/l3/users/ikravchuk/xg-ids/linux2.unix.nt/root :1 :2 :3 :4 :5 :6 :7 :8 :9 :10 :11 :12
[ править ]

Журнал лабораторных работ

Содержание

Журнал

Пятница (06/22/07)

/dev/tty3
19:27:11
#ping 192.168.15.201 
connect: Network is unreachable
19:27:33
#ping 192.168.15.201 
connect: Network is unreachable
19:27:34
#ping 192.168.15.201 
connect: Network is unreachable
19:28:52
#ifconfog 
bash: ifconfog: command not found
19:28:57
#ifconfig
eth0      Link encap:Ethernet  HWaddr 00:04:75:75:46:B1
          inet6 addr: fe80::204:75ff:fe75:46b1/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:184842 errors:0 dropped:0 overruns:500 frame:0
          TX packets:161932 errors:16 dropped:0 overruns:0 carrier:5
          collisions:0 txqueuelen:1000
          RX bytes:63494287 (60.5 MiB)  TX bytes:16013208 (15.2 MiB)
          Interrupt:169 Base address:0x2c00
lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:34746 errors:0 dropped:0 overruns:0 frame:0
          TX packets:34746 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:5157510 (4.9 MiB)  TX bytes:5157510 (4.9 MiB)
19:29:08
#ifconfig
eth0      Link encap:Ethernet  HWaddr 00:04:75:75:46:B1
          inet6 addr: fe80::204:75ff:fe75:46b1/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:184842 errors:0 dropped:0 overruns:503 frame:0
          TX packets:161932 errors:16 dropped:0 overruns:0 carrier:5
          collisions:0 txqueuelen:1000
          RX bytes:63494287 (60.5 MiB)  TX bytes:16013208 (15.2 MiB)
          Interrupt:169 Base address:0x2c00
lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:34746 errors:0 dropped:0 overruns:0 frame:0
          TX packets:34746 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:5157510 (4.9 MiB)  TX bytes:5157510 (4.9 MiB)
19:29:19
#ifconfig
eth0      Link encap:Ethernet  HWaddr 00:04:75:75:46:B1
          inet6 addr: fe80::204:75ff:fe75:46b1/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:184842 errors:0 dropped:0 overruns:504 frame:0
          TX packets:161932 errors:16 dropped:0 overruns:0 carrier:5
          collisions:0 txqueuelen:1000
          RX bytes:63494287 (60.5 MiB)  TX bytes:16013208 (15.2 MiB)
          Interrupt:169 Base address:0x2c00
lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:34746 errors:0 dropped:0 overruns:0 frame:0
          TX packets:34746 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:5157510 (4.9 MiB)  TX bytes:5157510 (4.9 MiB)
19:29:20
#ifconfig
eth0      Link encap:Ethernet  HWaddr 00:04:75:75:46:B1
          inet6 addr: fe80::204:75ff:fe75:46b1/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:184842 errors:0 dropped:0 overruns:505 frame:0
          TX packets:161932 errors:16 dropped:0 overruns:0 carrier:5
          collisions:0 txqueuelen:1000
          RX bytes:63494287 (60.5 MiB)  TX bytes:16013208 (15.2 MiB)
          Interrupt:169 Base address:0x2c00
lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:34746 errors:0 dropped:0 overruns:0 frame:0
          TX packets:34746 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:5157510 (4.9 MiB)  TX bytes:5157510 (4.9 MiB)
19:29:21
#ifconfig
eth0      Link encap:Ethernet  HWaddr 00:04:75:75:46:B1
          inet6 addr: fe80::204:75ff:fe75:46b1/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:184842 errors:0 dropped:0 overruns:506 frame:0
          TX packets:161932 errors:16 dropped:0 overruns:0 carrier:5
          collisions:0 txqueuelen:1000
          RX bytes:63494287 (60.5 MiB)  TX bytes:16013208 (15.2 MiB)
          Interrupt:169 Base address:0x2c00
lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:34746 errors:0 dropped:0 overruns:0 frame:0
          TX packets:34746 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:5157510 (4.9 MiB)  TX bytes:5157510 (4.9 MiB)
19:29:22
#ifdown eth0
There is already a pid file /var/run/dhclient.eth0.pid with pid 8320
killed old client process, removed PID file
Internet Systems Consortium DHCP Client V3.0.4
Copyright 2004-2006 Internet Systems Consortium.
All rights reserved.
For info, please visit http://www.isc.org/sw/dhcp/
Listening on LPF/eth0/00:04:75:75:46:b1
Sending on   LPF/eth0/00:04:75:75:46:b1
Sending on   Socket/fallback
DHCPRELEASE on eth0 to 192.168.15.254 port 67
send_packet: Network is unreachable
send_packet: please consult README file regarding broadcast address.
19:29:31
#ifup eth0
Internet Systems Consortium DHCP Client V3.0.4
Copyright 2004-2006 Internet Systems Consortium.
All rights reserved.
For info, please visit http://www.isc.org/sw/dhcp/
Listening on LPF/eth0/00:04:75:75:46:b1
Sending on   LPF/eth0/00:04:75:75:46:b1
Sending on   Socket/fallback
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 7
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 7
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 20
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 18
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 9
No DHCPOFFERS received.
No working leases in persistent database - sleeping.
/dev/tty4
19:30:32
#mii-tool
Internet Systems Consortium DHCP Client V3.0.4
Copyright 2004-2006 Internet Systems Consortium.
All rights reserved.
For info, please visit http://www.isc.org/sw/dhcp/
Listening on LPF/eth0/00:04:75:75:46:b1
Sending on   LPF/eth0/00:04:75:75:46:b1
Sending on   Socket/fallback
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 7
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 7
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 20
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 18
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 9
eth0: negotiated 100baseTx-FD flow-control, link ok
19:30:41
#mii-tool
eth0: negotiated 100baseTx-FD flow-control, link ok
19:30:46
#mii-tool
eth0: negotiated 100baseTx-FD flow-control, link ok
/dev/tty3
19:30:53
#ifdown eth0
There is already a pid file /var/run/dhclient.eth0.pid with pid 14185
killed old client process, removed PID file
Internet Systems Consortium DHCP Client V3.0.4
Copyright 2004-2006 Internet Systems Consortium.
All rights reserved.
For info, please visit http://www.isc.org/sw/dhcp/
Listening on LPF/eth0/00:04:75:75:46:b1
Sending on   LPF/eth0/00:04:75:75:46:b1
Sending on   Socket/fallback
DHCPRELEASE on eth0 to 192.168.15.254 port 67
send_packet: Network is unreachable
send_packet: please consult README file regarding broadcast address.
19:31:14
#ifup eth0
Internet Systems Consortium DHCP Client V3.0.4
Copyright 2004-2006 Internet Systems Consortium.
All rights reserved.
For info, please visit http://www.isc.org/sw/dhcp/
Listening on LPF/eth0/00:04:75:75:46:b1
Sending on   LPF/eth0/00:04:75:75:46:b1
Sending on   Socket/fallback
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 4
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 5
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 7
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 14
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 12
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 14
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 5
No DHCPOFFERS received.
No working leases in persistent database - sleeping.
19:32:19
#fa 
factor   faillog  false    farpd
19:32:19
#farpd -h 
Usage: arpd [-d] [-i interface] [net]
19:32:37
#ps -ef | grep farpd
root     12764     1  0 11:44 ?        00:00:00 farpd -i eth0 192.168.15.101
root     14271  3756  0 12:33 pts/2    00:00:00 grep farpd
19:33:15
#ifup eth0
ifup: interface eth0 already configured
19:33:58
#ps -ef | grep farpd
root     12764     1  0 11:44 ?        00:00:00 farpd -i eth0 192.168.15.101
root     14297  3756  0 12:34 pts/2    00:00:00 grep farpd
19:34:07
#kill -9 12764










