897 reputation
517
bio website simbiosi.org
location Lausanne, Switzerland
age 38
visits member for 4 years, 10 months
seen Nov 8 at 21:24

I'm an Italian vagabond now established in Switzerland since 2006, I'm a knowledge devourer a proud father, an happy husband, a funny and honest friend.

In my (never) free time, I love DMing some RPGs, cooking, playing guitar, studying computer science, doing sport and never sleeping.

I'm a *GNU/*Linux PC.

I am/was working as

  • Senior System Architect of multi-tier WEB based application on Unix/Linux architectures.
  • Unix specialist with strong knowledge in Open Source solutions.
  • System Integrator and Application Solution Analyst.
  • Unix and Network administrator.
  • Java and Unix System Performance Analyst.

My tech specialties

System Administration: Unix (Solaris,HP-UX,AIX), GNU/Linux, Windows NT, 2000, Dos. Network Administration: Alteon, DNS, Sendmail, Postfix, Radeon, Routers Cisco, Switches, Nokia Firewalls, IP tables. Programming: Shell Scripting (bash, ksh), PHP, AWK, sed, perl, ant, maven, GNU Make, LaTEX, XHTML, HTML. Application Administrator: Weblogic Server, OneToOne Portal, BEA Tuxedo, Vitria BW 4.2, JBoss, Jakarta Tomcat, Apache WebServer. DB Administration: MySQL, mSQL, PostgreSQL.


Jan
6
comment Hacking prevention, forensics, auditing and counter measures
I'm used to grind some billions of lines of logs per day and what I know is that before to understand what the heck was happened, is much more important to fix or workaround, that can be even a temporary server with just a static page explaining to the users blah, blah, ..., blah and apologizes. This is the first step, then you think about what and when you can reestablish the service (or part of it) and finally you investigate and put in place any countermeasures.
Jan
6
answered Making Apache able to write to PHP files with PHP running as DSO?
Jan
6
revised Hacking prevention, forensics, auditing and counter measures
added 57 characters in body
Jan
6
awarded  Promoter
Jan
5
revised How much packet loss is normal?
added 26 characters in body
Jan
5
answered How much packet loss is normal?
Jan
4
comment Tool to assist loading servers into a rack?
+1. Muscles + Brain ---> not common today
Jan
4
revised Hacking prevention, forensics, auditing and counter measures
added 122 characters in body
Jan
4
revised Hacking prevention, forensics, auditing and counter measures
added 636 characters in body
Jan
4
comment Hacking prevention, forensics, auditing and counter measures
thanks. Don't forget the user perspective and perception.
Jan
4
comment Hacking prevention, forensics, auditing and counter measures
Still not sure between your and Robert answer.
Jan
4
comment Hacking prevention, forensics, auditing and counter measures
I've chosen your answer because it's the most complete, and it's what companies, like the one we work for, they use and continuously improve, but I wonder how can be simplified also for normal webmasters, that have to find a solution asap, much more without huge amount of money.
Jan
4
comment Hacking prevention, forensics, auditing and counter measures
All correct, I think nothing more is needed, but again, when it happens, because it happens, what exactly you do, what do you need to react fast? Analyzing thousands of lines of logs, much more in a stressing situation, will not provide a quick workaround or temporary solution to at least inform the users.
Jan
4
comment Hacking prevention, forensics, auditing and counter measures
That is what I'd like to discuss here :-)
Jan
4
comment Hacking prevention, forensics, auditing and counter measures
+1. Yes, it's correct, but then, if everything happen it means that your template it's not as safe as you thought, so you cannot use it to deploy a new website. You need at least a maintenance page notifying the customers about a temporary issue and better to host it somewhere else (another server, another IP, and redirection from the old). I think we should always take in consideration the worst case.
Jan
4
comment Hacking prevention, forensics, auditing and counter measures
I agree on almost everything but this apply mainly to medium and large companies. Small sized companies won't need or want such expensive structure.
Jan
4
comment Hacking prevention, forensics, auditing and counter measures
Good point! I didn't know there is one, I thought the full list is in the footer of each stack websites.
Jan
3
asked Hacking prevention, forensics, auditing and counter measures
Jan
3
comment Automate the backup of my databases and files with cron
it's more interesting if you make a new question I think. This way we don't mess up different subjects.
Jan
3
comment Finding how a hacked server was hacked
IMHO it would be better to ask ourself how to better secure a server and how to correctly audit it.