[sf-lug] Who done it? ; -) Re: updated: Re: Status of SF-LUG / Linux meeting(s) @ Noisebridge? & SF-LUG web site (mis?)information thereof

Thu May 23 18:01:00 PDT 2019

> From: jim <jim at well.com>
> Subject: Re: [sf-lug] Who done it? ; -) Re: updated: Re: Status of  
> SF-LUG / Linux meeting(s) @ Noisebridge? & SF-LUG web site  
> (mis?)information thereof
> Date: Thu, 23 May 2019 12:49:58 -0400

> as far as i know, i am the only person
> who has ever edited the SF-LUG web page.

Well, as I'd also edited it (at least once now?), that'd be at least
two persons who'd edited it - at minimum - thus far.
http://linuxmafia.com/pipermail/sf-lug/2019q2/014118.html

Anyway, the folks that have access to edit it, and other information,
listed here:
https://www.wiki.balug.org/wiki/doku.php?id=sf-lug:resources_etc

And ... I was kind'a curious, and to show as "exercise", if I could
reasonably easily determine who - or who likely - last changed the
contents of the SF-LUG web page ... and likewise as to who first added
the Noisebridge mention(s)/link(s) on that web page; and firstly what
could be determined of that as a mere mortal user (not superuser, UID 0,
"root") on that host, ... and if/where that weren't sufficient, what
relevant data beyond that I might have of have access to (including via
superuser, backups, etc.).

"Who done it" is generally easier to determine if it's more recent,
and/or logs and/or backups are retained longer (also including backups),
and/or more data is logged (and potentially securely and remotely so, or
also so).

> On 5/23/19 1:42 AM, Michael Paoli wrote:
>>> From: "Michael Paoli" <Michael.Paoli at cal.berkeley.edu>
>>> Subject: updated: Re: [sf-lug] Status of SF-LUG / Linux meeting(s)  
>>> @ Noisebridge? & SF-LUG web site (mis?)information thereof
>>> Date: Wed, 22 May 2019 21:40:53 -0700
>>
>>> $ TZ=GMT0 stat index.php
>>>   File: index.php
>>>   Size: 3902            Blocks: 8          IO Block: 4096 regular file
>>> Device: fe02h/65026d    Inode: 166014      Links: 1
>>> Access: (0644/-rw-r--r--)  Uid: (22035/sflugwww)   Gid: (22035/sflugwww)
>>> Access: 2019-05-23 04:26:15.533244867 +0000
>>> Modify: 2016-07-18 16:18:38.521393742 +0000
>>> Change: 2016-07-18 16:18:38.521393742 +0000
>>>  Birth: -
>>> $
>>
>> So, who made or likely made the earlier edits?
>>
>> $ last | tail -n 1
>> wtmp begins Thu May  9 20:26:58 2019
>> $ ls -ltr /var/log/wtmp*
>> -rw-rw-r-- 1 root utmp 17664 Apr 30 10:25 /var/log/wtmp.1
>> -rw-rw-r-- 1 root utmp  8832 May 12 17:35 /var/log/wtmp
>> $
>>
>> Okay, wtmp data not saved back that far (and I'm not going to bother
>> to pull it from backups) ...
>> $ lastlog | fgrep -v '**Never logged in**' | sort -k 9,9bnr -k  
>> 5,5Mr -k 6,6br -k 7,7r
>> mpaoli           pts/0    198.144.194.235  Sun May 12 17:35:25 -0700 2019
>> rick             pts/9    198.144.195.186  Tue Apr 30 09:57:34 -0700 2019
>> kdavalos         pts/3    50.1.57.152      Fri Dec 14 07:39:29 -0800 2018
>> jstockford       pts/9    173-13-130-174-s Thu Jul 28 21:20:37 -0700 2016
>> thawley          pts/8    104-244-27-45.pu Thu Jan 14 22:05:40 -0800 2016
>> sdubois          pts/0    c-76-103-152-134 Sun Mar  9 17:27:01 -0700 2014
>> grantbow         pts/8    173-8-189-243-sf Sun Apr 28 13:50:11 -0700 2013
>> root             ttyS0                     Tue Feb 28 23:12:31 -0800 2012
>> Username         Port     From             Latest
>> $
>> Looks like last edit was probably by jstockford ... though that may or may
>> not have been or included any changes related to or addition of
>> Noisebridge bits in there.
>> Let's see ...
>> $ wget -q -O -  
>> 'https://web.archive.org/web/20090702064445id_/http://www.sf-lug.org:80/' |  
>> wc
>>      77     594    4310
>> $ wget -q -O -  
>> 'https://web.archive.org/web/20090702064445id_/http://www.sf-lug.org:80/' |  
>> fgrep -i noisebridge
>> $ wget -q -O -  
>> 'https://web.archive.org/web/20100305103628id_/http://www.sf-lug.org:80/' |  
>> wc
>>      95     770    5299
>> $ wget -q -O -  
>> 'https://web.archive.org/web/20100305103628id_/http://www.sf-lug.org:80/' |  
>> fgrep -i noisebridge
>> <li>Support the Noisebridge Linux Discussion meeting on Wednesday  
>> evenings, from 6:00 PM to 8:00 PM (or so) in the Turing  
>> classroom.</li>
>> <li>Come to the Linux system administration certification study  
>> group from 3:00 PM to 6:00 PM in the Turing classroom at  
>> Noisebridge.</li>
>> Noisebridge is located at 2169 Mission Street, very near 18th  
>> Street, in San Fraicisco. <A  
>> href="http://www.noisebridge.net">Noisebridge</A>
>> $
>> ... so, though it's changed some since then, looks like Noisebridge
>> probably first hit the SF-LUG web page in the range between
>> approximately 2009-07-02 and 2010-03-05 ... my lastlog data - and possibly
>> that (virtual) host itself, probably doesn't go back (quite) that far.
>> There might be some old backup(s)/data of predecessor host(s) ... but I'm
>> not going to bother checking.
>>
>> Looking over some log history
>> file:/var/local/log/log
>> 2015-08-20 Michael Paoli
>> qemu-kvm balug host on physical host vicki found to be down or inaccessible,
>> likewise for physical host vicki (presumably physical host disconnected
>> from network and/or power at colo or removed from colo)
>>
>> 2015-08-22 Michael Paoli
>> Completed restoration of backup to newly created balug qemu-kvm VM residing
>> atop a different physical host, reconfigured network and DNS for new IPv4
>> location.
>> applied stable security/critical/important bug fix update(s):
>>
>> So ... any (earlier) details on that would've been on the (prior) sflug VM,
>> as once colo stuff was "lost" (network disconnected), the SF-LUG relevant
>> stuff was restored onto a new balug VM.  Ye olde sflug VM is (probably)
>> still on vicki and/or I might have old backup copy(/ies) of it ... but
>> not gonna check at present.