19:34:29




#ps -ef | grep farpd


root     14313  3756  0 12:34 pts/2    00:00:00 grep farpd











19:34:31




#farpd -i eth0  192.168.15.101





farpd: bad interface configuration: not IP or Ethernet











19:34:49




#ps -ef | grep farpd


root     14332  3756  0 12:35 pts/2    00:00:00 grep farpd











19:35:00




#ifup eth0


ifup: interface eth0 already configured











19:35:04




#ifdown eth0


There is already a pid file /var/run/dhclient.eth0.pid with pid 14240
killed old client process, removed PID file
Internet Systems Consortium DHCP Client V3.0.4
Copyright 2004-2006 Internet Systems Consortium.
All rights reserved.
For info, please visit http://www.isc.org/sw/dhcp/
Listening on LPF/eth0/00:04:75:75:46:b1
Sending on   LPF/eth0/00:04:75:75:46:b1
Sending on   Socket/fallback
DHCPRELEASE on eth0 to 192.168.15.254 port 67
send_packet: Network is unreachable
send_packet: please consult README file regarding broadcast address.











19:35:17




#ps -ef | grep honeyd


nobody   13190     1  0 12:07 ?        00:00:00 honeyd
root     14366  3756  0 12:35 pts/2    00:00:00 grep honeyd











19:35:34




#kill -15 13190












19:35:54




#ps -ef | grep honeyd


root     14386  3756  0 12:35 pts/2    00:00:00 grep honeyd











19:35:58




#ifdown eth0


ifdown: interface eth0 not configured











19:36:01




#ifup eth0


Internet Systems Consortium DHCP Client V3.0.4
Copyright 2004-2006 Internet Systems Consortium.
All rights reserved.
For info, please visit http://www.isc.org/sw/dhcp/
Listening on LPF/eth0/00:04:75:75:46:b1
Sending on   LPF/eth0/00:04:75:75:46:b1
Sending on   Socket/fallback
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 4
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 8
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 11
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 13
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 16
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 9
No DHCPOFFERS received.
No working leases in persistent database - sleeping.











19:37:10




#ps -ef | grep honeyd


root     14423  3756  0 12:37 pts/2    00:00:00 grep honeyd











19:37:45




#ps -ef | grep farpd


root     14430  3756  0 12:37 pts/2    00:00:00 grep farpd











19:37:51




#ip





ip6tables          ipcrm              iptables           iptunnel
ip6tables-restore  ipcs               iptables-restore
ip6tables-save     ipmaddr            iptables-save











19:37:51




#host





bash: host: command not found











19:38:18




#hostname


linux2











19:38:23




#host





hostid    hostname











19:38:23




#ip





ip6tables          ipcrm              iptables           iptunnel
ip6tables-restore  ipcs               iptables-restore
ip6tables-save     ipmaddr            iptables-save











