Reputation
566
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
1 13 26
Impact
~81k people reached

Sep
19
comment Tried to deny access to apache /server-status module with certain exceptions, but it became exposed everywhere
Hmmm, seemed promising that allow locations might be space delimited instead of comma+space delimited, but in actuality it didn't make a difference.
Aug
20
comment Apache: Stealth 404 the admin area until authenticated via basic auth, then allow access
There are two advantages that I can see to not providing the basic auth password & username on every admin url: 1: brute forcing of the basic auth cannot be done until the wp-adminsecretlogin/ url is accessed, and since that url will be a custom one for the site/blog network, that would require prior knowledge of the login url and would generally require tailoring the attack to the unique site/blog network. 2: Returning 404 will mask the standards signals to bots that a wordpress admin section is present, to discourage the frequent brute force scripting attempts that tend to occur.
Aug
6
comment Dealing with development subdomains
Note that apache 2.4 requires .conf on the end of virtualhosts for them to work, which is what caused me the problem a second time. Found the documentation for the change in: vi /usr/share/doc/apache2/NEWS.Debian.gz
Jul
11
comment What are the correct permissions for /etc/init.d/ scripts?
This is giving execute permissions to world (what?) and group (ok, sure). Why would that ever be a good thing, or necessary in this case?
Jul
3
comment Apache VirtualHosts define php.ini but extend main php.ini
See also: serverfault.com/questions/34078/…
Jul
1
comment UFW logs blocked request on open port, what am I missing?
Well, this really makes logging stuff from iptables/UFW pointless, thanks for the clarification.
Feb
20
comment Increased number of 408 Request Timeouts for null on a webserver
Fair enough, the browser predictive optimization one seems like it may well fit the situation, especially since the error logs match. So I'll have to verify that myself later. Thanks.
Feb
18
comment Increased number of 408 Request Timeouts for null on a webserver
I posted a longer sampling of the most recent 408 requests into the pastebin link. The hits are relatively infrequent, throughout the day.
Feb
13
comment Increased number of 408 Request Timeouts for null on a webserver
Potentially related question: serverfault.com/questions/247051/…
Feb
13
comment Increased number of 408 Request Timeouts for null on a webserver
I've lowered it to 150 seconds, though I guess that will only increase the number of timeouts, of course, but I guess at least the requests that timeout wont hold onto resources.
Feb
13
comment Increased number of 408 Request Timeouts for null on a webserver
Looks like it is the rediculously high number of 300 seconds: # # Timeout: The number of seconds before receives and sends time out. # Timeout 300
Feb
13
comment Increased number of 408 Request Timeouts for null on a webserver
The "408 request timeout null: 694 times" and "a total of 125 sites probed the server" messages are from the logwatch log summarizing app, which emails me out info about the server logs on a daily basis. The others are entries from a grep of /var/log/apache2/access.log I also clarified in my question now.
Jan
28
comment Equivalent to denyhosts, but for HTTP requests?
...wouldn't that tie up your server's resources just as much as an attackers...
Nov
13
comment How can I get access to password hashing in postgresql? Tried installing postgresql-contrib in ubuntu, still can't access hashing functions
Yeah, they seem to have updated the system to make extensions easier to manage, happily, and now after installing postgresql-contrib in postgres 9.1 and up you can just: create extension pgcrypto or from the command line echo "create extension pgcrypto" | psql -d dataBaseName to enable extensions, as well.
Sep
11
comment Free service for checking for DNS errors on your domain?
Hmmm, Zonecheck stops on first error, which isn't helpful (at least, in the web interface).
Sep
10
comment Denyhosts: Should I ever clear the denied IP hosts file?
Any suggestions for what should I look into to set up deny.hosts rotation?
Sep
10
comment Denyhosts: Should I ever clear the denied IP hosts file?
Hmmm, right, I guess the ideal would be to turn on a rotation so that it cleans itself periodically. I'm not using centralized reporting or email notification within denyhosts per se, though I do receive logs of ips that get denied via logwatch emails.
Jul
26
comment Proper linux permissions for images that are uploaded to allow deletion and re-uploading
Ok, it seems to even view, you need X, so evidently that is the symbolic permission to add. What should I look into for apache to prevent execution within a directory?
Jul
25
comment Proper linux permissions for images that are uploaded to allow deletion and re-uploading
Ok, so apache being able to write everything in these image directories would be set via .htaccess or apache config somewhere, but what kind of directive should I be looking for to prevent interpretation as executable by apache for those folders? I'm also just trying (for my own understanding) to translate the permissions 600 for files and 700 for subdirectories into symbolic permissions. I believe that would be chmod u+rw,go-rwx for files, and chmod u+rwZ,go-rwx for directories (with the Z standing for I am not sure what, X? or s? Not sure of the symbolic rep. of direct. scan.
Nov
9
comment Increase php session time via .htaccess not working
Thank you for this post, I wasn't aware that my apache config values were being completely ignored, only that my sessions were timing out quickly, until I checked my phpinfo() directly. As a result, I've given up on using the apache site setup, which apparently may not use php_value at all (unlike a .htaccess?), and just went with editing the php.ini directly.