il maestro ignoto

I received an email from Dreamhost last night about what they thought were dubious activities on my shell account.

I logged in from a UK IP address and a mere minutes later, I logged in from a US IP address.

They immediately moved my .ssh folder to dot_ssh_disabled_by_dh and deleted all the crons I had installed. In the email was attached a copy of my crons, my new password and the email address of a real person to talk to.

Of course it wasn’t at all anything sinister - I was logged into a box stateside, needed to find script I had written almost a year ago and so ssh-ed to said account. I have logged into my account from other countries while traveling but never from the US - this triggered their monitoring system, I suspect they then keep a log of all countries I have visited from and no longer raise warnings from these.

A cursory glance at my history files, showed nothing out of the ordinary - I also checked my authorized_keys file before replacing my .ssh folder and peeked in at the processes running to make absolutely certain. I suspect there’s more that I could have done and that’s what the comments section is for

Just for good measure, I requested a list of the IP addresses which have connected to my accounts in the last week and Mike from Dreamhost sent the below list back - it’s been trimmed for brevity.


1182960547 o2 GB 86.129.82.65 3ce52ef567bd5dca3a402d863dc14966
1182960547 o2 GB 86.129.82.65 3ce52ef567bd5dca3a402d863dc14966
1183519178 o2 US 208.97.184.215 583677e4675e68f885c58f93c08caa00
1183519178 o2 US 208.97.184.215 583677e4675e68f885c58f93c08caa00
1183519191 o2 GB 86.129.82.65 9fc63a607f18cd3b97c1e15060c5aeeb
1183519191 o2 GB 86.129.82.65 9fc63a607f18cd3b97c1e15060c5aeeb
1183520357 o2 US 208.97.184.215 cbd71d00be60dbff34315939f2eebef0
1183520357 o2 US 208.97.184.215 cbd71d00be60dbff34315939f2eebef0
1183520745 o2 GB 86.129.82.65 10fcfa719b4fc1aef734a7aac3903c60
1183983151 o2 GB 90.193.90.47 7ab6b13fc20332d496316d19a75c0cd7
1183983151 o2 GB 90.193.90.47 7ab6b13fc20332d496316d19a75c0cd7
1184240826 o2 GB 86.129.75.30 ab907df7b86beed9503bd945923fecac
1184240826 o2 GB 86.129.75.30 ab907df7b86beed9503bd945923feca


I keep a running tab of my laptop’s internet facing addresses* and ticked off the GB addresses. And indeed the US IP was the account I ‘d been connected to.

While it continues to bother me that they don’t support django out of the box and don’t plan to provide a database which supports transactions - by which I specifically mean postgres, the amount of detail they put into supporting the services they do provide is commendable.

Thanks Dreamhost - My heroes for the day.

*it is auto-generated when I log onto a network and set in an email to me - at the time I hoped it’d come in handy if my laptop was stolen

Details of our July meet are finally up on upcoming.
Apologies for the short notice - we wanted to get a venue so we could have a class rather than our normal lovely pub meets.

Details are here, bring friends

http://upcoming.yahoo.com/event/218452

My iBook’s hard-drive kept filling up and no amount of df, du magic would tell me what’s taking up all this space: 40GB (Yeah, it’s 3 years old so back off Mr 100 TB ).

Well, today I found out when I kicked open iPhoto to import some pictures from my camera - Yes! Duplicates. Libraries upon libraries of duplicates and triplicates, with each file approx. 1MB large.

I went rooting around and it turns out iPhoto, iTunes have both been creating several copies of the same file on my laptop.

So, I blew them away. How?


io2:~ io2$ cd /Users/io2/Pictures/iPhoto\ Library/
io2:~ io2$ find . -name *.JPG -print | awk '/_[0-9]\.JPG$/' |xargs rm -


Of course no sooner had I done that and twittered about it than Dustin Breese replied with a shorter version.


find . -name \*_[0-9].JPG -exec rm {} \;


Remarks

I totally envy those unix guys with their powerful (perl + awk + sed + pipes + shell) toolbox sitting in their castles looking down at the rest of us