19:38:23




#ico





ico          iconv        iconvconfig











19:38:23




#ifconfig


eth0      Link encap:Ethernet  HWaddr 00:04:75:75:46:B1
          inet6 addr: fe80::204:75ff:fe75:46b1/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:184842 errors:0 dropped:0 overruns:506 frame:0
          TX packets:161968 errors:16 dropped:0 overruns:0 carrier:5
          collisions:0 txqueuelen:1000
          RX bytes:63508570 (60.5 MiB)  TX bytes:16020768 (15.2 MiB)
          Interrupt:169 Base address:0x2c00
lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:34746 errors:0 dropped:0 overruns:0 frame:0
          TX packets:34746 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:5157510 (4.9 MiB)  TX bytes:5157510 (4.9 MiB)











19:39:01




#man ifconfig










19:40:37




#ifdown eth0


There is already a pid file /var/run/dhclient.eth0.pid with pid 14410
killed old client process, removed PID file
Internet Systems Consortium DHCP Client V3.0.4
Copyright 2004-2006 Internet Systems Consortium.
All rights reserved.
For info, please visit http://www.isc.org/sw/dhcp/
Listening on LPF/eth0/00:04:75:75:46:b1
Sending on   LPF/eth0/00:04:75:75:46:b1
Sending on   Socket/fallback
DHCPRELEASE on eth0 to 192.168.15.254 port 67
send_packet: Network is unreachable
send_packet: please consult README file regarding broadcast address.











19:40:42




#ifup eth0


Internet Systems Consortium DHCP Client V3.0.4
Copyright 2004-2006 Internet Systems Consortium.
All rights reserved.
For info, please visit http://www.isc.org/sw/dhcp/
Listening on LPF/eth0/00:04:75:75:46:b1
Sending on   LPF/eth0/00:04:75:75:46:b1
Sending on   Socket/fallback
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 4
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 11
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 19
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 16
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 8
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 3
No DHCPOFFERS received.
No working leases in persistent database - sleeping.











19:41:58




#ifup eth0


ifup: interface eth0 already configured











19:42:24




#ifdown eth0


There is already a pid file /var/run/dhclient.eth0.pid with pid 14515
killed old client process, removed PID file
Internet Systems Consortium DHCP Client V3.0.4
Copyright 2004-2006 Internet Systems Consortium.
All rights reserved.
For info, please visit http://www.isc.org/sw/dhcp/
Listening on LPF/eth0/00:04:75:75:46:b1
Sending on   LPF/eth0/00:04:75:75:46:b1
Sending on   Socket/fallback
DHCPRELEASE on eth0 to 192.168.15.254 port 67
send_packet: Network is unreachable
send_packet: please consult README file regarding broadcast address.











/dev/tty1
19:44:05




#ping 192.168.15.100





PING 192.168.15.100 (192.168.15.100) 56(84) bytes of data.
--- 192.168.15.100 ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3001ms











19:44:15




#ifconfig


eth0      Link encap:Ethernet  HWaddr 00:04:75:75:46:B1
          inet addr:192.168.15.201  Bcast:192.168.15.255  Mask:255.255.255.0
          inet6 addr: fe80::204:75ff:fe75:46b1/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:98 errors:0 dropped:0 overruns:0 frame:0
          TX packets:113 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:8026 (7.8 KiB)  TX bytes:93204 (91.0 KiB)
          Interrupt:169 Base address:0x2c00
lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)











19:44:23




#ping 192.168.15.200


PING 192.168.15.200 (192.168.15.200) 56(84) bytes of data.
64 bytes from 192.168.15.200: icmp_seq=1 ttl=64 time=0.189 ms
64 bytes from 192.168.15.200: icmp_seq=2 ttl=64 time=0.171 ms
64 bytes from 192.168.15.200: icmp_seq=3 ttl=64 time=0.184 ms
--- 192.168.15.200 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 1999ms
rtt min/avg/max/mdev = 0.171/0.181/0.189/0.013 ms











19:45:04




#ps -ef | grep honeyd


root      2454  2413  0 12:45 pts/0    00:00:00 grep honeyd











19:45:38




#farpd -i eth0  192.168.15.101


arpd[2460]: listening on eth0: arp and (dst 192.168.15.101) and not ether src 00:04:75:75:46:b1











19:46:16




#arping -a 192.168.15.0-255





arping: Can't resolve 192.168.15.0-255











19:46:31




#honeyd


Honeyd V1.5b Copyright (c) 2002-2004 Niels Provos
honeyd[2476]: started with
honeyd[2476]: listening promiscuously on eth0: (arp or ip proto 47 or (udp and src port 67 and dst port 68) or (ip )) and not ether src 00:04:75:75:46:b1
Honeyd starting as background process











19:47:03




#iptables -L


Chain INPUT (policy ACCEPT)
target     prot opt source               destination
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination











19:47:26




#iptables -L


Chain INPUT (policy ACCEPT)
target     prot opt source               destination
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination











19:48:43




#iptables -L


Chain INPUT (policy ACCEPT)
target     prot opt source               destination
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination











19:48:44




#iptables -L


Chain INPUT (policy ACCEPT)
target     prot opt source               destination
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination











19:48:48




#iptables -L


Chain INPUT (policy ACCEPT)
target     prot opt source               destination
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination











19:48:49




#vi /etc/honeypot/honeyd.conf










19:50:13




#loger _-----test-----___





bash: loger: command not found











19:52:32




#logger _-----test-----___












19:52:39




#iptables -L


Chain INPUT (policy ACCEPT)
target     prot opt source               destination
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination











/dev/pts/3
19:53:47




#arp -a


? (192.168.15.200) at 00:0A:01:D4:D1:E3 [ether] on eth0
? (192.168.15.202) at 00:04:76:A1:EF:BB [ether] on eth0
? (192.168.15.254) at 00:0A:01:D4:D1:39 [ether] on eth0











19:53:53




#arping 192.168.15.102





#set default default udp action block
##set default default icmp action block
#create router
#set router personality "Cisco 1601R router running IOS 12.1(5)"
#set router default tcp action reset
:q
  arping: Can't resolve 192.168.15.102arp











/dev/tty1
19:54:11




#vi /etc/honeypot/honeyd.conf










/dev/pts/3
19:54:24




#arping 192.168.15.102


root@linux3's password:
                        ARPING 192.168.15.102
60 bytes from 00:04:76:a1:ef:bb (192.168.15.102): index=0 time=402.927 usec
60 bytes from 00:04:76:a1:ef:bb (192.168.15.102): index=1 time=774.860 usec
60 bytes from 00:04:76:a1:ef:bb (192.168.15.102): index=2 time=356.913 usec
60 bytes from 00:04:76:a1:ef:bb (192.168.15.102): index=3 time=670.910 usec
60 bytes from 00:04:76:a1:ef:bb (192.168.15.102): index=4 time=339.031 usec
60 bytes from 00:04:76:a1:ef:bb (192.168.15.102): index=5 time=682.116 usec
60 bytes from 00:04:76:a1:ef:bb (192.168.15.102): index=6 time=359.058 usec
60 bytes from 00:04:76:a1:ef:bb (192.168.15.102): index=7 time=664.949 usec
60 bytes from 00:04:76:a1:ef:bb (192.168.15.102): index=8 time=344.992 usec
60 bytes from 00:04:76:a1:ef:bb (192.168.15.102): index=9 time=674.009 usec
60 bytes from 00:04:76:a1:ef:bb (192.168.15.102): index=10 time=419.855 usec
60 bytes from 00:04:76:a1:ef:bb (192.168.15.102): index=11 time=719.070 usec
--- 192.168.15.102 statistics ---
7 packets transmitted, 12 packets received, -71% unanswered











/dev/tty1
19:54:29




#ssh linux3


root@linux3's password:
Permission denied, please try again.
root@linux3's password:
Permission denied, please try again.
root@linux3's password:
Last login: Fri Jun 22 10:12:24 2007 from 192.168.15.201
Linux linux3 2.6.18-4-686 #1 SMP Mon Mar 26 17:17:36 UTC 2007 i686
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
l3-agent is already running: pid=4349; pidfile=/root/.lilalo/l3-agent.pid











/dev/pts/3
19:54:52




#arp -a


? (192.168.15.200) at 00:0A:01:D4:D1:E3 [ether] on eth0
? (192.168.15.202) at 00:04:76:A1:EF:BB [ether] on eth0
? (192.168.15.254) at 00:0A:01:D4:D1:39 [ether] on eth0











19:54:57




#arping 192.168.15.102


ARPING 192.168.15.102
60 bytes from 00:04:76:a1:ef:bb (192.168.15.102): index=0 time=293.016 usec
60 bytes from 00:04:76:a1:ef:bb (192.168.15.102): index=1 time=805.140 usec
60 bytes from 00:04:76:a1:ef:bb (192.168.15.102): index=2 time=352.144 usec
60 bytes from 00:04:76:a1:ef:bb (192.168.15.102): index=3 time=682.116 usec
60 bytes from 00:04:76:a1:ef:bb (192.168.15.102): index=4 time=340.939 usec
60 bytes from 00:04:76:a1:ef:bb (192.168.15.102): index=5 time=654.936 usec
--- 192.168.15.102 statistics ---
3 packets transmitted, 6 packets received, -100% unanswered











19:55:25




#arp -a


? (192.168.15.200) at 00:0A:01:D4:D1:E3 [ether] on eth0
? (192.168.15.202) at 00:04:76:A1:EF:BB [ether] on eth0
? (192.168.15.254) at 00:0A:01:D4:D1:39 [ether] on eth0











19:55:29




#ping 192.168.15.102





PING 192.168.15.102 (192.168.15.102) 56(84) bytes of data.
--- 192.168.15.102 ping statistics ---
24 packets transmitted, 0 received, 100% packet loss, time 22999ms









прошло 11 минут




/dev/tty1
20:07:02




#iptables -L


Chain INPUT (policy ACCEPT)
target     prot opt source               destination
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination









прошло 10 минут




20:17:27




#ssh linux1















20:17:58




#cd /etc/












20:18:41




#ssh linux3


root@linux3's password:
Last login: Fri Jun 22 16:55:11 2007 from 192.168.15.201
Linux linux3 2.6.18-4-686 #1 SMP Mon Mar 26 17:17:36 UTC 2007 i686
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
l3-agent is already running: pid=4349; pidfile=/root/.lilalo/l3-agent.pid











/dev/tty3
20:25:29




#ps -ef | grep hon


nobody    2477     1  0 12:47 ?        00:00:00 honeyd
root      3535  3512  0 13:25 pts/5    00:00:00 grep hon











20:25:43




#ping 192.168.15.101





-r--r--r-- 1 root   root    0 2007-06-22 17:20 status
dr-xr-xr-x 3 nobody nogroup 0 2007-06-22 17:22 task
-r--r--r-- 1 root   root    0 2007-06-22 17:22 wchan
[root@mail2:~]# pdw
bash: pdw: command not found
[root@mail2:~]# pwd
/home/user
PING 192.168.15.101 (192.168.15.101) 56(84) bytes of data.
--- 192.168.15.101 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 1999ms











