Skip to content

Tweaking My Server Security

Over the past few weeks my web/email server has been attacked multiple times. So I’ve started hardening my defenses. Stay tuned as I will be documenting what I do and what I learn. Today I’ve been experimenting with iptables and the settings for my sshd (the server that allows me to connect to the web server “behind the scenes”).

Just this morning as I was tweaking things I “watched” someone in Russia try to guess passwords and account names. He was at 212.110.146.180 (u590.so-com.net) in case anyone is interested.

One of the biggest things I need to do is to re-train my customers to use a different program to upload files to their web sites. Right now I have them set to use FTP, but that needs to go away. SFTP looks like it will be the way to do things.

Misc Update for 2010-07-06

Spotus, I am receiving spam to the email address I gave only to spot.us. Did you guys sell out, have a privacy breach, or post my email?

FanBox.com Spam

I just got a message from someone I don’t know, with a return address of fbNOREPLY@myfanbox.com. The message was:

-fake name- says you should see this video clip.

-fake name- thinks you will really like this YouTube Video. Check it out!

This email was sent by -fake name- using the Application: Youtube Video Seach. You can stop receiving emails here.
– , ,

I’ve now blocked all of these domains: myfanbox.com fanbox.com fanboxapps.com sms.ac fanboxnotes.com

How To Succeed At Twitter

Here are a few tips on increasing your Twitter effectiveness

1. Repeat the same tweet day after day. People may forget your information, they need to hear it multiple times.

1b. Corollary: If your information is really important, post the same tweet multiple times per day.

2. Post inane information, such as what you had for lunch. People are interested, and besides, you can’t really say anything substantive in 140 characters anyways.

2b. Corollary: Post more than ten times per hour. For eight to ten hours a day. People want to know what you’re doing throughout the day. “Good morning” or “Good afternoon” posts are helpful.

3. Customize your twitter background with a tiny image that repeats many times. Your artwork isn’t at all distracting when reading an individual post.

3b. Corollary: Customize your avatar with the same image as your background image. Using your existing logo as an avatar is silly.

4. Customize the appearance of twitter pages with different colors and fonts than your existing web site. Using your existing branding and style is silly.

4b. Corollary: Make the fonts and colors you choose as different as possible from your existing marketing materials. Differing styles makes your organization look larger.

5. Only provide links to your own web site. Why take the chance a reader may visit the competition?

5b. Corollary: Only link to your home page. Once someone is there, they can navigate your site to find the details they are looking for.

Making the 4G Blacklist Easier to Manage

Jeff Starr wrote back in March about his attempts at keeping scammers and crackers and other undesirables away from his web sites. He’s published his suggested settings for the Apache web server at The Perishable Press 4G Blacklist.

I’m not a fan of adding lots of stuff to my core system files. So I simply put the rules in a file called “perishable-press-blacklist.conf” in my /etc/httpd/conf.d/ directory. If I put them in one of the regular configuration files, such as httpd.conf, I may overwrite the file or forget it’s there. By keeping it in its own separate file, I can more easily tweak the settings.

Recommended Server Software: Pixelpost

If you are an active photographer, you should definitely look into using Pixelpost to manage your online photo collection. I’m using it for my Fractal of the Day web site (site is now dead).

From the Pixelpost introduction:

Meet Pixelpost, a small photoblog application that’s a no-brainer to set up and use. It’s perfect for anyone wishing to regularly post their photos on the web like a blog.

Unlike other blog engines out there, Pixelpost doesn’t try to solve all of the worlds problems. Pixelpost simply does photoblogs, and it does them well. If you are looking for a full blown CMS or text-blog, Pixelpost isn’t for you. But if you want something simple, and designed from the ground up for photobloggers, like yourself, you’ve found the perfect app.

Pixelpost is free to use, and is open-source software.

The Pixelpost templating system is a little klunky, but I like that the system is easily extended through the use of addons (the addon concept is similar to WordPress plugins). Check out Pixelpost.

Double Check The Year In Your Footer

With the new year comes a very easily remedied problem: many web sites still say 2009 in their footer. You can either hard-code the year in the footer.php page in your site’s template and manually update each January 1st. Or you can add this bit of php code:

<?php echo date('Y'); ?> 

in place of the year and the year will always be accurate.

9/11 Pager Data Charted

WikiLeaks has released nearly “half a million US national text pager intercepts. The intercepts cover a 24 hour period surrounding the September 11, 2001 attacks in New York and Washington.” More information, including the intercepts themselves, are available from the WikiLeaks web site.

I’ve gone through the intercepts and created this chart. For each ten minute block of time from 3am on Tuesday September 11th, 2001 though 2:59am on Wednesday, September 12th, 2001, I’ve plotted the number of intercepts, as well as labeled a few of the more important events of the 9/11 attacks.
This is the entire dataset as downloaded from WikiLeaks:

chart of 9/11 pager intercepts

(Click the chart for a larger version.)

And this is a subset of the pager data, the lines only directing referring to the attacks (added to the post on Nov. 27, 2009 at 9:58am):

chart of 9/11 pager intercepts

(Click the chart for a larger version.)

BitTorrent for 2009-11-26

I like BitTorrent, but it is very frustrating when no one is seeding the document.

Venn Diagram of Prime Numbers

Just a touch of the light side: A Venn Diagram of Numbers:

Venn diagram of even, odd and prime numbers 1 through 39

More Venn Diagrams at the Venn Diagram Tumblog.