Justin Carmony » Security

Setting up SSH Key Authentication Between Servers

Justin Carmony — Wed, 14 Jul 2010 19:52:05 +0000

I always forget how to do this, so I have to look it up each time. This will make it easier the next time. It is so simple, just I always forget.

First, I need to generate my ssh pub and private keys on the host server: ssh-keygen

Second, I need to copy the pub key to the remote server: ssh-copy-id -i id_rsa.pub user@server.local

Then, that it! Now that I wrote it down, I won’t forget it… I hope.

Data Backups – There Are No Excuses

Justin Carmony — Sun, 19 Apr 2009 00:04:48 +0000

Today I just had the terrible experience of having a database lose data, need to restore, only to not have a recent backup. If you haven’t had this experience before, please, take this serious. My wife was home for lunch as it happened, and she watched as the blood drained from my face. It only took a few seconds for the loss to happen, and immediately I knew exactly what the repercussions where. The immediate second thought that passes through your brain is “Where are my backups?” That is when I realized I didn’t have my nightly backups set up on this server. I quickly checked the file date on the last known backup I had.

13 Days.

It could have been a lot worse, but it was still extremely bad. Those last thirteen days had been record setting days. Emails each day were going around about record new signups, records internal messages sent, etc. Those thirteen had been the best 13 days by far.

If some of you are wondering what had happened, and know me to be very diligent in my backups, I did the one wrong, terrible thing: I made an assumption. I’ve blogged before on how backups have saved me in the past, and how I am almost a fanatic about them. So what the heck happened?

This website was on some hardware that was starting to get overburdened. Then, out of the blue, our traffic exploded and our web server and database server started to grind to a halt. I spent long hours and sleepless nights migrating from these old servers from a terrible host to some new virtual machines. We then discovered our MySQL Database was so intense that the virtual server couldn’t handle the CPU and I/O requirements. Finally, in a last attempt of desperation I moved the Database to a spare box of another company who gave me permission to use it temporarily. That finally worked and allowed us to handle the load on our Database. By the time I finished this, it was about 8 AM in the morning and I went to bed.

I assumed we’d only be on this box for a day or two, so I didn’t setup the backup scripts. However, it gave us more breathing room than we expected, and other issues came up non-db related. The company lending the us the server said we could take our time, so the urgency on ordering our new hardware was pushed off more and more. I had completely forgotten about setting up backups scripts, and we ended up where we are now.

What I’m Changing Personally

I’ve decided to make two changes personally after this experience.

First, there are zero excuses for not having automated backups. Zero, zilch, nada! If a backup should have occurred, there is no excuse for it not to happen.

Secondly, I’m going to pick a day of the month where before I do anything else, I verify that all the backups are working. My father-in-law on the first business day of the month has the habit of doing his business’s billing and other accounting activities. He lets just about nothing stand in the way, and all ways checks his bank accounts and records to make sure everything is in order. I’m going to adopt this same idea, only with servers and data. The first business day of the month I’m going to go through all the servers under my care, verify the backups are working, check error logs, etc. I want to catch the problem before anyone else does.

How To Prevent Data Loss

Here are a few guidelines to make sure you don’t fall victim to data loss.

Select a Backup Schedule & Follow It 100% - I suggest for most websites, a daily backup will work out pretty well. If you have a lot of data that would really stink to lose that changes frequently through the day, you could backup several of the tables hourly.
Back Up To Several Locations – I like my servers to have two hard drives. One for the live data and another for backups. Then, after a backup has been created, I like to sync that backed up data to another server. It is important that if a meteor fell from the sky and hit your data center (or a flood, fire, earthquake), you would have a very recent backup somewhere else.
Verify Your Backups – I can’t stress this enough. After this terrible accident of not having a recent backup, I went and checked all my other website database backups. I found out that one critical database’s backups were broken and not running nightly. You never want to find out this information after you have to restore from a backup. Regularly verify that your backups are being created, and that you can restore from them.

Hopefully this will motivate at least one person in our profession to evaluate their backup strategy and make it better. You don’t ever want to tell a client that you just lost 13 days of their record setting work.

WhiteHouse.gov YouTube Channel Hacked?

Justin Carmony — Fri, 30 Jan 2009 21:08:05 +0000

I’m not sure exactly what this is, but its strange. I wanted to add the whitehouse YouTube channel’s RSS feed to my Google Reader. I might not have voted for Obama, but I think he is using new technologies to communicate with people in a very good way. I’m excited for the precedence that he is setting in the government, and for future leaders, on how to leverage the Internet, video streaming, etc.

When I added the RSS feed to my Google Reader, I saw a weird post titled “MPEG FOUR DOJ” with one view. Not sure how it got there, but I highly doubt it was published by Obama’s office.

This brings up one point that Obama’s administration is going to have to face. The whitehouse YouTube channel is has become a highly valuable target for people to hijack. So many groups, from the harmless to extreme, would love to have 5 minutes of fame by compromising the account and posting their own videos. There have been issues with Sara Palin’s email account during the election campaigns. It will be interesting to see how things will shake out.

Palin’s Yahoo Account Gets Hacked

Justin Carmony — Thu, 18 Sep 2008 15:26:22 +0000

Today I opened my email and found a story about how Sarah Palin, the Republican VP Nominee, had her email account hacked. Here are some quotes:

On the heels of media reports that Republican vice presidential candidate Sarah Palin was using a private Yahoo e-mail account (gov.palin@yahoo.com) to conduct Alaska state business, hackers have broken into the account and posted evidence of the hijack on Wikileaks.

An activist group calling itself ‘anonymous’ claimed responsibility for the compromise and released screenshots, photographs and the e-mail addresses of several people close to Palin, including her husband Todd and assistant Ivy Frye.

