Posted on Leave a comment

Securing The New Server & Security In General

This was originally going to be part of another post, but it ended up getting more complex than I originally intended so it’s been given it’s own. I go into into many of my personal security practices, on both my public facing servers & personal machines. Since the intertubes are so central to life these days, good security is a must, especially since most people use the ‘net to do very sensitive operations, such as banking, it’s becoming even more essential to have strong security.

Since bringing the new server online & exposing it to the world, it’s been discovered in record time by the scum of the internet, SSH was under constant attack within 24 hours, and within that time there were over 20,000 failed login attempts in the logs.
This isn’t much of an issue, as I’ve got a strong Fail2Ban configuration running which at the moment is keeping track of some 30 IP addresses that are constantly trying to hammer their way in. No doubt these will be replaced with another string of attacks once they realise that those IPs are being dropped. I also prevent SSH login with passwords – RSA keys only here.
MySQL is the other main target to be concerned about – this is taken care of by disabling root login remotely, and dropping all MySQL traffic at the firewall that hasn’t come from 127.0.0.1.

Keeping the SSH keys on an external device & still keeping things simple just requires some tweaking to the .bashrc file in Linux:

alias ssh='ssh -i <Path To Keys>'

This little snippet makes the ssh client look somewhere else for the keys themselves, while keeping typing to a minimum in the Terminal. This assumes the external storage with the keys always mounts to the same location.

Everything else that can’t be totally blocked from outside access (IMAP, SMTP, FTP, etc), along with Fail2Ban protection, gets very strong passwords, unique to each account, (password reuse in any situation is a big no-no) and where possible TOTP-based two factor authentication is used for front end stuff, all the SSH keys, master passwords & backup codes are themselves kept offline, on encrypted storage, except for when they’re needed. General password management is taken care of by LastPass, and while they’ve been subject to a couple of rather serious vulnerabilities recently, these have been patched & it’s still probably one of the best options out there for a password vault.
There’s more information about those vulnerabilities on the LastPass blog here & here.


This level of security paranoia ensures that unauthorized access is made extremely difficult – an attacker would have to gain physical access to one of my mobile devices with the TOTP application, and have physical access to the storage where all the master keys are kept (along with it’s encryption key, which is safely stored in Meatware), to gain access to anything.
No security can ever be 100% perfect, there’s always going to be an attack surface somewhere, but I’ll certainly go as far as is reasonable, while not making my access a total pain, to keep that attack surface as small as possible,and therefore keeping the internet scum out of my systems.
The last layer of security is a personal VPN server, which keeps all traffic totally encrypted while it’s in transit across my ISP’s network, until it hits the end point server somewhere else in the world. Again, this isn’t perfect, as the data has to be decrypted *somewhere* along the chain.

Posted on Leave a comment

The Finest Hour

Reprinted from The Pirate Bay. Thought this deserved as much net coverage as possible.

 

February 2011, MAFIAA Lobbyists began a massive attack against the European Union.

Defending the union were seeds and peers of The Pirate Bay along with the Telecomix, Anons, and the Pirate parties. The MAFIAA relied on an aggressive battle plan, utilizing modern communications such as radio and telefax to direct troops in the field. The Allies, for their part, assumed a defensive posture, just as they had done at the start of World Internets War of 2003, and in many cases still relied on irc.

As a result, the MAFIAA blitzkrieg caught the Allies off-guard. MAFIAA’s smooth talks and bribes against key players in the EU staged a surprise attack, then turned northward and soon surrounded the bulk of the EU headquarters in Belgium.

After just a few weeks of battle, MAFIAA’s armies had conquered the right, the left and the liberal parties.

I expect that the Battle of Internets is about to begin. Upon this battle depends the survival of an Uncensored civilization! Upon it depends our own free life, and the long continuity of our sites and our trackers. The whole fury and might of the enemy will very soon be turned on us.

MAFIAA knows that they will have to break us in Brussels or lose the war. If we can stand up to them, all Europe may be free and the life of the world may move forward into broad, sunlit uplands. But if we fail, then the whole world, including all that we have known and cared for, will sink into the abyss of a new Dark Age made more sinister, and perhaps more protracted, by the lights of perverted science.

Let us therefore brace ourselves to our duties, and so bear ourselves that if the free internets and its multitude of sites last for a thousand years, citizens will still say, This was their finest hour.

Yours, Winston Bay.

Full news article here.