› ›

Any hackers here?

NickHNickH
edited February 2009 in Chit chat
I'm curious - I'm just setting up a new home server and wondering how secure it is.

So... if you fancy a challenge, see if you can view and/or create files on obdwww.egyptus.co.uk.

There's a sneak preview DVD of the Xmas Special available if you can do it (and tell me how you did it).
Post edited by NickH on

Comments

  • zeropolis79zeropolis79
    edited February 2009
    I'm a former hacker so am no use for this.. but I have some ideas..

    I'll give it a bash

    (I promised the wife I'd quit hacking when we got married and started a family)
  • WinstonWinston
    edited February 2009
    You want a cracker, not a hacker :-) Just being pedantic.
  • NickHNickH
    edited February 2009
    Winston wrote: »
    You want a cracker, not a hacker :-) Just being pedantic.

    I've never kept up with the lingo - I always thought crackers hacked the protection off of sofware.
  • ewgfewgf
    edited February 2009
    Winston wrote: »
    You want a cracker, not a hacker :-) Just being pedantic.

    What's the difference?
  • thx1138thx1138
    edited February 2009
    ewgf wrote: »
    What's the difference?


    Crackers are served with cheese
    Hackers are the same but have a layer of crumbs and dust that you accidentally breathe in when eating, and nearly choke, (aka Rice Crispies Lung).
  • MetalbrainMetalbrain
    edited February 2009
    NickH wrote: »
    I've never kept up with the lingo - I always thought crackers hacked the protection off of sofware.

    AFAIK (by some definitions) a cracker does 'evil' things while a hacker is 'good'. So while both may break into a server, the hacker will leave everything untouched, and probably a message for the admin, telling him that his server is unsecure and the steps required to secure it. The cracker will steal information and/or destroy files (and nowadays he will probably plant a phishing site or something worse).

    By other definitions, a hacker is a 100% legal guy, who doesn't break into any server, but does constructive things instead (so in a way, coders are considered hackers).

    More here:
    http://en.wikipedia.org/wiki/Hacker_culture
  • Scottie_ukScottie_uk
    edited February 2009
    That figures, to hack out code is to write a program of subroutine without first documening it or giving it any deep thought what so ever.
    Calling all ASCII Art Architects Visit the WOS Wall of Text and contribute: https://www.yourworldoftext.com/wos
  • guesserguesser
    edited February 2009
    or hacking your own software to do things you need it to, by hacking about the config files
    My rubbish website including the redrawn Amstrad schematics and the Sinclair Wiki.
  • mel the bellmel the bell
    edited February 2009
    hackers can be black hats or white hats (bad or good)

    hackers see how things work and how to change stuff.
    crackers crack things

    so there can be an overlap between types tbh
    Professional Mel-the-Bell Simulator................"So realistic, I found myself reaching for the Kleenex King-Size!" - Richard Darling
  • rahtgazrahtgaz
    edited February 2009
    The only overlap has been caused by media ignorance, in my opinion.
    There was a time when both words coexisted without any confusion. But because the media can't be bothered with the technicalities, we are loosing vocabulary.
  • IN31IN31
    edited February 2009
    I think someone should hack into it, upload some dodgy porn and call the police.

    ;-)
  • mel the bellmel the bell
    edited February 2009
    IN31 wrote: »
    I think someone should hack into it, upload some dodgy porn and call the police.

    ;-)

    RUBBERKEYS!!!!
    your wanted
    Professional Mel-the-Bell Simulator................"So realistic, I found myself reaching for the Kleenex King-Size!" - Richard Darling
  • dekhdekh
    edited February 2009
    Ohh the law on hacking is soooooo grey now.

    I would have said get outside your own firewall and use nmap or what is currently flavour of the month.

    As a third party I'd want written/signed/witnessed statements - and then there is still the possibility of prosectution - (also prosecution under the new all encompassing anti terrorist laws) - simply for having the tools to do a legitamte job.

    However you can get yourself a report by running shields up.

    From behind your firewall goto here:

    https://www.grc.com/x/ne.dll?bh0bkyd2

    Do the full port scan.

    It should let you know any vulnerabilities.

    Fully patch your server.

    Run your server in an amber zone separate from your home network (green zone).

    Be careful around any forms on your sites these are what people tend to go for to exploit your server, to send spam mostly.
  • NickHNickH
    edited February 2009
    Shields Up only has a problem with my server being pingable, which isn't a problem in my book as I find that useful.

