Comments for Barbary Codes and Data http://www.barbarycodes.com We help companies get state of the art web and mobile applications to market. Fast. Sun, 18 Dec 2011 13:36:49 +0000 hourly 1 http://wordpress.org/?v=3.0.4 Comment on Automated Banning of Script Kiddies with fail2ban by Sven http://www.barbarycodes.com/2010/10/06/automated-banning-of-script-kiddies-with-fail2ban/#comment-63 Sven Sun, 18 Dec 2011 13:36:49 +0000 http://timothynjones.wordpress.com/?p=121#comment-63 maybe I've got to filter (if possible with regex) on ../../, because below that they are browsing outside my webroot... anybody knows if that is a good idea? so ../../../ or more is a direct ban... maybe I’ve got to filter (if possible with regex) on ../../, because below that they are browsing outside my webroot… anybody knows if that is a good idea? so ../../../ or more is a direct ban…

]]> Comment on Automated Banning of Script Kiddies with fail2ban by Sven http://www.barbarycodes.com/2010/10/06/automated-banning-of-script-kiddies-with-fail2ban/#comment-62 Sven Sun, 18 Dec 2011 13:32:01 +0000 http://timothynjones.wordpress.com/?p=121#comment-62 by the way, you can see these end up in apache 200 so it looks like I'm hacked (or the content of the file is shown)... this is not completely true, yes the index page is shown, BUT it does not contain the information from the environ file (environ is only readable by root, the apache childs run under different users). by the way, you can see these end up in apache 200 so it looks like I’m hacked (or the content of the file is shown)… this is not completely true, yes the index page is shown, BUT it does not contain the information from the environ file (environ is only readable by root, the apache childs run under different users).

]]> Comment on Automated Banning of Script Kiddies with fail2ban by Sven http://www.barbarycodes.com/2010/10/06/automated-banning-of-script-kiddies-with-fail2ban/#comment-61 Sven Sun, 18 Dec 2011 13:28:36 +0000 http://timothynjones.wordpress.com/?p=121#comment-61 awesome post! :) I've also added 403 as a 2nd line. Maybe this can be done by regex as well, but I'm not such a hero with regex Currently I'm also trying to block other requests. These requests are polling for files (like my environ file) outside my webdirectory. Now I could place my apache webserver in a chrooted jail, but this proves to be difficult because my web application has to create linux users. I would like to know how fail2ban can assist in blocking these: 202.109.129.166 - - [16/Dec/2011:08:22:25 +0100] "GET /?file=../../../../../../proc/self/environ%00 HTTP/1.1" 200 1864 "-" "" 202.109.129.166 - - [16/Dec/2011:08:22:25 +0100] "GET /?page=../../../../../../proc/self/environ%00 HTTP/1.1" 200 1864 "-" "" 202.109.129.166 - - [16/Dec/2011:08:22:26 +0100] "GET /?mod=../../../../../../proc/self/environ%00 HTTP/1.1" 200 1864 "-" "" 202.109.129.166 - - [16/Dec/2011:08:22:26 +0100] "GET /index.php?option=com_simpledownload&controller=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 1864 "-" "" awesome post! :)

I’ve also added 403 as a 2nd line. Maybe this can be done by regex as well, but I’m not such a hero with regex

Currently I’m also trying to block other requests. These requests are polling for files (like my environ file) outside my webdirectory. Now I could place my apache webserver in a chrooted jail, but this proves to be difficult because my web application has to create linux users. I would like to know how fail2ban can assist in blocking these:

202.109.129.166 – - [16/Dec/2011:08:22:25 +0100] “GET /?file=../../../../../../proc/self/environ%00 HTTP/1.1″ 200 1864 “-” “”
202.109.129.166 – - [16/Dec/2011:08:22:25 +0100] “GET /?page=../../../../../../proc/self/environ%00 HTTP/1.1″ 200 1864 “-” “”
202.109.129.166 – - [16/Dec/2011:08:22:26 +0100] “GET /?mod=../../../../../../proc/self/environ%00 HTTP/1.1″ 200 1864 “-” “”
202.109.129.166 – - [16/Dec/2011:08:22:26 +0100] “GET /index.php?option=com_simpledownload&controller=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1″ 200 1864 “-” “”

]]> Comment on Automated Banning of Script Kiddies with fail2ban by anon http://www.barbarycodes.com/2010/10/06/automated-banning-of-script-kiddies-with-fail2ban/#comment-60 anon Tue, 20 Sep 2011 20:42:50 +0000 http://timothynjones.wordpress.com/?p=121#comment-60 In failregex, must be all CAPS like . otherwise it fails. In failregex, must be all CAPS like . otherwise it fails.