20:26:02




#ping 192.168.15.100


PING 192.168.15.100 (192.168.15.100) 56(84) bytes of data.
64 bytes from 192.168.15.100: icmp_seq=1 ttl=128 time=0.969 ms
64 bytes from 192.168.15.100: icmp_seq=2 ttl=128 time=0.508 ms
--- 192.168.15.100 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1000ms
rtt min/avg/max/mdev = 0.508/0.738/0.969/0.232 ms









Суббота (06/23/07)


/dev/pts/3
10:06:35




$screen -x








прошла 81 минута




/dev/pts/7
11:27:48




#ping linux3


[root@linux3:~]#
PING linux3.unix.nt (127.0.1.1) 56(84) bytes of data.
64 bytes from linux3.unix.nt (127.0.1.1): icmp_seq=1 ttl=64 time=0.053 ms
64 bytes from linux3.unix.nt (127.0.1.1): icmp_seq=2 ttl=64 time=0.051 ms
64 bytes from linux3.unix.nt (127.0.1.1): icmp_seq=3 ttl=64 time=0.058 ms
64 bytes from linux3.unix.nt (127.0.1.1): icmp_seq=4 ttl=64 time=0.056 ms
64 bytes from linux3.unix.nt (127.0.1.1): icmp_seq=5 ttl=64 time=0.057 ms
--- linux3.unix.nt ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4002ms
rtt min/avg/max/mdev = 0.051/0.055/0.058/0.002 ms











11:28:02




#ping linux2


[root@linux3:~]#
[root@linux3:~]#
[root@linux3:~]#
PING linux2.unix.nt (192.168.15.201) 56(84) bytes of data.
64 bytes from 192.168.15.201: icmp_seq=1 ttl=64 time=0.181 ms
64 bytes from 192.168.15.201: icmp_seq=2 ttl=64 time=0.209 ms
64 bytes from 192.168.15.201: icmp_seq=3 ttl=64 time=0.207 ms
--- linux2.unix.nt ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 10009ms
rtt min/avg/max/mdev = 0.181/0.199/0.209/0.012 ms











11:28:18




#ping linux2


64 bytes from 192.168.15.201: icmp_seq=621 ttl=64 time=0.229 ms
64 bytes from 192.168.15.201: icmp_seq=622 ttl=64 time=0.235 ms
64 bytes from 192.168.15.201: icmp_seq=623 ttl=64 time=0.369 ms
64 bytes from 192.168.15.201: icmp_seq=624 ttl=64 time=0.266 ms
64 bytes from 192.168.15.201: icmp_seq=625 ttl=64 time=0.196 ms
64 bytes from 192.168.15.201: icmp_seq=626 ttl=64 time=0.210 ms
64 bytes from 192.168.15.201: icmp_seq=627 ttl=64 time=0.273 ms
64 bytes from 192.168.15.201: icmp_seq=628 ttl=64 time=0.202 ms
64 bytes from 192.168.15.201: icmp_seq=629 ttl=64 time=0.191 ms
64 bytes from 192.168.15.201: icmp_seq=630 ttl=64 time=0.223 ms
...
64 bytes from 192.168.15.201: icmp_seq=760 ttl=64 time=0.199 ms
64 bytes from 192.168.15.201: icmp_seq=761 ttl=64 time=0.170 ms
64 bytes from 192.168.15.201: icmp_seq=762 ttl=64 time=0.191 ms
64 bytes from 192.168.15.201: icmp_seq=763 ttl=64 time=0.204 ms
64 bytes from 192.168.15.201: icmp_seq=764 ttl=64 time=0.202 ms
64 bytes from 192.168.15.201: icmp_seq=765 ttl=64 time=0.199 ms
64 bytes from 192.168.15.201: icmp_seq=766 ttl=64 time=0.242 ms
64 bytes from 192.168.15.201: icmp_seq=767 ttl=64 time=0.206 ms
64 bytes from 192.168.15.201: icmp_seq=768 ttl=64 time=0.198 ms
64 bytes from 192.168.15.201: icmp_seq=769 ttl=64 time=0.201 ms









прошло 26 минут




/dev/pts/3
11:54:52




$exi





bash: exi: command not found









прошла 21 минута




12:16:45




$exit


exit
Connection to linux3 closed.









прошло 35 минут




/dev/tty1
12:52:02




#ifconfig


eth0      Link encap:Ethernet  HWaddr 00:04:75:75:46:B1
          inet addr:192.168.15.201  Bcast:192.168.15.255  Mask:255.255.255.0
          inet6 addr: fe80::204:75ff:fe75:46b1/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:26 errors:0 dropped:0 overruns:1 frame:0
          TX packets:34 errors:0 dropped:0 overruns:0 carrier:1
          collisions:0 txqueuelen:1000
          RX bytes:2720 (2.6 KiB)  TX bytes:3755 (3.6 KiB)
          Interrupt:169 Base address:0x2c00
lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)











12:52:31




#route


Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.15.0    *               255.255.255.0   U     0      0        0 eth0
default         192.168.15.254  0.0.0.0         UG    0      0        0 eth0











12:52:42




#apt-cache search snort


acidbase - Basic Analysis and Security Engine
airsnort - WLAN sniffer
ippl - IP protocols logger
libprelude-dev - Hybrid Intrusion Detection System [ Development files ]
libprelude2 - Hybrid Intrusion Detection System [ Base library ]
libpreludedb-dev - Hybrid Intrusion Detection System [ Development files ]
libpreludedb0 - Hybrid Intrusion Detection System [ Base library ]
oinkmaster - Snort rules manager
psad - The Port Scan Attack Detector
snort - Flexible Network Intrusion Detection System
snort-common - Flexible Network Intrusion Detection System [common files]
snort-doc - Documentation for the Snort IDS [documentation]
snort-mysql - Flexible Network Intrusion Detection System [MySQL]
snort-pgsql - Flexible Network Intrusion Detection System [PostgreSQL]
snort-rules-default - Flexible Network Intrusion Detection System ruleset
wflogs - The modular firewall log analyzer of the WallFire project











