I was surprised to see that I'm receiving lots of ssh intruders from different IP locations. Also in my server 90% of CPU is being utilized in running cron  /tmp/.txl/upd &gt;/dev/null 2&gt;&amp;1   The logs from journalctl. What actually it means  Dec 14 17:33:08 svr-1004 sshd[17786]: Invalid user dovecot from 111.231.66.135 port 37596 Dec 14 17:33:08 svr-1004 sshd[17786]: input_userauth_request: invalid user dovecot [preauth] Dec 14 17:33:08 svr-1004 sshd[17786]: pam_unix(sshd:auth): check pass; user unknown Dec 14 17:33:08 svr-1004 sshd[17786]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.66.135 Dec 14 17:33:10 svr-1004 sshd[17786]: Failed password for invalid user dovecot from 111.231.66.135 port 37596 ssh2 Dec 14 17:33:11 svr-1004 sshd[17786]: Received disconnect from 111.231.66.135 port 37596:11: Bye Bye [preauth] Dec 14 17:33:11 svr-1004 sshd[17786]: Disconnected from 111.231.66.135 port 37596 [preauth] Dec 14 17:33:22 svr-1004 sshd[17802]: reverse mapping checking getaddrinfo for 234.2.125.189.static.impsat.net.br [189.125.2.234] failed - POSSIBLE BREAK-IN ATTEMPT! Dec 14 17:33:22 svr-1004 sshd[17802]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.125.2.234  user=root Dec 14 17:33:22 svr-1004 sshd[17802]: pam_succeed_if(sshd:auth): requirement "uid &gt;= 1000" not met by user "root" Dec 14 17:33:24 svr-1004 sshd[17802]: Failed password for root from 189.125.2.234 port 27235 ssh2 Dec 14 17:33:25 svr-1004 sshd[17802]: Received disconnect from 189.125.2.234 port 27235:11: Bye Bye [preauth] Dec 14 17:33:25 svr-1004 sshd[17802]: Disconnected from 189.125.2.234 port 27235 [preauth] Dec 14 17:33:33 svr-1004 systemd[1]: firewalld.service start operation timed out. Terminating. Dec 14 17:33:33 svr-1004 kernel: Ebtables v2.0 unregistered
I am fairly new to the system administration world. I've been working on an application recently and when I check my application server logs, I constantly get various IP addresses trying to ssh into my server by brute force. Here is an example of my server log:   Feb 14 04:07:20 foodwiz3 sshd[1264]: error: Could not load host key: /etc/ssh/ssh_host_ed25519_key Feb 14 04:07:21 foodwiz3 sshd[1264]: reverse mapping checking getaddrinfo for coenamor.columbiansabbatical.com [23.249.167.223] failed - POSSIBLE BREAK-IN ATTEMPT! Feb 14 04:07:21 foodwiz3 sshd[1264]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.249.167.223  user=root Feb 14 04:07:23 foodwiz3 sshd[1264]: Failed password for root from 23.249.167.223 port 32997 ssh2 Feb 14 04:07:23 foodwiz3 sshd[1264]: Received disconnect from 23.249.167.223: 11: Bye Bye [preauth] Feb 14 04:13:04 foodwiz3 sshd[1289]: error: Could not load host key: /etc/ssh/ssh_host_ed25519_key Feb 14 04:13:05 foodwiz3 sshd[1289]: reverse mapping checking getaddrinfo for coenamor.columbiansabbatical.com [23.249.167.223] failed - POSSIBLE BREAK-IN ATTEMPT! Feb 14 04:13:05 foodwiz3 sshd[1289]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.249.167.223  user=root Feb 14 04:13:07 foodwiz3 sshd[1289]: Failed password for root from 23.249.167.223 port 41562 ssh2   Is this something that is fairly normal, or should I be worried/doing something about it?
