Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Whenever I look over at server logs, I run into a bunch of failed fraud/hacking attempts. Mostly just failed attempts to access config files and what not. This is never that big of a issue for me since I try to always use security through obscurity practices and so far all of the attempts have failed. Should I really be concerned with these?

I've read over Ruby On Rails Security Guide (http://guides.rubyonrails.org/security.html), but was wondering if there were some more detailed resources out there.

I was also wondering if it was advisable to set up something to automatically scan my logs to search for malicious attempts.

== Edit ==
Okay, so I did so more reading and realized I had misunderstood "security through obscurity." I am not trying to protect the system through obscurity. Basically, I have followed Rails Guide. I'm wondering if i'm being paranoid or if I should be trying to put more serious measures in place. The attempts I've found look auto generated.

share|improve this question

migrated from stackoverflow.com Sep 7 '11 at 7:36

This question came from our site for professional and enthusiast programmers.

2 Answers 2

Security through obscurity is not security.

That being said, if you are seeing a lot of malicious attempts, I would examine all logs from the source IP's of the problem children regularly and carefully, looking for cases of successful actions... success from those sorts of places would be bad.

share|improve this answer
1  
+1 just for the first sentence. I was thinking the exact same words. :) –  Guffa Sep 6 '11 at 20:39
    
Sorry about that, I by no means want to suggest that security through obscurity is adequate, which is way I'm trying to put more (or actual) security in place. The Ruby On Rails Security Guide seems pretty basic, but has so far at least helped prevent any malicious actions from being successful. –  James Sep 6 '11 at 20:50

The "hacking attempts" you see in your logs are probably nothing to be concerned about. If everything looks like it was run by some kind of automated script, following good security practices (such as those found in the Rails Guide) is probably adequate.

However, if you see evidence that someone is targeting you specifically, I'd take it more seriously.

As a general way of thinking, your concern should take into account what's at risk. If someone hacks your box, what's at stake? Sensitive user data and plain-text passwords (hope not!)? Or just boring application data? Paranoia should be set accordingly.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.