldmanager.com/st?ad_type=iframe&ad_size=300x250&section=300799…" "Mozilla/4.0 (compatible; MSIE 5.01; Windows 98)" [2] 92.17.231.188 - - [23/Oct/2012:04:41:01 +0200] "POST /ajaxExecutors HTTP/1.1" 200 545 "http://squeakci.org/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/536.26.14 (KHTML, like Gecko) Version/6.0.1 Safari/536.26.14" www.squeakci.org:80 92.17.231.188 - - [23/Oct/2012:04:41:03 +0200] "POST /ajaxBuildQueue HTTP/1.1" 200 415 "http://squeakci.org/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/536.26.14 (KHTML, like Gecko) Version/6.0.1 Safari/536.26.14" www.squeakci.org:80 92.17.231.188 - - [23/Oct/2012:04:41:06 +0200] "POST /ajaxExecutors HTTP/1.1" 200 545 "http://squeakci.org/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/536.26.14 (KHTML, like Gecko) Version/6.0.1 Safari/536.26.14" [3] 108.62.111.169 - - [25/Oct/2012:14:30:30 +0200] "GET http://ad.scanmedios.com/st?ad_type=iframe&ad_size=160x600&section=3522623 HTTP/1.0" 404 558 "http://classidressing.com/index.php?option=com_mailto&tmpl=component&link=a…" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Win64; x64; .NET CLR 2.0.50727; SLCC1; Media Center PC 5.0; .NET CLR 3.0.04506)" www.squeakci.org:80 50.93.195.16 - - [25/Oct/2012:14:30:30 +0200] "GET http://ad.yieldmanager.com/st?ad_type=iframe&ad_size=300x250&section=1949015 HTTP/1.0" 404 558 "http://www.suddengame.com/index.html" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; WOW64; SLCC1; Media Center PC 5.0; .NET CLR 2.0.50727)" www.squeakci.org:80 23.19.67.38 - - [25/Oct/2012:14:30:30 +0200] "GET http://ad.adserverplus.com/st?ad_type=iframe&ad_size=728x90&section=2898706… HTTP/1.0" 404 558 "http://femaleapple.com/index.php?option=com_content&view=article&id=6299:20…" "Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9.0.5) Gecko/2008120122 Firefox/3.0.5" www.squeakci.org:80 108.62.178.236 - - [25/Oct/2012:14:30:30 +0200] "GET http://ad.tagjunction.com/st?ad_type=iframe&ad_size=300x250&section=2933804… HTTP/1.0" 404 558 "http://bestmylive.com/index.php?option=com_mailto&tmpl=component&link=73209…" "Mozilla/4.0 (compatible; MSIE 6.0; Windows CE; IEMobile 7.11)" www.squeakci.org:80 108.62.75.188 - - [25/Oct/2012:14:30:30 +0200] "GET http://ad.globe7.com/st?ad_type=iframe&ad_size=160x600&section=3542181&pub_… HTTP/1.0" 404 558 "http://fashionarrow.com/index.php?option=com_mailto&tmpl=component&link=aHR…" "Mozilla/5.0 (Windows NT 5.1; U; en; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 10.53" www.squeakci.org:80 173.208.94.17 - - [25/Oct/2012:14:30:30 +0200] "GET http://ad.scanmedios.com/st?ad_type=iframe&ad_size=160x600&section=3522623 HTTP/1.0" 404 558 "http://classidressing.com/index.php?option=com_mailto&tmpl=component&link=a…" "Mozilla/4.0 (compatible; MSIE 6.0; Update a; Win32)" www.squeakci.org:80 142.91.189.9 - - [25/Oct/2012:14:30:30 +0200] "GET http://ads1.ministerial5.com/creative/2-002134057-00001i;size=4 HTTP/1.0" 404 558 "http://travellingonroad.com/index.php?view=article&catid=34%3Acheap-travel&…" "Mozilla/5.0 (X11; Linux i686) AppleWebKit/534.35 (KHTML, like Gecko) Ubuntu/10.10 Chromium/13.0.764.0 Chrome/13.0.764.0 Safari/534.35" www.squeakci.org:80 142.91.217.190 - - [25/Oct/2012:14:30:30 +0200] "GET http://ad.globaltakeoff.net/st?ad_type=iframe&ad_size=300x250&section=21864… HTTP/1.0" 404 558 "http://www.ttfemalehealth.com/index.php?option=com_content&view=article&id=…" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.8.99 Version/11.10" www.squeakci.org:80 142.91.189.47 - - [25/Oct/2012:14:30:31 +0200] "GET http://ad.adserverplus.com/st?ad_type=iframe&ad_size=300x250&section=325642… HTTP/1.0" 404 558 "http://newsja.com/index.php?view=article&catid=35%3Acelebrity&id=8455%3A201…" "Mozilla/4.76 [en] (X11; U; SunOS 5.7 sun4u)"

4 11

Looks healthier now
by Chris Cunnington 29 Oct '12

29 Oct '12

I'm not sure what happened but the response time for http://www.squeakci.org looks quite acceptable. I don't know why that is, exactly. Perhaps David did something over the weekend. Or the efforts we put into place last week have cleared up the situation. The logs files are rolling over to newer ones. The log files are not stuffed with requests trying to use us as an open proxy. The situation certainly looks healthier now. Chris

2 2

Can I get a Jenkins account on box3?
by David T. Lewis 28 Oct '12

28 Oct '12

I would like to try connecting VM build and tarball generation to Jenkins on box3. I assume that there is a Jenkins administrator who might be able to add "lewis" to the configuration. Chris, is this something that you could do for me? Thanks, Dave

