Grex Oldcoop Conference

Item 123: Looks like someone is creating hundreds of accounts

Entered by ryan on Sat Feb 14 22:07:07 2004:

ryan Mon Aug 29 22:49:58 2005 Ryan Antkowiak,,, ryan Mon Aug 29 22:49:58 20
ryan
27 responses total.
#1 of 27 by ryan on Sat Feb 14 22:27:44 2004:

This response has been erased.


#2 of 27 by rational on Sat Feb 14 22:32:09 2004:

Also, it looks like jp2's filled up some partitions somewhere.

#3 of 27 by naftee on Sat Feb 14 23:07:17 2004:

Also, it seems jp2 is up to his old mass-mailing tricks again.

#4 of 27 by rational on Sat Feb 14 23:08:51 2004:

jp2's up to his old tricks again.

#5 of 27 by naftee on Sat Feb 14 23:10:04 2004:

We should ban him!

#6 of 27 by scott on Sun Feb 15 00:06:58 2004:

Hush, you.

#7 of 27 by rational on Sun Feb 15 00:13:22 2004:

Yet another attem[pt to abridge the free speech RIGHTS of Grex's users.

#8 of 27 by naftee on Sun Feb 15 01:20:06 2004:

Typical.

#9 of 27 by other on Sun Feb 15 05:11:37 2004:

What is fixwait reporting?

#10 of 27 by spooked on Sun Feb 15 12:03:05 2004:

The telnet queue - connections awaiting a tty (arbitrarily limited).
Thus, someone may have created a software program (automated) bot to
create accounts via newuser endlessly, thus initiating a denial-of-service
(resources) attack.

#11 of 27 by scott on Sun Feb 15 15:17:38 2004:

Or it could have been a class... that's happened before.

#12 of 27 by ryan on Sun Feb 15 16:48:08 2004:

This response has been erased.


#13 of 27 by ryan on Sun Feb 15 16:49:23 2004:

This response has been erased.


#14 of 27 by naftee on Sun Feb 15 19:07:24 2004:

's

#15 of 27 by jlamb on Sat Feb 21 05:13:38 2004:

This response has been erased.


#16 of 27 by lkjh on Sat Feb 21 15:56:13 2004:

like these?
  
yiy591:x:17764:205:IslamicWays:/c/y/i/yiy591:/bin/csh
yiy592:x:17765:205:IslamicWays:/c/y/i/yiy592:/bin/csh
yiy593:x:17766:205:IslamciWays:/c/y/i/yiy593:/bin/csh
yiy594:x:17767:205:IslamicWays:/c/y/i/yiy594:/bin/csh
yiy595:x:17768:205:IslamicWays:/c/y/i/yiy595:/bin/csh
yiy597:x:17770:205:IslamicWays:/c/y/i/yiy597:/bin/csh
yiy596:x:17771:205:IslamicWays:/c/y/i/yiy596:/bin/csh
yiy598:x:17772:205:IslamicWays:/c/y/i/yiy598:/bin/csh
yiy599:x:17773:205:IslamciWays:/c/y/i/yiy599:/bin/csh
yiy600:x:17774:205:IslamicWays:/c/y/i/yiy600:/bin/csh
yiy485:x:18230:205:none:/c/y/i/yiy485:/bin/csh
yiy601:x:20209:205:United States of America:/c/y/i/yiy601:/bin/csh
yiy602:x:20210:205:United States of America:/c/y/i/yiy602:/bin/csh
yiy603:x:20211:205:United States of America:/c/y/i/yiy603:/bin/csh
yiy604:x:20213:205:United States of America:/c/y/i/yiy604:/bin/csh
yiy605:x:20214:205:United States of America:/c/y/i/yiy605:/bin/csh
yiy606:x:20216:205:United States of America:/c/y/i/yiy606:/bin/csh
yiy607:x:20217:205:United States of America:/c/y/i/yiy607:/bin/csh
yiy608:x:20218:205:United States of America:/c/y/i/yiy608:/bin/csh:p
   
or these?
  