12:53:20




#apt-get install snort


Selecting previously deselected package snort-common.
Unpacking snort-common (from .../snort-common_2.3.3-11_all.deb) ...
Selecting previously deselected package snort.
Unpacking snort (from .../snort_2.3.3-11_i386.deb) ...
Setting up snort-rules-default (2.3.3-11) ...
Setting up snort-common (2.3.3-11) ...
Setting up snort (2.3.3-11) ...
No snort instance found to be stopped!
Starting Network Intrusion Detection System: snort(eth0)No /etc/snort/snort.eth0.conf, defaulting to snort.conf
.











12:55:09




#apt-get install acidbase


 │ An error seems to have occurred while installing the database. If it's    │
 │ of any help, this was the error encountered:                              │
 │                                                                           │
 │ ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using      │
 │ password: YES)                                                            │
 │                                                                           │
 │ At this point, you have the option to retry or abort the operation. If    │
 │ you choose "retry", you will be prompted with all the configuration       │
 │ questions once more and another attempt will be made at performing the    │
 │ operation. "retry (skip questions)" will immediately attempt the          │
 │ operation again, skipping all questions.  If you choose "abort", the      │
 │ operation will fail and you will need to downgrade, reinstall,            │
 │ reconfigure this package, or otherwise manually intervene to continue     │
 │ using it.  If you choose "ignore", the operation will continue, ignoring  │
 │ further errors from dbconfig-common.                                      │
 │                                                                           │
 │                                  <Ok>                                     │
 │                                                                           │
 └───────────────────────────────────────────────────────────────────────────┘











/dev/tty2
13:00:25




#mysql


Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 9
Server version: 5.0.32-Debian_7etch1-log Debian etch distribution
Type 'help;' or '\h' for help. Type '\c' to clear the buffer.
mysql> exit
Bye











13:00:35




#mysql -u root -p


Enter password:
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 10
Server version: 5.0.32-Debian_7etch1-log Debian etch distribution
Type 'help;' or '\h' for help. Type '\c' to clear the buffer.
mysql> set password for user root@localhost=password('password');
ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'root@localhost=password('password')' at line 1
mysql> set password for root@localhost=password('password');
Query OK, 0 rows affected (0.00 sec)
mysql> exit
Bye











13:02:57




#mysql -u root -p





Enter password:
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: NO)











13:03:00




#mysql -u root -p


Enter password:
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 12
Server version: 5.0.32-Debian_7etch1-log Debian etch distribution
Type 'help;' or '\h' for help. Type '\c' to clear the buffer.
mysql> exit
Bye











13:03:08




#logger ___test____


#url = http://www.snort.org/dl/rules/snortrules-snapshot-2_1.tar.gz
url=http://www.snort.org/pub-bin/oinkmaster.cgi/5a08f649c16a278e1012e1c84bdc8fab9a70e2a4/snortrules-snapshot-2.3.tar.gz
# url = http://www.snort.org/dl/rules/snortrules-snapshot-2_0.tar.gz
# To use CVS snapshots
# url = http://www.snort.org/dl/rules/snortrules-snapshot-CURRENT.tar.gz
# --------------------
"/etc/oinkmaster.conf" 164L, 8028C written
[root@linux3:~]# oinkmaster -o /etc/snort/rules/
Loading /etc/oinkmaster.conf
Downloading file from http://www.snort.org/pub-bin/oinkmaster.cgi/*oinkcode*/snortrules-snapshot-2.3.tar.gz...











/dev/tty1
13:03:46




#apt-get install snort-mysql


Selecting previously deselected package snort-mysql.
(Reading database ... 27686 files and directories currently installed.)
Unpacking snort-mysql (from .../snort-mysql_2.3.3-11_i386.deb) ...
Setting up snort-mysql (2.3.3-11) ...
No snort instance found to be stopped!
WARN: /etc/snort/db-pending-config file found
WARN: Snort will not start as its database is not yet configured.
WARN: Please configure the database as described in
WARN: /usr/share/doc/snort-{pgsql,mysql}/README-database.Debian
WARN: and remove /etc/snort/db-pending-config
invoke-rc.d: initscript snort, action "start" failed.











13:05:02




#oinkmaster





bash: oinkmaster: command not found











/dev/pts/3
13:06:13




#ssh user@linux3


user@linux3's password:
Linux linux3 2.6.18-4-686 #1 SMP Mon Mar 26 17:17:36 UTC 2007 i686
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
You have new mail.
Last login: Sat Jun 23 09:39:38 2007 from 192.168.15.254
l3-agent is already running: pid=3998; pidfile=/home/user/.lilalo/l3-agent.pid











/dev/pts/7
13:10:06




#exit


exit
Connection to linux3 closed.











/dev/tty2
13:10:35




#snort -h





snort: option requires an argument -- h
   ,,_     -*> Snort! <*-
  o"  )~   Version 2.3.3 (Build 14)
   ''''    By Martin Roesch & The Snort Team: http://www.snort.org/team.html
           (C) Copyright 1998-2004 Sourcefire Inc., et al.
USAGE: snort [-options] <filter options>
Options:
        -A         Set alert mode: fast, full, console, or none  (alert file alerts only)
                   "unsock" enables UNIX socket logging (experimental).
        -b         Log packets in tcpdump format (much faster!)
...
        -u <uname> Run snort uid as <uname> user (or uid) after initialization
        -U         Use UTC for timestamps
        -v         Be verbose
        -V         Show version number
        -w         Dump 802.11 management and control frames
        -X         Dump the raw packet data starting at the link layer
        -y         Include year in timestamp in the alert and log files
        -z         Set assurance mode, match on established sesions (for TCP)
        -?         Show this information
<Filter Options> are standard BPF options, as seen in TCPDump











13:12:37




#cd /etc/o





oinkmaster.conf  openoffice/      opt/









прошло 19 минут




/dev/tty1
13:32:20




#apt-get install  oinkmaster


Reading package lists... Done
Building dependency tree... Done
The following extra packages will be installed:
  libarchive-tar-perl libcompress-zlib-perl libio-zlib-perl
Suggested packages:
  libio-string-perl
The following NEW packages will be installed:
  libarchive-tar-perl libcompress-zlib-perl libio-zlib-perl oinkmaster
0 upgraded, 4 newly installed, 0 to remove and 0 not upgraded.
Need to get 215kB of archives.
...
Selecting previously deselected package libio-zlib-perl.
Unpacking libio-zlib-perl (from .../libio-zlib-perl_1.04-1_all.deb) ...
Selecting previously deselected package libarchive-tar-perl.
Unpacking libarchive-tar-perl (from .../libarchive-tar-perl_1.30-2_all.deb) ...
Selecting previously deselected package oinkmaster.
Unpacking oinkmaster (from .../oinkmaster_2.0-1_all.deb) ...
Setting up libcompress-zlib-perl (1.42-2) ...
Setting up libio-zlib-perl (1.04-1) ...
Setting up libarchive-tar-perl (1.30-2) ...
Setting up oinkmaster (2.0-1) ...









Статистика
Время первой команды журнала19:27:11 2007- 6-22
Время последней команды журнала13:32:20 2007- 6-23
Количество командных строк в журнале101
Процент команд с ненулевым кодом завершения, %12.87
Процент синтаксически неверно набранных команд, % 4.95
Суммарное время работы с терминалом *, час 2.47
Количество командных строк в единицу времени, команда/мин 0.68
Частота использования команд
ping11|=========|  9.91%
ps10|=========|  9.01%
grep10|=========|  9.01%
ifconfig8|=======|  7.21%
ifup7|======|  6.31%
iptables7|======|  6.31%
ifdown6|=====|  5.41%
mysql4|===|  3.60%
arping4|===|  3.60%
apt-get4|===|  3.60%
ssh4|===|  3.60%
arp3|==|  2.70%
mii-tool3|==|  2.70%
farpd3|==|  2.70%
host2|=|  1.80%
cd2|=|  1.80%
logger2|=|  1.80%
ip2|=|  1.80%
vi2|=|  1.80%
kill2|=|  1.80%
exit2|=|  1.80%
screen1||  0.90%
loger1||  0.90%
man1||  0.90%
snort1||  0.90%
fa1||  0.90%
ico1||  0.90%
route1||  0.90%
honeyd1||  0.90%
exi1||  0.90%
oinkmaster1||  0.90%
hostname1||  0.90%
apt-cache1||  0.90%
ifconfog1||  0.90%
____
*) Интервалы неактивности длительностью 30 минут и более не учитываются
Справка
    Для того чтобы использовать LiLaLo, не нужно знать ничего особенного:
    всё происходит само собой.
    Однако, чтобы ведение и последующее использование журналов
    было как можно более эффективным, желательно иметь в виду следующее:
    
    
    
  1.  
    В журнал автоматически попадают все команды, данные в любом терминале системы.
    
    2. 
    
  2. 
    Для того чтобы убедиться, что журнал на текущем терминале ведётся, 
    и команды записываются, дайте команду w.
    В поле WHAT, соответствующем текущему терминалу, 
    должна быть указана программа script.
    
    3. 
    
  3. 
    Команды, при наборе которых были допущены синтаксические ошибки, 
    выводятся перечёркнутым текстом:

    

    


    $ l s-l
    

    bash: l: command not found

    
    		

    

    

    
    
    4. 
    
  4. 
    Если код завершения команды равен нулю, 
    команда была выполнена без ошибок.
    Команды, код завершения которых отличен от нуля, выделяются цветом.

    

    


    $ test 5 -lt 4
    

    		

    

    
    Обратите внимание на то, что код завершения команды может быть отличен от нуля
    не только в тех случаях, когда команда была выполнена с ошибкой.
    Многие команды используют код завершения, например, для того чтобы показать результаты проверки

    
    
    5. 
    
  5. 
    Команды, ход выполнения которых был прерван пользователем, выделяются цветом.

    

    


    $ find / -name abc
    

    find: /home/devi-orig/.gnome2: Keine Berechtigung
find: /home/devi-orig/.gnome2_private: Keine Berechtigung
find: /home/devi-orig/.nautilus/metafiles: Keine Berechtigung
find: /home/devi-orig/.metacity: Keine Berechtigung
find: /home/devi-orig/.inkscape: Keine Berechtigung
^C

    
    		

    

    

    
    
    6. 
    
  6. 
    Команды, выполненные с привилегиями суперпользователя,
    выделяются слева красной чертой.

