457 reputation
11023
bio website ninjawars.net
location New York, NY
age 34
visits member for 5 years, 3 months
seen 16 mins ago

I make a ninja game at ninjawars.net, am hirable at bitlucid.com, do crazy art when I can at dnaexmosn.deviantart.com, and code open source stuff on github at github.com/tchalvak

Code in:

  • php
  • javascript
  • html/css

Want to code in: - Clojure

Want to code on: - node.js

aka Tchalvak


Nov
14
comment nginx / fpm and PHP_VALUE not working
Based on that bug, it may be an escaping issue for some reason.
Oct
16
comment How to set a favicon.ico for a specific Virtual Host on Nginx?
The permissions issue fixed it for me as well!
Sep
19
comment Tried to deny access to apache /server-status module with certain exceptions, but it became exposed everywhere
Hmmm, seemed promising that allow locations might be space delimited instead of comma+space delimited, but in actuality it didn't make a difference.
Aug
20
comment Apache: Stealth 404 the admin area until authenticated via basic auth, then allow access
There are two advantages that I can see to not providing the basic auth password & username on every admin url: 1: brute forcing of the basic auth cannot be done until the wp-adminsecretlogin/ url is accessed, and since that url will be a custom one for the site/blog network, that would require prior knowledge of the login url and would generally require tailoring the attack to the unique site/blog network. 2: Returning 404 will mask the standards signals to bots that a wordpress admin section is present, to discourage the frequent brute force scripting attempts that tend to occur.
Aug
6
comment Dealing with development subdomains
Note that apache 2.4 requires .conf on the end of virtualhosts for them to work, which is what caused me the problem a second time. Found the documentation for the change in: vi /usr/share/doc/apache2/NEWS.Debian.gz
Jul
11
comment What are the correct permissions for /etc/init.d/ scripts?
This is giving execute permissions to world (what?) and group (ok, sure). Why would that ever be a good thing, or necessary in this case?
Jul
3
comment Apache VirtualHosts define php.ini but extend main php.ini
See also: serverfault.com/questions/34078/…
Jul
1
comment UFW logs blocked request on open port, what am I missing?
Well, this really makes logging stuff from iptables/UFW pointless, thanks for the clarification.
Feb
20
comment Increased number of 408 Request Timeouts for null on a webserver
Fair enough, the browser predictive optimization one seems like it may well fit the situation, especially since the error logs match. So I'll have to verify that myself later. Thanks.
Feb
18
comment Increased number of 408 Request Timeouts for null on a webserver
I posted a longer sampling of the most recent 408 requests into the pastebin link. The hits are relatively infrequent, throughout the day.
Feb
13
comment Increased number of 408 Request Timeouts for null on a webserver
Potentially related question: serverfault.com/questions/247051/…
Feb
13
comment Increased number of 408 Request Timeouts for null on a webserver
I've lowered it to 150 seconds, though I guess that will only increase the number of timeouts, of course, but I guess at least the requests that timeout wont hold onto resources.
Feb
13
comment Increased number of 408 Request Timeouts for null on a webserver
Looks like it is the rediculously high number of 300 seconds: # # Timeout: The number of seconds before receives and sends time out. # Timeout 300
Feb
13
comment Increased number of 408 Request Timeouts for null on a webserver
The "408 request timeout null: 694 times" and "a total of 125 sites probed the server" messages are from the logwatch log summarizing app, which emails me out info about the server logs on a daily basis. The others are entries from a grep of /var/log/apache2/access.log I also clarified in my question now.
Jan
28
comment Equivalent to denyhosts, but for HTTP requests?
...wouldn't that tie up your server's resources just as much as an attackers...
Nov
13
comment How can I get access to password hashing in postgresql? Tried installing postgresql-contrib in ubuntu, still can't access hashing functions
Yeah, they seem to have updated the system to make extensions easier to manage, happily, and now after installing postgresql-contrib in postgres 9.1 and up you can just: create extension pgcrypto or from the command line echo "create extension pgcrypto" | psql -d dataBaseName to enable extensions, as well.
Sep
11
comment Free service for checking for DNS errors on your domain?
Hmmm, Zonecheck stops on first error, which isn't helpful (at least, in the web interface).
Sep
10
comment Denyhosts: Should I ever clear the denied IP hosts file?
Any suggestions for what should I look into to set up deny.hosts rotation?
Sep
10
comment Denyhosts: Should I ever clear the denied IP hosts file?
Hmmm, right, I guess the ideal would be to turn on a rotation so that it cleans itself periodically. I'm not using centralized reporting or email notification within denyhosts per se, though I do receive logs of ips that get denied via logwatch emails.
Jul
26
comment Proper linux permissions for images that are uploaded to allow deletion and re-uploading
Ok, it seems to even view, you need X, so evidently that is the symbolic permission to add. What should I look into for apache to prevent execution within a directory?