Heal Your Church WebSite

Tag: security

  • How to block a range of IPs from spamming your church website

    Using a blog to manage a website’s content is a flexible and affordable solution more and more churches are employing to effectively present their message online. There is however one drawback – in that some of the open source blogging solutions used as content management on the cheap also tend to attract attention from nere-do-wells who attack the comment and content functions of application such as WordPress and MovableType with robotic floods of advertisements offering anything from enlarging various appendages to curing male baldness all while losing your life’s saving playing poker online.

    What’s worse is that many of these attacks these days come from servers in countries where you have absolutely no legal, let alone social, recourse to stop said attacks. Take for example a recent slam of attacks on a new dedicated server I’ve been working on – all which failed due to recent preventative security endeavors – but all incoming from a block of related IP addresses from a server in China all of whose addresses had 218.25.161… in common.

    And while these unwanted advances were successfully thwarted by various server hardening practices implementations – the best way to avoid trouble from said attacker is to just deny access to anything on the server by denying the range of IP addresses indicated in my security logs.

    With that in mind, I thought I’d share two approaches to blocking a range of IP addresses. One solution at the firewall level – the path I prefer on dedicated servers, the other solution is blocking IP blocks via the .htaccess file, which are employed on sites hosted on a shared server.

    Using APF firewall, I simply create an entry that defines the block – in this case:

    218.25.161.0/24

    In the .htaccess file:

    <Limit GET HEAD POST>
    order allow,deny
    deny from 218.25.161
    allow from all
    </LIMIT>

    Both implementations block IP addresses from 218.25.161.0 through 218.25.161.255. But what happens if I only want to block addresses from a smaller set of addresses? Like those coming from someone abusing their DSL services whose range of dynamically assigned IPs may only be a range of 216.12.201.150 through 216.12.201.200.

    That becomes trickier as is requires both a knowledge of the ‘CIDR notation’ and the bit mapping that goes along with it. Which is why I recommend instead using this nifty little online tool from Mikero.com. An easy-to-use service which performs all the bit-blasting, while also “aligning” the range so it can be expressed in correct CIDR notation.

    Or in laymen’s terms, I add the following generated range to my firewall:

    216.12.201.128/25

    Or where no such firewall access is available, the following line in my .htaccess file:

    deny from 216.12.201.128/25

    Below are some tools and links on the topic of how to block a range of IP addresses if you want to dig into it a bit further.

    Online tools to calculate an IP address range (CIDR):

    Online tools to check/verify your CIDR notation:

    Tutorials on blocking IP addresses and CIDR subnet masks:

    Pre-fabricated blacklists to block IP addresses of entire countries:

    A bit more on .htaccess and mod_access:

    Just remember to keep good backups of whatever files you’re working on – and try not to lock yourself out while experimenting with changes!

  • How to secure your church’s dedicated Linux server

    This post is dedicated to all of you running your church’s website in the choir robe closet, or who have been graced with a generous and geeky member who has taken advantage of one of those cheap, unmanaged dedicated server deals advertised at places like WebHostingTalk:

    As the author plainly states, “This list is not comprehensive, nor does [he] take any responsibility for any harm that may come to your server if you use any of these commands.”

    Emphasis mine, that said, I found this a very good “quick reference” for those of you thinking about running or leasing your own Linux/Apache server. Especially for those blissfully ignorant enough to think it can be done simply by installing ubuntu on an old machine some donated as a tax-write off.

    Using Richy’s sobering tips, I went out and found how-to articles on each of these “dedicated Linux server for dummies” points – just so you could realize just how much work goes into “hardening Linux servers for dummies:”

    Now if this hasn’t scared you out of running your own server in the basement of your church or charity (and I’m hoping it does), then may suggest, rather … I COMMAND YOU to go buy and then read “Hacking Linux Exposed” before you take the dive.

    Seriously, consider the costs of trying to save money by running a box out of an unused closet or corner of your church. It may be more expensive in time and lost off data than you think. At least think of all the work that goes into hardening Linux web servers these days.

    How ’bout some of you other pros out there? I’m sure I’ve missed something. Leave a comment, we’ll add to the list.

  • 5 Simple Security Tips for the WiFi-ing Road Warrior

    As I travel to the Hashemite Kingdom next week, there are at least 5 simple things I can do to make my WiFi experiences a bit more secure. So can you, here’s how:

    During my upcoming journey to Jordan, I’ll have ample opportunities to consume the culture on a variety of levels – including the ever growing WIFI connections that now abound in the Hashemite Kingdom. This in turn will give any nere-do-wells an opportunity to consume my personal and private information; if not zombie-fry my laptop altogether. And while I believe there is no such thing as total mobile security – there are ast least 5 simple things I can do to inconvenience the lesser-determined bad-guys to the point they move onto the guy computing next to me waiting for the airplane to board.

