Security on Evan Hoffman

Setting user Postgres passwords via MD5

Wed, 12 Feb 2014 11:06:07 +0000

Say you want to create a Postgres account for a user but you don’t want them to have to reset it after logging in, and you don’t want to do the “come type in a password on my computer” routine. Well, here’s one way around this.

Have the user generate an MD5 of their password on their local computer. Postgres uses the username as the salt for the hash, so the command to generate the md5 on a Mac would be (assuming a username of ’ehoffman’ and a password of ‘abcdefg’):

Super quick wordpress exploit stopper

Fri, 25 Oct 2013 09:27:38 +0000

I got an email yesterday from my host (DigitalOcean) that I was running a phishing website. So, I’m not, but I quickly guessed what happened: my Wordpress got hacked. This is just one of the risks of running silly little PHP apps. I logged in, deleted the themes directories, reinstalled clean ones, and ensured this doesn’t happen again by doing the following:

useradd apache_ro
chown -R apache_ro:apache_ro $WP/wp-content/themes

Now apache can’t write to those directories. This means you can’t update Wordpress via the web UI, but I’m ok with that.

Graphing SSH dictionary attacks with HighCharts

Fri, 18 Nov 2011 14:06:03 +0000

After my 10-year-old basement Linux server died this week from a power outage, I took the sad step of giving up on it. It’s died before and I’ve patched it back together with a new power supply here or an addon PCI SATA card there, but I finally decided to throw in the towel since I had a newer old computer that had been idle for several years. The one that died was an Athlon K7 750 MHz with 512 MB ram. The new one is an Athlon 2 GHz (3200+) with 1 gig. For my uses, specs don’t really matter that much, but it’s nice to have more power for free.

Making sure SSLv2 is disabled in Apache (and Nginx)

Tue, 20 Sep 2011 14:06:38 +0000

Edit Jan 24, 2012: Deleted all the crap from this story and just left the recommended Apache and Nginx SSL cipher suites for maximum security without SSLv2 and without BEAST vulnerability (at least according to Qualys). Apache httpd

SSLProtocol -ALL +SSLv3 +TLSv1
SSLCipherSuite ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM;
SSLHonorCipherOrder on

nginx

ssl_protocols SSLv3 TLSv1;
 ssl_ciphers ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM;
 ssl_prefer_server_ciphers on;

Source:

The Barracuda Spam Firewall VMware Appliance (Vx) finally exists!

Mon, 04 Oct 2010 18:24:12 +0000

When I started at my current company, spam was handled with a separate server running SpamAssassin and a few other services. This sort of got the job done but required babysitting. I wasn’t part of the Sysadmin team at that point but I know they had to restart SpamAssassin relatively frequently, manually clear out the email queue when people noticed they weren’t receiving email, etc.

After a few months, someone wised up and purchased a Barracuda Spam Firewall. I assumed this was basically a pretty GUI wrapper around the same tools we had already been using, but it was certainly worth the money. In addition to the basic filtering of spam it filtered for viruses, performed recipient verification against AD via LDAP, had nice graphing and reporting.

Passwordless SSH Everywhere

Tue, 30 Mar 2010 15:18:22 +0000

I’ve known about ssh keys for a long time and frequently use them, most frequently so that a script can transfer a file between two servers without having to do some mumbo-jumbo where I try to pipe a password into it or some other wacky thing. I hadn’t fully embraced ssh keys, though, because I didn’t like the idea that if I lost my laptop, I’d be losing a free key into my servers. Then I discovered ssh-agent. This isn’t new, so I’m kind of embarrassed I didn’t know about it, but I’ve been using it for a few months now and I can’t imagine going back.