Skipt Criddies

[elfs]

I have had a very stressful day. It started with waking up this morning with a splitting headache, a terrible backache, tired eyes and a generally poor disposition. This despite having gotten almost nine hours of sleep last night, although it broken repeatedly by Kouryou-chan climbing into bed. I almost never wake up feeling so bad; it had better not happen tomorrow. I am tired of coming home tired.

Perhaps, today, I had an excuse. I experienced five hours of meetings this day. An hour with documentation, an hour with the development staff regarding a new product, an hour with the staff just to discuss UI issues, an hour with a job candidate, and finally a one-on-one with the boss. I'm working on a new infrastructure for the UI, one in which I push the business logic down into its own layer, and one which enables Ajax components reliably on the client.

I took a look at the Pendorwright site this afternoon and discovered that in the course of the past week some skipt criddie had tried five thousand different common HTTP bugs looking for a hole into the system. Since I haven't deployed PHP or Rails (yet, mostly due to issues like this), he didn't get in, but man it was sobering to see that. That's on top of the thousands of brute-force attempts to break in through SSH. It's quite sobering to realize just how careful I have to be to keep the botfools out of my playpen.

Comments

[edichka2.livejournal.com]

"Skipt Criddie"? Is that a single-malt?

- Eddie

[wookie-cd.livejournal.com]

wow.

[funos.livejournal.com]

That there are thousands of ways to try is what bothers me the most...

[elfs.livejournal.com]

Well, there are about fifty "standard" accounts across all platforms, and a few dozen "standard" passwords that idiots like to deploy (I try to not be an idiot), plus all the known hacks of the most popular tools like phpmyadmin and the rails demoset, so after a while it adds up to a large number of basic tries.

[gromm.livejournal.com]

Compile ssh with the '--with-tcp-wrappers' option, and set up an /etc/hosts.allow for only a few hosts (ssh can use tcp wrappers independently of the OS). And preferrably one that allows ssh connections from anywhere, just in case.

That will make *all* the brute-force attempts go away. :)