How do I safely investigate a USB stick found in the parking lot at work? I work at an embedded software company. This morning I found a USB stick in the parking lot in front of the building. With all the stories of "dropped USB stick attacks" in mind, I'm obviously not going to just plug it into my laptop. OTOH, I'm curious to know whether this was actually an attempt to compromise our systems, or it's really just an innocent case of somebody accidentally losing a USB stick. How do I safely inspect the USB stick without risking exposure?  I'm worried not just about malware and crafted file system images; there's also stuff like power surge attacks:.  EDIT: Many of the answers seem to assume I want to keep the drive and use it afterwards. I have no interest in that at all, I know USB sticks are cheap, and that it wouldn't be mine to keep anyway. I only want to know whether this was indeed a semi-targeted attack, partly out of curiosity whether this actually happens in real life and not just in security papers, but also so that I could warn my coworkers.  I want to know how I would figure out whether the stick contains malware. And that's not just a matter of looking at the drive contents and seeing a suspicious autorun.inf or a carefully crafted corrupt file system - I very much also want a way to inspect the firmware. I sort-of expected that there were tools for extracting that and comparing to known-good or known-bad binaries. Using expect for inputting commands Heres the thread I'm bouncing off of:   So I'm trying to run this command: cd /etc/openvpn/easy-rsa; . ./vars; ./build-key username  However, after running that command, I need to input nothing [just press enter] 10 times, and press y twice. The user on the last thread suggested I use except, but I couldn't get it working. Here are the questions it asks:  root@suffice-vpn:/etc/openvpn/easy-rsa# ./build-key usernamtest Generating a 2048 bit RSA private key ..................+++ ........+++ writing new private key to 'usernamtest.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [US]: State or Province Name (full name) [NY]: Locality Name (eg, city) [Merrick]: Organization Name (eg, company) [IceWare]: Organizational Unit Name (eg, section) [IceWare]: Common Name (eg, your name or your server's hostname) [usernamtest]: Name [server]: Email Address [iceware@programmer.net]:  Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.0.cnf Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows countryName           :PRINTABLE:'US' stateOrProvinceName   :PRINTABLE:'NY' localityName          :PRINTABLE:'Merrick' organizationName      :PRINTABLE:'IceWare' organizationalUnitName:PRINTABLE:'IceWare' commonName            :PRINTABLE:'usernamtest' name                  :PRINTABLE:'server' emailAddress          :IA5STRING:'iceware@programmer.net' Certificate is to be certified until Jan 14 18:27:48 2026 GMT (3650 days) Sign the certificate? [y/n]:y   1 out of 1 certificate requests certified, commit? [y/n]y   As you can see, I press enter 8 times initially [to keep the default input] and then press enter another 2 times to skip the optional commands. Then, I need to press y twice. How can I automate this? I need to have this all happen in one command. Any suggestions? Thanks in advance. Need help disabling imessage? I recently changed from iphone to android and i have been having trouble recieving messages from my iphone friends since my iphones screen is broken i cant do anything on it. Any way to fix this problem through icloud or something? How to enable or disable a user? I'm uing ubuntu 12.04 desktop. I have 3 users: user1(administrator), user2(standard) and guest. I wanted to disable user1 and enable user2 which auto logs on with no password but after I did that I can't login to user1 and user2 accounts except the guest session user. I'm striped off every administrative privileges. I don't know which options are available to me and how do I enable root or user which is an administrator? Similar matrices and field extensions My ubuntu partition was deleted and I can't boot from either a DVD or USB Inverse public-key encryption I'm in the need of an inverse public-key encryption method where you encrypt with the private key and decrypt with the public key. In other words an asymetric encryption where you can't generate the encryption key from the decryption key. Does such encryption exist? If yes which, and which would be the fastest?  If nothing like that exists I would be glad if you helped me out with my situation:    I need to authenticate users logging in from my Java application in the way that the response from the server cannot be falsified and thus giving the user full access to the application. Using public key encryption was an obvious method, I would decrypt data received from the client to confirm the credentials. This won't work because if someone manages to decompile and get the private key from the code, they would be able to generate the public key, which would make them able to crack my application again. So any ideas how I can get this secure? How to write permutations as product of disjoint cycles and transpositions $$\sigma=\begin{pmatrix} 1 &amp; 2 &amp;3 &amp; 4&amp; 5&amp; 6&amp;7 &amp;8 &amp;9 &amp;10 &amp; 11 \\ 4&amp;2&amp;9&amp;10&amp;6&amp;5&amp;11&amp;7&amp;8&amp;1&amp;3    \end{pmatrix}$$  (1) I am asked to write this permutation in $S_{11}$ as a product of disjoint cycles and also as a product of transpositions.   (2) Also find the order of the element. Is this permutation even or odd?  I think these are the disjoint cycles  $E_{1}=(1,4,10)$, $\;\operatorname{order}E_1 =3$  $E_{2}= (3,9,8,7,11),\;$ $\operatorname{order}E_{2} =5$  $E_{3}=(5,6),\;$ $\operatorname{order}E_{3} =2$  $S_{11}$=  $E_{1} \cdot E_{2}\cdot  E_{3}$  The order of $\operatorname{order}E_{3}$ is even so the order of the permutation is even. Why are they asking this? And what is the significance of it being even or odd?  Transpositions – I have read this a couple times but the one example in my textbook is rather unclear, I am not sure what this means?  I think the transposition for $E_{1}$ is $(1,4)(1,10)$ but I'm not sure what this means. Solve a linear system with more variables than equations As per the title, what is this new feature? How to create a folder in HOME Folder with ModelBuilder in ArcGis 10? Formula to this pattern? $1$, $11$, $21$, $1211$, $111221$, $\ldots$ I have this pattern:  1 11 21 1211 111221   I'm guessing it's a fibo pattern, been at it for hours now. Anyone know? Implementing a Custom Subscription Center in Salesforce Marketing Cloud Has anyone implemented a custom subscription center using landing pages? The example one from the documentation doesn't seem to be working. I would really like to just customized the out of the box one but the amp script is hidden when I view source. Does anyone have and tips/tricks for creating a sub center?  Thanks! What is the gradient of $f(x, y, z) = \sqrt{x^2+y^2+z^2}$? What is the gradient of $f(x, y, z) = \sqrt{x^2+y^2+z^2}$?  I know that $\nabla f = \left\langle\frac{\partial f}{\partial x}, \frac{\partial f}{\partial y}, \frac{\partial f}{\partial z}\right\rangle$ or equivalently $\nabla f = \frac{\partial f}{\partial x}\mathbf{i} + \frac{\partial f}{\partial y}\mathbf{j} + \frac{\partial f}{\partial z}\mathbf{k}$.  Eventually, I am going to evaluate this gradient at a point and then dot it with some given unit vector to find a directional derivative. I think maybe what is troubling me is the radical in $f$. Will I have to use the chain rule in order to find the three partial derivatives?  I tried this:  $$\frac{\partial f}{\partial x} = \frac{1}{2}(x^2 + y^2 + z^2)^{-\frac{1}{2}}2x$$ $$= \frac{x}{\sqrt{x^2 + y^2 + z^2}}$$  That result looks ugly to me. However, if I did that partial derivative correctly, then I think I know what I am doing. It looks like if I load dynamic content using $.get(), the result is cached in browser.  Adding some random string in QueryString seems to solve this issue (I use new Date().toString()), but this feels like a hack.   Is there any other way to achieve this? Or, if unique string is the only way to achieve this, any suggestions other than new Date()? How to define servlet filter order of execution using annotations in WAR Deleting a comment (mine) shouldn't count as a comment vote I had an old question that I revisited in order to link it in a new answer. I noticed that in the comments Steven A Lowe had a funny comment that I -- at the time -- had responded to with "why can't I upvote comments?"  Well, of course, now I can.  So, I voted Steven's comment up then went to delete mine. I got the warning box that I can only submit comment votes once every 5 seconds. This seems like a bug to me. Deleting is not the same as voting. Why, oh why, don't the Weasleys "conjure" up some diamonds/gold/etc, sell 'em to Muggles, and get rich? They could buy a mansion (like the Malfoys), and live there happily ever after.  I know there's  that prohibits one from conjuring food (which doesn't make much sense to me, either). Even if it applied to gold, what about all the other elements/compounds/materials? Could the law really be 'don't let a wizard conjure something if it'll make them richer'? That's totally nonsensical.  Why does Wizard society still have poor people, especially if they're talented? Auto-expand TAB character in code formatting Related:       Note that this question, while related, is not the same as the ones linked.  In many cases, when people put code into questions or answers, they copy/paste the code from their editor.  If their editor is using tab characters, the formatting will be broken after the post is submitted.  For example, if a code is indented using TAB characters, then one TAB character in the beginning of a line will be treated as one level of indent and align with the left edge of the code, effectively indenting equally to 4 spaces.  However in the post editor it looks indented twice - the same as 8 spaces.  I often edit other people's posts to improve code formatting and I find this TAB issue being the biggest annoyance.  Most of the times (I think) on SO, we use 4 spaces to format/indent the code.  I think it would be an easy thing to auto-expand TAB characters inside &lt;code&gt; blocks by replacing them with 4 spaces when the post is submitted. Are film capacitors affected by DC bias?