    

    


    # id
    

    uid=0(root) gid=0(root) Gruppen=0(root)

    
    		

    

    
    
    
    
    7. 
    
  7. 
    Изменения, внесённые в текстовый файл с помощью редактора, 
    запоминаются и показываются в журнале в формате ed.
    Строки, начинающиеся символом "<", удалены, а строки,
    начинающиеся символом ">" -- добавлены.

    

    


    $ vi ~/.bashrc
    

    2a3,5
>    if [ -f /usr/local/etc/bash_completion ]; then
>         . /usr/local/etc/bash_completion
>        fi

    		

    

    
    
    
    
    8. 
    
  8. 
    Для того чтобы изменить файл в соответствии с показанными в диффшоте
    изменениями, можно воспользоваться командой patch.
    Нужно скопировать изменения, запустить программу patch, указав в
    качестве её аргумента файл, к которому применяются изменения,
    и всавить скопированный текст:

    

    


    $ patch ~/.bashrc
    
    		

    

    
    В данном случае изменения применяются к файлу ~/.bashrc
    
    9. 
    
  9. 
    Для того чтобы получить краткую справочную информацию о команде, 
    нужно подвести к ней мышь. Во всплывающей подсказке появится краткое
    описание команды.
    
    
    
    
    Если справочная информация о команде есть, 
    команда выделяется голубым фоном, например: vi.
    Если справочная информация отсутствует,
    команда выделяется розовым фоном, например: notepad.exe.
    Справочная информация может отсутствовать в том случае, 
    если (1) команда введена неверно; (2) если распознавание команды LiLaLo выполнено неверно;
    (3) если информация о команде неизвестна LiLaLo.
    Последнее возможно для редких команд.
    
    10. 
    
  10. 
    Большие, в особенности многострочные, всплывающие подсказки лучше 
    всего показываются браузерами KDE Konqueror, Apple Safari и Microsoft Internet Explorer.
    В браузерах Mozilla и Firefox они отображаются не полностью, 
    а вместо перевода строки выводится специальный символ.
    
    11. 
    
  11. 
    Время ввода команды, показанное в журнале, соответствует времени 
    начала ввода командной строки, которое равно тому моменту, 
    когда на терминале появилось приглашение интерпретатора
    
    12. 
    
  12. 
    Имя терминала, на котором была введена команда, показано в специальном блоке.
    Этот блок показывается только в том случае, если терминал
    текущей команды отличается от терминала предыдущей.
    
    13. 
    
  13. 
    Вывод не интересующих вас в настоящий момент элементов журнала,
    таких как время, имя терминала и других, можно отключить.
    Для этого нужно воспользоваться формой управления журналом
    вверху страницы.
    
    14. 
    
  14. 
    Небольшие комментарии к командам можно вставлять прямо из командной строки.
    Комментарий вводится прямо в командную строку, после символов #^ или #v.
    Символы ^ и v показывают направление выбора команды, к которой относится комментарий:
    ^ - к предыдущей, v - к следующей.
    Например, если в командной строке было введено:

    $ whoami

    

    user

    

    $ #^ Интересно, кто я?

    
    в журнале это будет выглядеть так:
    

    $ whoami

    

    user

    

    

      Интересно, кто я?
     
     
    
    15. 
    
  15. 
    Если комментарий содержит несколько строк,
    его можно вставить в журнал следующим образом:

    $ whoami

    

    user

    

    $ cat > /dev/null #^ Интересно, кто я?

    

    Программа whoami выводит имя пользователя, под которым 
мы зарегистрировались в системе.
-
Она не может ответить на вопрос о нашем назначении 
в этом мире.

    
    В журнале это будет выглядеть так:

    

    


    $ whoami
    

    user

    

    Интересно, кто я?
    
Программа whoami выводит имя пользователя, под которым
    
мы зарегистрировались в системе.
    

    
Она не может ответить на вопрос о нашем назначении
    
в этом мире.
    

    
    		

    

    
    Для разделения нескольких абзацев между собой
    используйте символ "-", один в строке.
    
    

    16. 
    
  16. 
    Комментарии, не относящиеся непосредственно ни к какой из команд, 
    добавляются точно таким же способом, только вместо симолов #^ или #v 
    нужно использовать символы #=
    
    17. 

    
  17. 
    Содержимое файла может быть показано в журнале.
    Для этого его нужно вывести с помощью программы cat.
    Если вывод команды отметить симоволами #!, 
    содержимое файла будет показано в журнале
    в специально отведённой для этого секции.
    
    18. 

    
    
    
  18. 
    Для того чтобы вставить скриншот интересующего вас окна в журнал,
    нужно воспользоваться командой l3shot.
    После того как команда вызвана, нужно с помощью мыши выбрать окно, которое
    должно быть в журнале.
    
    19. 
    
    

    
    
    
  19. 
    Команды в журнале расположены в хронологическом порядке.
    Если две команды давались одна за другой, но на разных терминалах,
    в журнале они будут рядом, даже если они не имеют друг к другу никакого отношения.

    1
    2
3   
    4

    
    Группы команд, выполненных на разных терминалах, разделяются специальной линией.
    Под этой линией в правом углу показано имя терминала, на котором выполнялись команды.
    Для того чтобы посмотреть команды только одного сенса, 
    нужно щёкнуть по этому названию.
    
    20. 
    
    



О программе
    

    LiLaLo (L3) расшифровывается как Live Lab Log.

    Программа разработана для повышения эффективности обучения Unix/Linux-системам.

    (c) Игорь Чубин, 2004-2008

    

$Id$