    1. Connect Securely

    How do you know you’re securely connected to the wireless router at your favorite coffee shop? Simple, you have inconvenience the barista or the hotel staff for a WEP, or even more secure, WPA key to access the Internet.

    Yes, yes, yes, I know, WEP stinks in comparison to WPA, none-the-less, better a little hassle than to sign away one’s identity and security by confirming to use a ‘wide-open’ network.

    2. Tunnel Safely

    The problem with seeking out a WPA-PSK encryption is that many times, it just isn’t available. Merchants provide WiFi hot-spots as a competitive draw. It loses its return on investment if they find themselves busier teaching wireless laptop connectivity than selling biscotti.

    For those who don’t mind taking security matters into their own hands – or at least putting them into the hands of 3rd parties who provide VPN services; some for free. Here is a short list in alphabetical order:

    And for those on the road a lot, you might want to check to see if your hot-spot access service such as Boingo, iPass or TMobile/HS provides secure software.

    3. Surf Encrypted

    Many of us who buy stuff online already know to look for that little encryption lock in the status bar of our browser. However, have you considered looking for it when you login to an online email service?

    How about when you use the same password you use for everything when you login to a blogging service or bulletin board?

    Again, in cases where you are at the mercy of a service provider not offering secure logins and transactions, there are some not-so-stupid browser tricks you can employ – provided you have the right browser.

    For example, while gMail does provide a secure login, it does not provide encryption when I’m emailing you about my upcoming trip to Jordan. Same too when I blog this post using Google Docs.

    Fortunately, I use FireFox, which in turn allows me to plug-in the Customize Google extension, which in turn allows me to check an option to “Secure (switch to https).” Voila!

    Similarly, I Pidgin-Encrypt my instant messaging (not to be confused with the actual IM Pidgin Client, though the two are related).

    If I must to FTP, then I use SSH File Transfer Protocol (SFTP) – and when possible – using an encrypted zip file. Yes, I’m aware the PKZip password protection is inherently weak, but it’s stronger than nothing.

    4. Password Strongly

    All the security in the world won’t help me if I use the same password for everything, and that password is something relatively easy to guess or crack. For example … a login of ‘dean’ and password of ‘peters’ I would think would take even the lames of script kiddie all of 5 seconds to figure out.

    If you can’t figure out how to create a memorable but strong password, fear not. There are plenty of online services. Here are 3 that didn’t ask me who I was before generating some solutions:

    5. Speak Nothing

    Having spent some time with a top-secret security clearance, I know what the phrase “need to know” means:

    • the best way to keep a secret is not to tell anyone;
    • failing that, only tell the secret to those who must know;
    • never write anything down;
    • shred everything; and
    • trust no one.

    So asides from keeping our ‘yaps shut’ – this also means

    • turning off any file, printer and/or other fun network sharing;
    • turning on any firewall, spyware and anti-virus detection; and
    • depending on your operating system and configuration, shutting down open ports.

    Yeah, that last one is not too easy, but I figure if you’re savvy enough to run a server, you’re savvy enough to know you’ve got some entry ways your firewall may not catch (for the rest of you, just make sure your firewall application is running).

    Conclusion

    I know this last bit sounds a bit blunt – especially for those of you working with churches, charities and missions – especially that last point.

    But the last thing we need is to have our personal lives, our ministries and/or our livelihoods imperiled by an ever constant swarm of sinners who would think nothing of emptying out your bank account, ruining your retirement fun, and tapping out your travel funds to fun places like Jordan.

    Better to remain a little bit paranoid about private information so you can keep you mind on publicly pronouncing the good news that is Christ crucified and Christ resurrected.

  • How to cron a MySQLDump

    Once again Rachael C. not only yanks the plank outta my eye, but smacks me upside the head for not scripting my backups on a regular basis. And she’s right to do so.

    Here is a link she recommended in a comment in my “make a ready defense” article The recommended tutorial is appropriately entitled How to backup your MySQL tables and data every night using a bash script and cron.

    Of course, this steals my thunder as I was, and still am, going to give you some PERL that will enumerate all your databases, then dump them, then compress them into a tidy little file good for downloading and such.

    But until I do, do what this article says, and not what I’m not doing.