FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Gentoo > Gentoo User

 
 
LinkBack Thread Tools
 
Old 09-25-2010, 04:38 PM
Grant
 
Default machine check exception errors

>> > Thanks Mick. *My host is big with multiple data centers of their own.
>> > They did exactly as I asked and I'm running on new RAM. *There was a
>> > problem bringing my system back online and the cause was purported to
>> > be an unseated ethernet cable. *I handed over my root password as I
>> > was requested to do, and then started to get paranoid. *I suppose I
>> > shouldn't though because with physical access to my machine they
>> > pretty much have full access anyway, right?
>
>> Usually, physical access means they either have it or can get it pretty
>> quick. *Boot a CD/DVD, mount the partitions, chroot in, change password
>> and reboot. *Then, you don't have the password but they do.
>
> That's pretty obvious though. Physical access allows them to change your
> password but not read it, so you'd know pretty soon if they'd been up to
> anything.
>
> If they really do need the root password, you have to give it to them,
> but that doesn't stop you changing it, and running a rootkit scan, as
> soon as they've finished with it.

I've run chkrootkit, but I noticed:

The file of stored file properties (rkhunter.dat) does not exist, and
so must be created. To do this type in 'rkhunter --propupd'.

I thought the best practice with a rootkit checker like chkrootkit was
to not leave it installed on the system so you can run it as a clean
install when the time comes?

Do any of these warnings sound an alarm for anyone? I think the SSH
warnings are OK because I have a normal user specified with AllowUsers
and the config file says:

# The default requires explicit activation of protocol 1
#Protocol 2

Here are the warnings:

Warning: The command '/usr/bin/ldd' has been replaced by a script:
/usr/bin/ldd: Bourne-Again shell script text executable

Warning: The command '/usr/bin/whatis' has been replaced by a script:
/usr/bin/whatis: POSIX shell script text executable

Warning: The command '/usr/bin/lwp-request' has been replaced by a
script: /usr/bin/lwp-request: a /usr/bin/perl -w script text
executable

Warning: No output found from the lsmod command or the /proc/modules file:
/proc/modules output:
lsmod output:

Warning: The SSH configuration option 'PermitRootLogin' has not been
set. The default value may be 'yes', to allow root access.

Warning: The SSH configuration option 'Protocol' has not been set. The
default value may be '2,1', to allow the use of protocol version 1.

Warning: Hidden directory found: /dev/.udev

- Grant
 
Old 09-25-2010, 06:09 PM
walt
 
Default machine check exception errors

On 09/25/2010 09:38 AM, Grant wrote:


Do any of these warnings sound an alarm for anyone?

Warning: The command '/usr/bin/ldd' has been replaced by a script:
/usr/bin/ldd: Bourne-Again shell script text executable

Warning: The command '/usr/bin/whatis' has been replaced by a script:
/usr/bin/whatis: POSIX shell script text executable

Warning: The command '/usr/bin/lwp-request' has been replaced by a
script: /usr/bin/lwp-request: a /usr/bin/perl -w script text
executable

Warning: No output found from the lsmod command or the /proc/modules file:
/proc/modules output:
lsmod output:

Warning: The SSH configuration option 'PermitRootLogin' has not been
set. The default value may be 'yes', to allow root access.

Warning: The SSH configuration option 'Protocol' has not been set. The
default value may be '2,1', to allow the use of protocol version 1.

Warning: Hidden directory found: /dev/.udev


I have the same on my machines except for the lsmod output. Did you configure
your kernel without any modules?
 
Old 09-25-2010, 08:47 PM
Grant
 
Default machine check exception errors

>> Do any of these warnings sound an alarm for anyone?
>>
>> Warning: The command '/usr/bin/ldd' has been replaced by a script:
>> /usr/bin/ldd: Bourne-Again shell script text executable
>>
>> Warning: The command '/usr/bin/whatis' has been replaced by a script:
>> /usr/bin/whatis: POSIX shell script text executable
>>
>> Warning: The command '/usr/bin/lwp-request' has been replaced by a
>> script: /usr/bin/lwp-request: a /usr/bin/perl -w script text
>> executable
>>
>> Warning: No output found from the lsmod command or the /proc/modules file:
>> /proc/modules output:
>> lsmod output:
>>
>> Warning: The SSH configuration option 'PermitRootLogin' has not been
>> set. The default value may be 'yes', to allow root access.
>>
>> Warning: The SSH configuration option 'Protocol' has not been set. The
>> default value may be '2,1', to allow the use of protocol version 1.
>>
>> Warning: Hidden directory found: /dev/.udev
>
> I have the same on my machines except for the lsmod output. *Did you
> configure
> your kernel without any modules?

