While still not completely finished, I love the lively effect the jQuery animation gives the menu at the top of this page. One day I’ll get around to sorting out the images, but for now, it’s a good start.
A friend of mine pointed me to a cool script that’s helped me combat dictionary attacks on my server. I guess I’d really never paid that much attention, but once I started seeking out attempted break ins to my box from various names and hosts, I knew I had to do something.
In came DenyHosts, which is a daemon that monitors your log file. You can tweak the config file to your liking, but basically it works like this.
Any and every attempted ssh get logged in /var/log/secure file and every ftp gets placed in /var/log/messages file…DenyHosts monitors these log files. If user “hacker” tries to log in via ssh to your box more than the amount of times you specify in your configuration file, the Ip they attempt to log in from gets automatically added to the /etc/hosts.deny file.
My current configuration is set to ban “ALL” access to my machine from any Ip that incorrectly specifies a user name/password combo 5 times. I could be more strict than that, but for now it works quite well.
Unlike a dynamic Ip, which changes from time to time, a static Ip defines me…and my box. It never changes. So, it’s up to me and my firewall/security to thwart attacks on the box, and those attacks are usually defined as such:
“In cryptanalysis and computer security, a dictionary attack is a technique for defeating a cipher or authentication mechanism by trying to determine its decryption key or passphrase by searching likely possibilities.”
The point of a dictionary attack? If access can be had to your machine by an outside source, it can then use your box(Ip) as a relay point to send out spam and all sort of other terrible things.
So, when I first started up DenyHosts and checked the “users-invalid” file in /usr/share/denyhosts, I was pretty shocked to see the amount of invalid users that have attempted to log in to my box.
My next test is what’s called a Honey Pot.
“In computer terminology, a honeypot is a trap set to detect, deflect, or in some manner counteract attempts at unauthorized use of information systems. Generally it consists of a computer, data, or a network site that appears to be part of a network, but is actually isolated, (un)protected, and monitored, and which seems to contain information or a resource of value to attackers.”