]]> Comment on Automated Banning of Script Kiddies with fail2ban by Mart http://www.barbarycodes.com/2010/10/06/automated-banning-of-script-kiddies-with-fail2ban/#comment-59 Mart Mon, 29 Aug 2011 07:01:38 +0000 http://timothynjones.wordpress.com/?p=121#comment-59 Really useful. Thank you! One gotcha (my own stupidity, not your instructions) was that I called the filter 'apache-404' and omitted the '.conf' on the end. fail2ban just wouldn't start and I couldn't see why. It all sprang into life when I noticed my mistake and corrected it :) Really useful. Thank you!

One gotcha (my own stupidity, not your instructions) was that I called the filter ‘apache-404′ and omitted the ‘.conf’ on the end. fail2ban just wouldn’t start and I couldn’t see why. It all sprang into life when I noticed my mistake and corrected it :)

]]> Comment on Automated Banning of Script Kiddies with fail2ban by Larry Rubin http://www.barbarycodes.com/2010/10/06/automated-banning-of-script-kiddies-with-fail2ban/#comment-56 Larry Rubin Wed, 23 Mar 2011 01:55:35 +0000 http://timothynjones.wordpress.com/?p=121#comment-56 This was very useful. Thank you. I implemented it and immediately cut down on probing activity on my server. Some of my sites don't have favicons, which were generating 404 errors on every request, and consequently getting me banned after a few page views. By adding "favicon\.ico" (omit the quotes, but not the slash escaping the period) to the ignoreregex line, I stopped this from happening. So: ignoreregex = favicon\.ico This was very useful. Thank you.

I implemented it and immediately cut down on probing activity on my server.

Some of my sites don’t have favicons, which were generating 404 errors on every request, and consequently getting me banned after a few page views. By adding “favicon\.ico” (omit the quotes, but not the slash escaping the period) to the ignoreregex line, I stopped this from happening. So:

ignoreregex = favicon\.ico

]]> Comment on Fix for Glassfish spontaneously exiting under Capistrano by Jacob http://www.barbarycodes.com/2009/12/16/fix-for-glassfish-spontaneously-exiting-under-capistrano/#comment-55 Jacob Tue, 08 Mar 2011 22:46:55 +0000 http://timothynjones.wordpress.com/?p=93#comment-55 Had this same problem, had to turn on pty for git to work, so in the start and stop tasks I turned off pty there. Thanks for the help! Had this same problem, had to turn on pty for git to work, so in the start and stop tasks I turned off pty there.

Thanks for the help!

]]> Comment on Automated Banning of Script Kiddies with fail2ban by Fail2Ban more skript kiddies poking 404 files | Ted Roche's weblog http://www.barbarycodes.com/2010/10/06/automated-banning-of-script-kiddies-with-fail2ban/#comment-54 Fail2Ban more skript kiddies poking 404 files | Ted Roche's weblog Mon, 21 Feb 2011 21:04:15 +0000 http://timothynjones.wordpress.com/?p=121#comment-54 [...] http://www.barbarycodes.com/2010/10/06/automated-banning-of-script-kiddies-with-fail2ban/ This entry was posted in Technology and tagged fail2ban, firewall, kiddies, script, Security, skript, web. Bookmark the permalink. ← “That shouldn’t break anything…” [...] [...] http://www.barbarycodes.com/2010/10/06/automated-banning-of-script-kiddies-with-fail2ban/ This entry was posted in Technology and tagged fail2ban, firewall, kiddies, script, Security, skript, web. Bookmark the permalink. ← “That shouldn’t break anything…” [...]

]]> Comment on Automated Banning of Script Kiddies with fail2ban by madtechsupport http://www.barbarycodes.com/2010/10/06/automated-banning-of-script-kiddies-with-fail2ban/#comment-50 madtechsupport Thu, 16 Dec 2010 10:04:41 +0000 http://timothynjones.wordpress.com/?p=121#comment-50 Perfect, Thank you. Perfect,

Thank you.

]]> Comment on Rails 2 asset caching issue with load-balanced environments by Karle Durante http://www.barbarycodes.com/2008/08/28/rails-2-asset-caching-issue-with-load-balanced-environments/#comment-30 Karle Durante Fri, 20 Aug 2010 16:00:39 +0000 http://timothynjones.wordpress.com/?p=55#comment-30 Another solution is to configure your load balancer to use sticky IP. This will ensure that your page request, and subsequent asset requests, all happen on the same server. Another solution is to configure your load balancer to use sticky IP. This will ensure that your page request, and subsequent asset requests, all happen on the same server.

]]>