WARNING, runaway RC5 clients, please check your settings!

[IsOs]

The following IPs are submitting blocks without the proper id. Please check your RC5 settings

nobody@[24.177.191.77] (This one is still submitting blocks without id)

MIKA identified the 204.209.128.x as coming from nobody@[24.88.137.21], so whoever you are please fix your settings.

Glad to see BoberFett fixed his settings.

 

[GeoffS]

Any idea what the IDs are or how we can figure out if they are coming from one of us?

 

[NicColt]

newbie question but, what would the setting be?

here's mine, is this ok?

[parameters]
id=rc5@tacube.com

[buffers]
checkpoint-filename=cp

[rc5]
preferred-blocksize=33
fetch-workunit-threshold=500
randomprefix=177

[misc]
project-priority=RC5,OGR=0,DES=0,CSC=0

[triggers]
restart-on-config-file-change=yes

[networking]
firewall-type=http
firewall-host=proxy.compaq.com:8080
disabled=yes

 

[Ken g6]

The last IP comes up as clt88-137-021.carolina.rr.com on nslookup. The other two seem to be offline.

P.S. That's fine, Nic. At least, it's fine if you want to be a Borg.

I assume the problem is someone forgot to put in an e-mail address.

 

[Jani]

Geronimo Development Corp (NETBLK-GERONIMO-1) GERONIMO-1 199.199.174.0 - 199.199.174.255
CAnet (NETBLK-ALBERTA-3) ALBERTA-3 204.209.0.0 - 204.209.255.0

 

[IsOs]

Ken_g6,
I've experienced a situation that when the computer shutdown, sometimes the client caused it to freezed. I forced a reset and when the computer rebooted, the client's ini got wiped out. I didn't noticed it until someone posted a similar thread and I recognized my IP.

So if your system recently locked up, check your client's ini and make sure that it still have your DNET ID!

 

[Vossie]

If you run your clients hidden, it makes sense to add:

[triggers]
restart-on-config-file-change=yes
pause-watch-plist=taskman.exe

this helps avoiding discovery of your client....

 

[IsOs]

As of today...within the last hour:

199.199.174.24 (This one is still submitting blocks without id)

nobody@[24.94.17.222]

nobody@[204.209.128.158]

 

[IsOs]

This needs a bump. BoberFett identified the 199 as his herd. The others are still active spending energy without team benefiting from it.

nobody@[204.209.128.158] please fix your cow.

 

[BoberFett]

Yep, 199.199.174.x is my C block at work. Those are mine, I'll fix it as soon as I get home tonight.

 

[Mika]

strange - 204.209.128.158 is teamanandtech.com

Here is the ini file:

[parameters]
id=manderso@shaw.wave.ca

[rc5]
fetch-workunit-threshold=128
preferred-blocksize=33
randomprefix=1

[ogr]
fetch-workunit-threshold=2

[networking]
autofindkeyserver=no
keyserver=proxy.teamanandtech.com

[logging]
log-file-limit=1024
log-file=dnetc.log
log-file-type=fifo

[misc]
project-priority=DES,CSC,RC5,OGR=0

[buffers]
frequent-threshold-checks=3


Any ideas?

 

[Mika]

Ah, I think I know why there are blocks coming from teamanandtech.com (webserver).

I recently changed mika.dhs.org to point to 204.209.128.158 (the webserver) rather than 204.209.128.157 (the pproxy). I installed a pproxy on the webserver so that users who couldn't update their keyserver settings from mika.dhs.org would still have blocks submitted.

The unknown blocks are probably coming from a member using mika.dhs.org as their keyserver.

Mika

 

[Mika]

It appears that the unknown blocks from 204.209.128.158 are coming from:
nobody@[24.88.137.21]

Also, please check this page to see if you are still submitting blocks through mika.dhs.org. If possible, please change it to proxy.teamanandtech.com or core.teamanandtech.com (I know it's not always possible, I dont' have easy access to a some machines with that address on it).

Mika

 

[BoberFett]

Awww crap. I found the problem. The dnetc.ini on a machine at home had the line

/[parameters]

I must have hit a key and unknowingly changed it. Oh well, it was only 6K or 7K blocks. :disgust:

 

[ViRGE]

Boberfett!:| We've taught you too well to speak like that! Take it back and say you're serverly dissapointed, or else...

 

[IsOs]

24.177.191.77, last submitted about 2 hours ago. Hopefully, that's the last one. Thanks to all, for fixing your settings.

 

[dkappos]

I am now using teamanandtech.dhs.org Is this ok or should I change my clients to proxy.teamanandtech.com? If I change the client to the second on will I still by able to see the IP where the blocks are coming from?

 

[bphantom]

dkappos, please change your clients to proxy.teamanandtech.com. teamanandtech.dhs.org was only a temporary solution and may be disabled in the future.

To everyone, as Mika stated above, mika.dhs.org is now on a forwarding pproxy. There is the possibility this temp pproxy may be removed in the future. So as time/availability permits, please change your clients to point to either proxy.teamanandtech.com or core.teamanandtech.com. Thanks!

Brad..

 

[Wellcky]

Changed all my cows yesterday looks all good here!

 

[dmcowen674]

Hi Mika,

I don't have access to the 50 or so machines that I had still pointing to Mika.dhs.org What will happen once mika goes off-line?

Dave

 

[dmcowen674]

Actually I've missed a lot. Didn't know about the AOL IP and addresses being blocked. dmcowen674@aol.com is where my machines were coming from. Also why is mika.dhs.org going off-line? It was working so long so fine.

 

[Ken g6]

Okay, now that this thread popped back up, I got a clean nslookup on the other IP. So, anybody submitting from cx76009-b.elcjn1.sdca.home.com on AT&T's @Home Cable Service, or clt88-137-021.carolina.rr.com on RoadRunner, please check your .ini files.

BTW, an interesting thing happened when I put the @Home URL in IE. It bounced me to the Distributed.net page! So, anybody running a web server which does a redirect to Distributed.net (it's not a meta-refresh but it might be any other method), please check your dnetc.ini file!

 

[JJ650]

hmm, wonder if it is a one I just put the client on. Im on carolina RR and so is that machine. Uh oh.

 

[Soccerman]

whoa this is weird, I got an e-mail from Distributed.net with my password in it.. it said that the request originated from the IP address 4.54.35.144.. here's the whole message:

You (or "" [4.54.35.144]) recently requested the password for your distributed.net stats account. You should keep this information confidential. If you did not just request your password, it just means that some confused person has clicked on the "mail me my password" link on your personal stats page. This is no reason to be alarmed, they cannot get to your password this way.

should I be worried about someone trying to get my password? after all, my name in Distributed.net has my e-mail address on it.

 

[ViRGE]

Soccerman, there isn't too much to be worried about. It might be a good idea to change your email addy so that it can't be used in trojans, but that's about it. Unless they can hack into your email accout, there's no way they can get the password.