yiy108:x:17052:205:asdfasdfasdf:/c/y/i/yiy108:/bin/csh
yiy109:x:17053:205:gfhsdgsbfsgf:/c/y/i/yiy109:/bin/csh
yiy110:x:17055:205:asdfasdfasdf:/c/y/i/yiy110:/bin/csh
yiy113:x:17056:205:gfhsdgsbfsgf:/c/y/i/yiy113:/bin/csh
yiy111:x:17057:205:adgfasdfasdfasdf:/c/y/i/yiy111:/bin/csh
yiy112:x:17058:205:asdfasdfasdf:/c/y/i/yiy112:/bin/csh
yiy114:x:17059:205:gfhsdgsbfsgf:/c/y/i/yiy114:/bin/csh
yiy115:x:17060:205:adgfasdfasdfasdf:/c/y/i/yiy115:/bin/csh
yiy116:x:17061:205:asdfasdfasdf:/c/y/i/yiy116:/bin/csh
yiy117:x:17062:205:gfhsdgsbfsgf:/c/y/i/yiy117:/bin/csh
yiy118:x:17063:205:adgfasdfasdfasdf:/c/y/i/yiy118:/bin/csh
yiy:p

#17 of 27 by jlamb on Sat Feb 21 16:49:41 2004:

This response has been erased.


#18 of 27 by naftee on Sat Feb 21 17:36:14 2004:

asdasdasdasdasdasdasd

#19 of 27 by ryan on Mon Feb 23 00:53:28 2004:

This response has been erased.


#20 of 27 by rational on Mon Feb 23 00:59:26 2004:

I hope he wasn't doing it from my computer.  :(

#21 of 27 by salad on Mon Feb 23 01:42:28 2004:

Nope.  From mine.

#22 of 27 by keesan on Mon Feb 23 18:44:09 2004:

WOuld someone please explain to the general public what these numbers mean,
other than that naftee is hogging grex?

#23 of 27 by rational on Mon Feb 23 20:45:50 2004:

He's not.

#24 of 27 by albaugh on Mon Feb 23 23:08:07 2004:

Not any *more*, that is...

#25 of 27 by gelinas on Mon Feb 23 23:47:51 2004:

Sindi, the first part of Response 19 is screen shots from "top", which
displays information about the processes using the most resources.  From 
the manual page for top (i.e., "man top"):

     The top few lines of the display  show  general  information
     about the state of the system, including the last process id
     assigned to a process (on  most  systems),  the  three  load
     averages,   the   current   time,  the  number  of  existing
     processes, the number of processes in each state  (sleeping,
     running,  starting,  zombies, and stopped), and a percentage
     of time spent in each of the processor states  (user,  nice,
     system,  and idle).  It also includes information about phy-
     sial and virtual memory allocation.

     The remainder of the screen displays information about indi-
     vidual  processes.   This  display  is  similar in spirit to
     ps(1) but it is not exactly the same.  PID  is  the  process
     id,  USERNAME  is  the name of the process's owner (if -u is
     specified, a UID column will be substituted  for  USERNAME),
     PRI is the current priority of the process, NICE is the nice
     amount (in the range -20 to 20), SIZE is the total  size  of
     the  process  (text,  data,  and  stack), RES is the current
     amount of resident memory (both SIZE and RES  are  given  in
     kilobytes),  STATE  is  the  current  state (one of "sleep",
     "WAIT", "run", "idl", "zomb", or "stop"), TIME is the number
     of  system  and  user cpu seconds that the process has used,
     WCPU, when displayed, is the weighted cpu  percentage  (this
     is  the  same  value that ps(1) displays as CPU), CPU is the
     raw percentage and is the field that is sorted to  determine
     the  order  of the processes, and COMMAND is the name of the
     command that the process is currently running (if  the  pro-
     cess is swapped out, this column is marked "<swapped>").

I'll leave finding the explanation of the "vmstat" portion of Response
19 as an exercise for the reader.

#26 of 27 by salad on Tue Feb 24 00:24:21 2004:

Quit posting man pages; they make you look like you actually have something to
say.

#27 of 27 by jesuit on Wed May 17 02:14:52 2006:

TROGG IS DAVID BLAINE

There are no more items selected.

You have several choices: