| 00:16.36 | *** join/#uphpu noisewaterphd (~camronlev@67.214.225.82) |
| 01:15.40 | *** join/#uphpu ponderability (~Adium@76.27.120.22) |
| 02:11.41 | *** join/#uphpu ponderability (~Adium@76.27.120.22) |
| 03:12.02 | *** join/#uphpu UtahDave (~boucha@198.217.121.244) |
| 03:12.02 | *** mode/#UPHPU [+o UtahDave] by ChanServ |
| 03:25.40 | *** join/#uphpu HumanCell (~Humancell@207.224.214.130) |
| 03:39.53 | *** join/#uphpu hhatfield (~hhatfield@97-126-245-178.slkc.qwest.net) |
| 03:39.54 | *** mode/#UPHPU [+v hhatfield] by ChanServ |
| 04:40.39 | *** join/#uphpu cro (~cro@204.228.149.217) |
| 04:54.05 | *** join/#uphpu cro (~cro@204.228.149.217) |
| 09:00.31 | *** join/#uphpu TuxToaster (~TuxToaste@66.133.98.27) |
| 09:00.31 | *** mode/#UPHPU [+v TuxToaster] by ChanServ |
| 10:45.21 | *** join/#uphpu DexterTheDragon (~DexterThe@oalug/member/blackchaos) |
| 10:45.21 | *** mode/#UPHPU [+v DexterTheDragon] by ChanServ |
| 11:01.28 | *** join/#uphpu TuxToaster (~TuxToaste@66.133.98.27) |
| 11:01.28 | *** mode/#UPHPU [+v TuxToaster] by ChanServ |
| 13:02.18 | *** join/#uphpu TuxToaster (~TuxToaste@66.133.98.27) |
| 13:02.18 | *** mode/#UPHPU [+v TuxToaster] by ChanServ |
| 13:05.23 | *** join/#uphpu supernovia (~Adium@2605:a601:520:8501:58fa:e9fc:81a:ea5e) |
| 13:57.12 | *** join/#uphpu hhatfield (~hhatfield@199.104.95.10) |
| 13:57.12 | *** mode/#UPHPU [+v hhatfield] by ChanServ |
| 14:13.04 | *** join/#uphpu MikeHansenMe (~mike@c-67-186-219-152.hsd1.ut.comcast.net) |
| 14:15.15 | *** join/#uphpu bbankes (~bbankes@50-200-100-242-static.hfc.comcastbusiness.net) |
| 14:17.05 | *** join/#uphpu josephscott (~josephsco@proxy.iad.automattic.com) |
| 14:17.05 | *** mode/#UPHPU [+o josephscott] by ChanServ |
| 14:17.11 | *** join/#uphpu eggyknap (~jtolley@74.36.15.55) |
| 14:17.11 | *** join/#uphpu eggyknap (~jtolley@unaffiliated/eggyknap) |
| 14:17.11 | *** mode/#UPHPU [+v eggyknap] by ChanServ |
| 14:24.42 | *** join/#uphpu macnewbold (~macnewbol@wfw.vivint.com) |
| 14:24.42 | *** mode/#UPHPU [+o macnewbold] by ChanServ |
| 14:44.15 | *** join/#uphpu opapo (~quassel@204.113.97.239) |
| 14:44.15 | *** mode/#UPHPU [+v opapo] by ChanServ |
| 14:51.59 | *** join/#uphpu clintberry (~clintberr@75-148-102-17-Utah.hfc.comcastbusiness.net) |
| 14:51.59 | *** mode/#UPHPU [+v clintberry] by ChanServ |
| 15:07.22 | *** join/#uphpu kendsnyder (~Adium@67.214.245.39) |
| 15:07.22 | *** mode/#UPHPU [+v kendsnyder] by ChanServ |
| 15:11.25 | *** join/#uphpu littleSkinner (~JSkinn@asa-2.fbp.ore.fiber.net) |
| 15:20.48 | *** join/#uphpu ponderability (~Adium@tobias.chpc.utah.edu) |
| 15:49.01 | *** join/#uphpu TuxToaster (~TuxToaste@wfw.vivint.com) |
| 15:49.01 | *** mode/#UPHPU [+v TuxToaster] by ChanServ |
| 15:49.31 | *** join/#uphpu kendsnyder (~Adium@67.214.245.39) |
| 15:49.31 | *** mode/#UPHPU [+v kendsnyder] by ChanServ |
| 15:55.46 | *** join/#uphpu _carbohydrate (~textual@192.150.9.201) |
| 15:58.59 | *** join/#uphpu josephscott (~josephsco@proxy.iad.automattic.com) |
| 15:59.00 | *** mode/#UPHPU [+o josephscott] by ChanServ |
| 15:59.48 | *** join/#uphpu gshipley (~gshipley@138.91.145.100) |
| 15:59.48 | *** mode/#UPHPU [+v gshipley] by ChanServ |
| 16:09.41 | *** join/#uphpu mgeary (~mgeary@67.136.112.81) |
| 16:09.43 | *** mode/#UPHPU [+v mgeary] by ChanServ |
| 16:10.40 | mgeary | hmm. it seems that my mail server developed a "poor reputation" over the weekend |
| 16:11.09 | mgeary | i'm currently theorizing that an email user with a weaker password had it compromised by a brute-force attack |
| 16:11.17 | mgeary | but i'm not sure if i can substantiate/track that |
| 16:15.54 | fungus | mail logs |
| 16:16.25 | josephscott | mgeary: are you using Amazon SES? https://forums.aws.amazon.com/thread.jspa?messageID=538207 |
| 16:16.49 | mgeary | josephscott: no. it's a private server |
| 16:17.03 | mgeary | and i can confirm a big increase in mail |
| 16:17.44 | mgeary | trying to figure out if it's via smtp or possibly some exposed PHP interface |
| 16:18.06 | mgeary | ah |
| 16:18.09 | mgeary | might have found it |
| 16:19.24 | fungus | find an example message and search your logs by that message ID. that will pinpoint the source IP (if SMTP) or source user ID (if local) |
