neomorphic

EDIT: I just found some help documentation for the text filters buried within the admin interface at http://yourblog/admin/textfilters

• Rails envy tell you all you need to get started using some very funny analogies.
• Martin Fowler takes a more in depth look at how rake stacks up against other build languages like make and ant.

require 'rake'

task :default => :hello

desc 'Say hello'
task :hello do
  puts 'Hello World'
end

anon@box:~/ruby$ rake
(in /home/anon/ruby)
Hello World

namespace :database do
  task :clean do 
    #clean up the database
  end
end

namespace :files do
  task :clean do
    #clean up the files
  end
end

namespace :dir do
  task :clean do
    #clean up the directory structure
  end
end

rake database:clean

require 'rake'

task :default => :logs:clean

namespace :logs do
  desc 'Clean up generated files'
  task :clean do
    #delete generated files
  end
end

It turns out that ruby symbols don't like to have a ':' in them. After some digging around I discovered that tasks in namespaces have to be called slightly differently in order to get around this problem. The answer is to use a string:

require 'rake'

task :default => 'logs:clean'

namespace :logs do
  desc 'Clean up generated files'
  task :clean do
    #delete generated files
  end
end

1. Someone is trying to hack into my machines.
2. The machine can slow to a crawl when trying to deal with the thousands of requests that I am getting. Causing my web services to slow down.

So, the question is:

How can I deal with this?

Some common suggestions:

1. Change your port to a non-standard port such as 2222, or some other random number. I agree that this does work, but it can be annoying if my applications cant be configured to connect to a non-standard port.
2. Use port knocking to keep the port closed, until the right sequence of ports have been probed. This sounds more elegant than changing the port number, but again if my programs cant do this, then I need some sort of hack to get the port open.

I have gone for a slightly different approach, which is to setup a cronjob to monitor my log files and add the offenders to a list of banned ip addresses. The code was written in ruby and is running on a debian server

#!/usr/bin/ruby -T


# hash of found ips used to store the ips found in the 
# auth.log
ipFound = Hash.new(0)

puts 'Checking for scanning attempts'

# 1. read in the auth.log
authLog = File.open('/var/log/auth.log','r')

authLog.each_line { |line|
  # 2. check for the ip addresses that are scanning
  if line =~ /Failed password for invalid user/
    if line =~ /(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/
      @ipaddress = $1
      #add it to the list
      ipFound[@ipaddress] += 1
    end
  end
}

authLog.close

# hash used to store the ips that are already banned
ipDenied = Hash.new(0)

# open the list of banned ip adresses
hostsDeny = File.open('/etc/hosts.deny','r')

hostsDeny.each_line { |line|
  if line =~ /ALL:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/
    ipDenied[$1] += 1
  end
}

hostsDeny.close

# if ip not in denied list or from the local network,
# then add it

hostsDenied = File.open('/etc/hosts.deny','a')

ipFound.each_pair { |ip,count|
  puts "IP:#{ip} -> #{count}"
  if ipDenied[ip] != 0
    puts "IP Already denied"
    next
  end
  if ip =~ /^192.168.1/
    puts "IP in local network"
    next
  end
  if count < 10
    puts "Didn't scan that much"
    next
  end
  puts "Adding to the denied list"
  hostsDenied << "ALL:#{ip}\n"
}

hostsDenied.close

puts "Done"

10 * * * * /path/to/banning_code 2>&1 | Mail -s 'offender ban run' you@your.domain

1. After creating a fresh debian install and using apt to get ruby and gems tried to run 'gem install typo'. Everything seemed to go well, until I actually tried to run the typo install command. It wasn't there. Apparently the debian version of gems is broken and wont install the required stubs into the /usr/bin directory. To get around this I had to manually install the gems package from rubygems.org.
2. With gems manually installed I tried to get typo yet again. This time I received an error message stating that SSL was not installed on the system. Fixing this required an apt-get of openssl and libopenssl-ruby
3. After finally getting rails and typo installed I tried running the typo command yet again. The failure this time complained about the migrate task not working. This turned out to be due to the rails version being too new. So, I downgraded the installed version of rails to 1.2.6 from 2.0.1 and everything worked fine.