    Ta for the link!
  • dekhdekh
    edited February 2009
    But ping does let hackers know that there is 'something' there.
  • Steve(spt)Steve(spt)
    edited February 2009
    NickH wrote: »
    Shields Up only has a problem with my server being pingable, which isn't a problem in my book as I find that useful.

    you can set your router/server not to respond to pings. Also set your own server error pages.


    setup a good .htaccess.txt file to restrict access to folders.
  • JamesWJamesW
    edited February 2009
    dekh wrote: »
    But ping does let hackers know that there is 'something' there.
    Poking around with telnet gives a few more details as to what is there. It looks like a Linux box running Apache/2.2.9 and OpenSSH_5.1p1. 2.2.11 is the latest version of Apache. There is a cross site scripting exploit with 2.2.9, but it doesn't affect you. Openssh is up to date, but you have to be careful with ssh - there are many bots that will attempt a dictionary attack against the root account.
  • NickHNickH
    edited February 2009
    JamesW wrote: »
    Poking around with telnet gives a few more details as to what is there. It looks like a Linux box running Apache/2.2.9 and OpenSSH_5.1p1. 2.2.11 is the latest version of Apache. There is a cross site scripting exploit with 2.2.9, but it doesn't affect you. Openssh is up to date, but you have to be careful with ssh - there are many bots that will attempt a dictionary attack against the root account.

    Ta for letting me know - it's an up-to-date Xubuntu box. As for passwords... well, it's a long one :) This machine is the only machine on my network that is public-facing, and even then that's behind a separate firewall/router.
  • guesserguesser
    edited February 2009
    JamesW wrote: »
    but you have to be careful with ssh - there are many bots that will attempt a dictionary attack against the root account.

    that's a good point actually, I shall have to remember that when I set up my new server and set a nice strong password
    My rubbish website including the redrawn Amstrad schematics and the Sinclair Wiki.
  • JamesWJamesW
    edited February 2009
    guesser wrote: »
    that's a good point actually, I shall have to remember that when I set up my new server and set a nice strong password
    Better still, don't allow the root account to authenticate, and don't use username/password authentication. Use public key authentication instead.
  • guesserguesser
    edited February 2009
    JamesW wrote: »
    Better still, don't allow the root account to authenticate, and don't use username/password authentication. Use public key authentication instead.

    I didn't mention the root account :)
    ubuntu server rather sensibly imo has the root account disabled by default and makes you create a new user who can use sudo during the installation

    public key authentication is a pain, I can carry my username and password in my brain wherever I go.
    My rubbish website including the redrawn Amstrad schematics and the Sinclair Wiki.
  • NickHNickH
    edited February 2009
    Now made a little bit tougher - I've made SSH (the only way to remotely access my network) restrict access to the root and day-to-day accounts to only machines on the home network, and there is now only one user name which will get you SSH access, to the home network from outside, which has a massive password, and even then will only get you to a restricted shell.

    Not perfect, but I'm quite proud that I've found out how to do that.
  • mheidemheide
    edited February 2009
    NickH wrote: »
    Now made a little bit tougher - I've made SSH (the only way to remotely access my network) restrict access to the root and day-to-day accounts to only machines on the home network, and there is now only one user name which will get you SSH access, to the home network from outside, which has a massive password, and even then will only get you to a restricted shell.

    Not perfect, but I'm quite proud that I've found out how to do that.

    An alternative method (which I use myself when I'm away for work) is to block remote access completely apart from known addresses, and add a username/password protected (.htaccess) script to your website that does nothing else but open the SSH port in the firewall for the address that accessed the script for a while.
    You still have the regular SSH credentials, but you need a second layer (that script) to poke a temporary hole in the firewall.
  • NickHNickH
    edited February 2009
    mheide wrote: »
    An alternative method (which I use myself when I'm away for work) is to block remote access completely apart from known addresses, and add a username/password protected (.htaccess) script to your website that does nothing else but open the SSH port in the firewall for the address that accessed the script for a while.
    You still have the regular SSH credentials, but you need a second layer (that script) to poke a temporary hole in the firewall.

    Oooh, now that's a cunning idea... but then again we're heading in the direction of port-knocking, and that's a bit overkill for my server :)
Sign In or Register to comment.