Following the release of this story, both Sarah Palin’s better known account gov.sarah@yahoo.com and the gov.palin@yahoo.com account have been suspended or deleted as revealed by a test email sent to these addresses by Wikileaks. Although the reasons for the deletion of both accounts can not not yet be established, one interpretation is that Palin is trying to destroy her email records.

This story is a classic example of people not knowing the dangers of the Internet. People can be clueless as to how they have their stuff compromised. However, in this case, it is extremely dangerous for politicians. People “armed” with access to private materials, and I don’t care which politician it is, can be manipulated. There could be hundreds of emails that are fine, and just one email taken out of context could skew opinions.

The comment that irks me is “Although the reasons for the deletion of both accounts can not not yet be established, one interpretation is that Palin is trying to destroy her email records.” If you’ve know that your email accounts have been compromised, accounts that contain very personal and work related information, wouldn’t you want to prevent people from using it? This “one interpretation” makes it sound like Palin is covering her tracks, where as she might just not want the whole world prying into her life? Give me a break with all this alluding to cover up and conspiracy.

If Barack Obama had his email compromised, I’m sure there would be enough ammunition to attack him and make up stories of corruption. Only time will tell what will be posted about what was contained in her email account. Honestly, I doubt they found anything incriminating or they would have posted it already.

AVG – The New Popular Anti-Virus

Justin Carmony — Mon, 07 Jul 2008 03:38:44 +0000

AVG, a popular anti-virus that I use, has a good free version. I guess it has become popular enough that I found a avgsafe.dll on a computer using HijackThis. The reason it suck out is that they didn’t have AVG installed. Was easy to remove and the computer was good to go.

Apple Needs to Stop Being Misleading – Viruses & Malware

Apple Needs to Stop Being Misleading – Viruses & Malware

Justin Carmony — Wed, 02 Jul 2008 11:09:00 +0000

The other day I was talking with my cousin and she asked how I liked my MacBook Pro. She told me all the cool things she had heard. A friend of hers said that with a Mac you don’t ever need to buy anything like “Norton” cause Macs don’t get viruses. She asked me if that was true and in reality it is a two part answer.

Here is the classic ad on Apple & viruses:

This is what I like to call a classic “misleading.” Here are my points:

1) Macs Have Fewer Viruses – True

This is absolutely true. There are hundreds of thousands of viruses each for the PC, and it is only escalating. Numbers can be misleading, as many of the viruses are almost identical, just slightly tweaked for the viruses creator. However, PC holds a MUCH higher market share. 80% percent at least. Apple has climbed to 16% of sales in 2008, Q1. What does this mean? OS X has been used by the minority for a very long time. However, it is gaining more and more popularity. Apple sold 66% of high end computers costing $1,000+ in Q1. It is definitely moving to be mainstream and not obscure.

This increase in users will, undoubtedly, causes the Mac to increase as a potential target. Especially if Mac users think they are invincible.

2) Macs Are Virus Proof – False

This is absolutely false. Like any other operating system, Macs can be targeted, exploited, and compromised, especially if users are not careful. At the moment, there are some severe mac exploits going around, and in many ways a lot worse than Windows exploits.

6.20.2008 News
Intego has posted an advisory titled OSX.Trojan.PokerStealer Trojan Horse to their website. The trojan horse is a script wrapped in an executable bundle. Once launched, the script will prompt the user for his password, and turn on SSH for outside attackers to gain access to the system.

6.19.2008 News
Security Alert: SecureMac has discovered multiple variants of a new Trojan horse in the wild that affects Mac OS X 10.4 and 10.5. AppleScript.THT Trojan Horse runs hidden on the system, and allows a malicious user complete remote access to the system, can transmit system and user passwords, and can avoid detection by opening ports in the firewall and turning off system logging. Additionally, the AppleScript.THT Trojan horse can log keystrokes, take pictures with the built-in Apple iSight camera, take screenshots, and turn on file sharing. The Trojan horse exploits a recently discovered vulnerability with the Apple Remote Desktop Agent, which allows it to run as root. Read more.

6.18.2008 News
Security Alert: Mac OS X root escalation exploit code in the wild.
Read more.

These exploits are just with the last few weeks.

The problem is the false sense of security that “normal” users are having with Macs. For a long time, Macs were for fan-boys and professionals. The average user never would have owned a Mac. That is changing. There are so many “average” users using Mac now that it poses a threat, especially if they believe they are virus proof. I mean, are we going to have to re-train every Mac user to not open unknown attachments and be careful of what they download from the Internet?

I’ll give Apple credit, there are a lot of aspects of OS X that make it more secure by nature. This in many ways is due to their use of FreeBSD as the underling OS. So in many ways, yes a Mac is a lot more secure than a Windows PC, but you still have to be careful. The more Mac owners there are, the more attention they will get from hackers, especially if the Mac owners are ignorant.

How to Be Safe

Here are some very simple ways to stay safe:

Look at getting an Anti-Virus. This will go a long way. Many people suggest Intego.
Download only trusted applications from trusted websites.
Avoid Piracy and Illegal Torrents. Many times this is where hackers place viruses.
Don’t view sensitive material on the Internet when connected to a public Wi-Fi spot.
Keep your Mac OS X up to date. Apple has been pretty good at staying up to date.

Just remember, just because it is a Mac doesn’t mean its virus free.

Technorati : Apple, Mac, Malware, OS X, Security, Viruses
Del.icio.us : Apple, Mac, Malware, OS X, Security, Viruses
Zooomr : Apple, Mac, Malware, OS X, Security, Viruses
Flickr : Apple, Mac, Malware, OS X, Security, Viruses