Yes, no modules except that one that seems to be required called
something along the lines of scsi-wait-scan.

- Grant
 
Old 09-25-2010, 09:53 PM
Dale
 
Default machine check exception errors

Grant wrote:

Do any of these warnings sound an alarm for anyone?

Warning: The command '/usr/bin/ldd' has been replaced by a script:
/usr/bin/ldd: Bourne-Again shell script text executable

Warning: The command '/usr/bin/whatis' has been replaced by a script:
/usr/bin/whatis: POSIX shell script text executable

Warning: The command '/usr/bin/lwp-request' has been replaced by a
script: /usr/bin/lwp-request: a /usr/bin/perl -w script text
executable

Warning: No output found from the lsmod command or the /proc/modules file:
/proc/modules output:
lsmod output:

Warning: The SSH configuration option 'PermitRootLogin' has not been
set. The default value may be 'yes', to allow root access.

Warning: The SSH configuration option 'Protocol' has not been set. The
default value may be '2,1', to allow the use of protocol version 1.

Warning: Hidden directory found: /dev/.udev


I have the same on my machines except for the lsmod output. Did you
configure
your kernel without any modules?


Yes, no modules except that one that seems to be required called
something along the lines of scsi-wait-scan.

- Grant




I tried getting rid of that, I don't like modules much, but I had no
luck. It just has to be a module and it seems it just has to be there.
Still not sure it is the way it is.


Dale

:-) :-)
 
Old 09-25-2010, 11:11 PM
walt
 
Default machine check exception errors

On 09/25/2010 02:53 PM, Dale wrote:

Grant wrote:

Did you
configure
your kernel without any modules?



Yes, no modules except that one that seems to be required called
something along the lines of scsi-wait-scan.



I tried getting rid of that, I don't like modules much, but I had no luck. It just has to be a module and it seems it just has to be there. Still not sure it is the way it is.


Hm. I see that I have that driver in /lib/modules/ but the module is
not loaded. Anyone know what that module is for?
 
Old 09-25-2010, 11:17 PM
Dale
 
Default machine check exception errors

walt wrote:

On 09/25/2010 02:53 PM, Dale wrote:

Grant wrote:

Did you
configure
your kernel without any modules?



Yes, no modules except that one that seems to be required called
something along the lines of scsi-wait-scan.


I tried getting rid of that, I don't like modules much, but I had no
luck. It just has to be a module and it seems it just has to be
there. Still not sure it is the way it is.


Hm. I see that I have that driver in /lib/modules/ but the module is
not loaded. Anyone know what that module is for?



I think it was Alan that tried to explain that thing to me. I don't use
it that I know of but you can't config it out. I even tried to edit the
config file directly and it just got really mad during the build.


No idea what it is for but some kernel dev thinks it is really important
to have no matter what.


Dale

:-) :-)
 
Old 09-25-2010, 11:20 PM
Volker Armin Hemmann
 
Default machine check exception errors

On Tuesday 21 September 2010, Stroller wrote:
> On 21 Sep 2010, at 18:37, Grant wrote:
> >>>> I'm getting a lot of machine check exception errors in dmesg on my
> >>>> hosted server. Running mcelog I get:
> >>>> ...
> >
> > They offered to take my machine down and do a memory test which they
> > said would take a number of hours. Is a memory test likely to help?
> > Did you suggest reseating or replacing RAM modules as opposed to a
> > memory test because it will result in less downtime?
>
> I suspect that your hosting provider are offering you this memory test
> because they don't want to go swapping out memory modules willy-nilly.
>
> How do they know that the problem is really memory, and not your operating
> system? If they take all this RAM out and put new RAM in, what do they do
> with the old RAM? They don't know if it's good or bad, so are they
> expected to just slap it in a server belonging to another customer, and
> stitch him up?
>
> A memory test is likely to identify bad RAM, if it is bad, so you should
> proceed with this. This is likely the best route to solving the problem.
>

sure?
this is ecc ram - does memtest report ecc-corrected errors? i don't think so.
The mce errors say:
we detected an error. Error was corrected. Applications will not see error.
Everything marches on.

The ram is borked and must be replaced.
 

Thread Tools




All times are GMT. The time now is 03:47 AM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org