1

Whenever I look over at server logs, I run into a bunch of failed fraud/hacking attempts. Mostly just failed attempts to access config files and what not. This is never that big of a issue for me since I try to always use security through obscurity practices and so far all of the attempts have failed. Should I really be concerned with these?

I've read over Ruby On Rails Security Guide (http://guides.rubyonrails.org/security.html), but was wondering if there were some more detailed resources out there.

I was also wondering if it was advisable to set up something to automatically scan my logs to search for malicious attempts.

== Edit ==
Okay, so I did so more reading and realized I had misunderstood "security through obscurity." I am not trying to protect the system through obscurity. Basically, I have followed Rails Guide. I'm wondering if i'm being paranoid or if I should be trying to put more serious measures in place. The attempts I've found look auto generated.

2 Answers 2

4

Security through obscurity is not security.

That being said, if you are seeing a lot of malicious attempts, I would examine all logs from the source IP's of the problem children regularly and carefully, looking for cases of successful actions... success from those sorts of places would be bad.

2
  • 1
    +1 just for the first sentence. I was thinking the exact same words. :)
    – Guffa
    Sep 6, 2011 at 20:39
  • Sorry about that, I by no means want to suggest that security through obscurity is adequate, which is way I'm trying to put more (or actual) security in place. The Ruby On Rails Security Guide seems pretty basic, but has so far at least helped prevent any malicious actions from being successful.
    – James
    Sep 6, 2011 at 20:50
2

The "hacking attempts" you see in your logs are probably nothing to be concerned about. If everything looks like it was run by some kind of automated script, following good security practices (such as those found in the Rails Guide) is probably adequate.

However, if you see evidence that someone is targeting you specifically, I'd take it more seriously.

As a general way of thinking, your concern should take into account what's at risk. If someone hacks your box, what's at stake? Sensitive user data and plain-text passwords (hope not!)? Or just boring application data? Paranoia should be set accordingly.

You must log in to answer this question.