| 16:20.04 | mgeary | exactly. Found this: Apr 20 04:08:22 server postfix/smtpd[1110]: 9B0B429E022B: client=unknown[190.236.36.167], sasl_method=PLAIN, sasl_username=<user with weak password>@gearyweb.com |
| 16:20.13 | mgeary | followed by a bunch of spam emails going out |
| 16:20.54 | fungus | looks pretty good. |
| 16:21.12 | mgeary | just changed that user's password to something robust |
| 16:21.31 | fungus | lock that down, smack "user with weak password" upside the head, then start the cleanup process. |
| 16:22.05 | fungus | And then audit your user lists/passwords. |
| 16:22.46 | mgeary | yeah, that's the next question. what cleanup do i need to do? look for blacklisting, i know. what else? |
| 16:23.22 | fungus | find all the blacklists you are on, and visit each one requesting removal, following any procedures each one requires. |
| 16:23.52 | fungus | Move your mail server to another IP in the mean time. |
| 16:24.33 | fungus | Sometimes, depending on the blacklist it can take weeks/months to clean up your reputation. |
| 16:30.58 | *** join/#uphpu UtahDave (~boucha@208.187.248.7) |
| 16:31.00 | *** mode/#UPHPU [+o UtahDave] by ChanServ |
| 16:40.12 | *** join/#uphpu TuxToaster (~TuxToaste@wfw.vivint.com) |
| 16:40.13 | *** mode/#UPHPU [+v TuxToaster] by ChanServ |
| 16:40.47 | *** part/#uphpu shanemhansen (~shanemhan@149.154.152.93) |
| 17:04.53 | *** join/#uphpu TuxToaster (~TuxToaste@wfw.vivint.com) |
| 17:04.53 | *** mode/#UPHPU [+v TuxToaster] by ChanServ |
| 17:56.53 | *** join/#uphpu HumanCell (~Humancell@216.51.68.1) |
| 18:14.51 | *** join/#uphpu josephscott (~josephsco@proxy.iad.automattic.com) |
| 18:14.52 | *** mode/#UPHPU [+o josephscott] by ChanServ |
| 18:37.21 | *** join/#uphpu UtahDave (~boucha@208.187.248.7) |
| 18:37.22 | *** mode/#UPHPU [+o UtahDave] by ChanServ |
| 18:46.21 | *** join/#uphpu OldCoder (~OldCoder@unaffiliated/oldcoder) |
| 19:00.49 | *** join/#uphpu hhatfield (~hhatfield@64.147.139.68) |
| 19:00.49 | *** mode/#UPHPU [+v hhatfield] by ChanServ |
| 19:01.01 | *** join/#uphpu supernovia (~Adium@23-255-234-14.slc.googlefiber.net) |
| 19:05.07 | *** join/#uphpu hhatfield_ (~hhatfield@199.104.95.10) |
| 19:05.10 | *** mode/#UPHPU [+v hhatfield_] by ChanServ |
| 19:08.48 | *** join/#uphpu hhatfield_ (~hhatfield@199.104.95.10) |
| 19:08.49 | *** mode/#UPHPU [+v hhatfield_] by ChanServ |
| 19:14.18 | *** join/#uphpu supernovia (~Adium@2605:a601:520:8501:6c78:49c3:60ed:1e12) |
| 19:42.28 | UtahDave | Our first SaltStack user group meeting is tomorrow night at 6pm at the SaltStack headquarters. http://www.meetup.com/SaltStack-user-group-Salt-Lake-City/events/177704062/ |
| 19:42.57 | UtahDave | Everyone is welcome to attend! |
| 19:43.05 | clintberry | UtahDave: awesome. I'm glad that is starting |
| 19:43.17 | UtahDave | The CoreOS developers are going to be speaking, too. Should be really interesting. |
| 19:45.34 | UtahDave | clintberry: Will you be able to make it? |
| 20:03.41 | clintberry | UtahDave: not this week. But I will be adding it to my calendar to attend |
| 20:03.48 | UtahDave | cool |
| 20:23.48 | peno | neat. |
| 20:23.58 | peno | if whiteinge will be there, I might have to go. :) |
| 20:37.34 | *** join/#uphpu opapo (~quassel@204.113.97.239) |
| 20:37.34 | *** mode/#UPHPU [+v opapo] by ChanServ |
| 20:43.23 | ninnypants | UtahDave: what's the monthly schedule for it? |
| 20:44.08 | UtahDave | peno: unfortunately whiteinge is in San Fran this week working with a customer. But he'll be there whenever he's in town |
| 20:44.40 | UtahDave | ninnypants: I'm not 100% sure, but I think it's every month same day, same time, same bat-channel |
| 20:45.54 | ninnypants | would same day me every 4th Tuesday? |
| 20:46.16 | ninnypants | s/me/be/ |
| 20:46.29 | UtahDave | Yeah, I think so. Let me check |
| 20:46.34 | ninnypants | well that backfired |
| 20:48.33 | UtahDave | he he. |
| 20:48.51 | UtahDave | there's a meeting going on. I'll ask as soon as their finished |
| 21:09.34 | *** join/#uphpu supernovia (~Adium@2605:a601:520:8501:51d7:4a1:4481:53f3) |
| 23:26.33 | *** join/#uphpu clintberry (~clintberr@c-50-160-3-25.hsd1.ut.comcast.net) |
| 23:26.33 | *** mode/#UPHPU [+v clintberry] by ChanServ |