746 reputation
27
bio website mricon.com
location Montreal, Canada
age 38
visits member for 2 years
seen yesterday

Systems administrator at the Linux Foundation.


Dec
12
awarded  Yearling
Sep
16
answered ssh tunnel through two-factor auth
Dec
12
awarded  Yearling
Oct
25
answered Tell browsers to cache until last modified date changes?
Sep
24
answered Is there an open source equivalent of Windows software restriction policies for Linux?
Sep
4
comment How to fight request spam (DDOS i guess) on CentOS server
Yes, I've used modsecurity extensively in the past. It's effective, but pretty horrible to configure (as most security tools are). Using it they way you suggest -- by counting per-IP accesses -- is not effective in a DDoS scenario. With a distributed botnet, each of the many thousands global nodes will make a handful of requests, each 5-10 minutes apart. Dumber botnets will not vary their headers, so you can filter by that (as I suggest above). Cleverer botnets will vary the headers and make their traffic pretty much indistinguishable from legitimate access.
Sep
4
comment How to fight request spam (DDOS i guess) on CentOS server
This will very likely deny legitimate requests.
Sep
4
answered How to fight request spam (DDOS i guess) on CentOS server
Sep
4
comment How to fight request spam (DDOS i guess) on CentOS server
As the OP specifically pointed out that the attacker is sending at most 2 requests from each IP, hence the first "D" in the DDoS (Distributed).
Jun
25
comment possible? radius server with active directory users and google authentication
@MoSiAc It's best if you ask this on github.com/mricon/totp-cgi/issues and we'll be glad to help you out.
Apr
9
comment selinux in enforcing mode
This is really something that few are aware of, unfortunately. There is basically a bunch of SELinux denials that occur on almost any command run and are mostly bogus denials that can be safely ignored in 99% of the cases. To prevent your audit logs from filling up with this junk, they are blanketly labeled as "don't audit these." However, when you are writing your own policy, you have to turn the "dontaudit" off in order to make sure that you are not missing anything.
Apr
5
comment Are OTP/OATH (RFC 4226) Hardware Tokens Re-seedable?
Just so you are aware, Google Authenticator PAM module has important security limitations: blog.mricon.com/2012/12/…
Mar
30
comment How to use php readfile() across partitions?
When do you say "I do not have selinux installed", what do you mean? What's the output of "sestatus"?
Feb
17
answered Force every HTTPS to one url
Feb
6
answered Can Netcat talk to an encrypted port?
Feb
5
comment Postfix 2.5.6 on Fedora 10
I'd be more worried about having a publicly-accessible Fedora 10 system. There haven't been any security updates to Fedora 10 since December 2009.
Feb
5
comment SFTP - Allow user to upload to www only
You probably don't need www-data to write to /var/www/mysite, but to some path underneath it, right?
Feb
5
comment Not using SSH Pubkey Authentication is really serious security flaw compare to regular Password Authentication
Do you check every day to make sure there is no hardware keylogger sitting between your keyboard and the USB port where it's plugged in? If you work in a place with lax physical security, that's how easy it is to defeat password-based authentication.
Jan
25
answered possible? radius server with active directory users and google authentication
Jan
18
comment SSH:using single public key on multiple remote machines and spoofing-by-known-server
The known_hosts file not only lists the known fingerprints, but also the DNS names and IP addresses these fingerprints belong to. If you try to connect to server-1, but it gives you server-2's fingerprint, SSH will give you a warning. Moreover, it doesn't really matter if traffic passes via server-1 -- you're encrypting the contents of the traffic with server-2's key, so all the MITM party will see is encrypted traffic which they can't decrypt without having server-2's private key.