2 3

Weekly Roundup
by Chris Cunnington 26 Oct '12

26 Oct '12

I just want to sum up some things that happened with the box and Jenkins this week: - We have Jenkins running behind its domain squeakci.org. It comes up reliably now, but there is around a twenty second wait, which is too long. - The /var/log/apache2/other_vhosts_access.log is around 2.5G now. That means its growing at .3G a day. - We were being used as an open proxy and have done everything conceivable to stop it. The log now says that we still get lots of requests to do this and that they all get 403 responses. I'm unfamiliar with this as it didn't happen on my ServerBeach server (the one I'm about to shutter). I can't help feel it's a kind of low level DDOS and that even with 403 responses it likely affects the ability of people to reach our Jenkins server - I've launched a 4.4 image with Altitude and RFB in the server. Using RFB I can see that the problem of Altitude not finding libsys is there. All the Linux FFI tests run green so that's not the problem. I figure I'll create a symlink between where FFI looks for things and /usr/lib/libsys* Some things we want to do next: - Dave has a vm build script that returns a tarball of VMM-generated sources. We want to make that a daily build on the Jenkins server and produced a downloadable artifact - Levente has suggested making Jenkins listen only on the local interface, and to - add a firewall to the server while moving port22 requests to another port. An observation: - Between the Jenkins server, compiling vms, and deploying an Altitude website, I think we are starting to crowd this server which only has 1G of RAM. Chris

3 2

Re: Jenkins reliability ( was Re: [squeak-dev] 6 tests to go...)
by Chris Cunnington 24 Oct '12

24 Oct '12

On 2012-10-24 10:45 AM, Levente Uzonyi wrote: > On Wed, 24 Oct 2012, Igor Stasenko wrote: > >> Err, no. >> A "workspace" is where slave doing its work. >> But artifacts made by job(s) are stored in separate place. > > Right, but as I said, the directory structure created by Jenkins > didn't match what the wiki says when we set up Jenkins. So, tt's still > worth checking the directory structure. > > > Levente > The directory structure seems to be as it should be: xxxxxxxxx:/xxxxxxxxx/jobs/SqueakTrunk/builds/20$ ls -la total 864 drwxr-xr-x 3 jenkins xxxxxx 4096 Oct 23 19:26 . drwxr-xr-x 21 jenkins xxxxxx 4096 Oct 23 19:21 .. drwxr-xr-x 3 jenkins xxxxxx 4096 Oct 23 19:26 archive -rw-r--r-- 1 jenkins xxxxxx 2906 Oct 23 19:26 build.xml -rw-r--r-- 1 jenkins xxxxxx 252 Oct 23 19:21 changelog.xml -rw-r--r-- 1 jenkins xxxxxx 857130 Oct 23 19:26 junitResult.xml -rw-r--r-- 1 jenkins xxxxxx 1312 Oct 23 19:26 log The deliverables are in the archive directory as expected. I think the build.xml is what is read to inform the web page. Looking at the site it seems a bit more stable than yesterday. Somewhat. Nothing has disappeared so far. Perhaps it's hardening a bit with use. Chris

3 13

squeaci.org live
by Chris Cunnington 22 Oct '12

22 Oct '12

OK, I've added the stanza: <VirtualHost *:80> ServerName www.squeakci.org ServerAlias squeakci.org ProxyRequests On ProxyPreserveHost On ProxyPass / http://www.squeakci.org:8080/ ProxyPassReverse / http://www.squeakci.org:8080/ </VirtualHost> to the bottom of /etc/apache2/apache2.conf. I had to use: /usr/sbin/a2enmod to add the proxy_http module, and then restart: /etc/init.d/apache2 restart http://www.squeakci.org Chris

1 0

A note on that squeakci.org transfer business...
by Chris Cunnington 22 Oct '12

22 Oct '12

I have switched over at my registrar, but I haven't configured Apache yet. Mmmm... So I'll look to that. Just a sec. Chris

1 0

change made at registrar
by Chris Cunnington 22 Oct '12

22 Oct '12

I've made the squeakci.org change at my registrar. The transition should happen soon. The difference will be plain to see as the old server has three jobs and the new server has only one. Chris

1 0

First Successful build on the new server
by Chris Cunnington 22 Oct '12

22 Oct '12

I configured SqueakTrunk/.git/config with: sudo git config user.name "Frank Shearar" sudo git config user.email "frank.shearar(a)gmail.com" Pressed "Build Now" and I think we have our first successful build. there were six tests outstanding and zipped files to download. And then it disappeared. All of it. The job, the workspace, everything. I do have proof from the log though: Oct 22, 2012 8:34:45 PM hudson.model.Run execute INFO: SqueakTrunk #16 main build action completed: SUCCESS Where it's all got to at the moment, I couldn't say. Wait. I did it again. There it is: http://173.246.101.237:8080/job/SqueakTrunk/17/ Chris

2 1

Permissions solved; now it's identification
by Chris Cunnington 22 Oct '12

22 Oct '12

I took care of the permissions. Now it says: Caused by:hudson.plugins.git.GitException <http://stacktrace.jenkins-ci.org/search?query=hudson.plugins.git.GitExcepti…>: Command "git tag -a -f -m Jenkins Build #13 jenkins-SqueakTrunk-13" returned status code 128: stdout: stderr: *** Please tell me who you are. Run git config --global user.email "you(a)example.com" git config --global user.name "Your Name" to set your account's default identity. Omit --global to set the identity only in this repository. I did some of that and it is not yet mollified: chriscunnington@box3-squeak:/var/lib/jenkins$ git config --global user.email "frank.shearar(a)gmail.com" chriscunnington@box3-squeak:/var/lib/jenkins$ git config --global user.name "Frank Shearar" Chris

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Box-Admins October 2012