Zix...Webmin is a GREAT BIG security risk. You can root a *nix box running webmin in about 30 seconds. If you HAVE to use it, ssh in and run the service only when you need it, then stop the service when finished.
Rick: Yeah, I know. ;)--> I've also switched it to SecureHttp access as well to cut down on traffic sniffers. I'm no Linux expert, but I do cover my backside on things like remote administration! :D-->
Thanks,
Zix
Secret Signature of the Day==v
If nobody knows what you're doing, nobody knows what you're doing wrong.
A lot of people use Webmin and really don't realize how unsecure it is. I started working with Unix back in the mid-80's when I was a programmer for At&t. Best os ever, in my opinion. Now I use Free-BSD for servers, although Red Hat looks really good for the Desktop.
I see your just teaching yourself linux...if you have any questions, let me know!
Rick: Thanks, I appreciate the offer! I have much, much more experience with IIS on WindowsNT, but with the old clunker machine I had, running NT4 would have been more trouble than it was worth.
Apache is quite low-maintenance (more like no-maintenance) for what I use it for, although I may just install Tomcat and play around with some Java Server Pages for it... :D-->
I don't use the X desktop--too slow on that box. The command line interface is usually good enough for anything I have to do, and I can ssh into Webmin for most stuff. I do hate the vi editor though...the cutting edge of 1975 technology. -->
Secret Signature of the Day==v
If nobody knows what you're doing, nobody knows what you're doing wrong.
VI was the first full-screen editor, to my knowledge. It followed ed, which M$ stole later and called Edlin.
VI is STILL the best text editor I have ever used, for programming. The Set commands, which are abbreviated by se are very powerful. As are global substitutions. But that would be a thread unto itself, to go into all that! :)-->
Also, for those that may be interested in anti-bot scripts and such, I've written some in PHP that work well. If you have root on your own server you can even block them with whatever firewall you run on the server (it's trivial to update the /etc/hosts.deny file) or set up your .htaccess file (if you're using mod_rewrite with apache) to block bad people.
I've taken the protection of my visitors pretty seriously, as well as come up with ways to foil those bots that look for email addresses to spam. The latest version of my script looks for the ISP of the spambot (which is blocked in robots.txt) and then sets up a honeypot that creates a list of 1000 fake email addresses that will go back to the ISP they are using, so they end up harassing their own ISP. At the same time, I block them from visiting my site ever again, and then redirect them to a vulgar site.
P-mosh, the master white hat hacker and spam destroyer!
:D-->
Well, I've been getting too much spam lately, so I'm going to drop my cable modem ISP when I move, and I've already moved my personal email to my own server, which uses a few spam filtering programs. I have SpamAssasin, as well as some filters I set up myself, and I'm thinking of implementing a whitelist so that only people send me email that I allow to send it to me. That way, only my friends and family can send me email directly, plus any random people that visit my site can use the forms I set up to send me email rather than exposing an email address.
Recommended Posts
Bluzeman
Zix...Webmin is a GREAT BIG security risk. You can root a *nix box running webmin in about 30 seconds. If you HAVE to use it, ssh in and run the service only when you need it, then stop the service when finished.
Rick
Link to comment
Share on other sites
Zixar
Rick: Yeah, I know.
;)--> I've also switched it to SecureHttp access as well to cut down on traffic sniffers. I'm no Linux expert, but I do cover my backside on things like remote administration! 
:D-->
Thanks,
Zix
Secret Signature of the Day==v
Link to comment
Share on other sites
Bluzeman
Glad to hear it Zix!
A lot of people use Webmin and really don't realize how unsecure it is. I started working with Unix back in the mid-80's when I was a programmer for At&t. Best os ever, in my opinion. Now I use Free-BSD for servers, although Red Hat looks really good for the Desktop.
I see your just teaching yourself linux...if you have any questions, let me know!
Rick
Link to comment
Share on other sites
Zixar
Rick: Thanks, I appreciate the offer! I have much, much more experience with IIS on WindowsNT, but with the old clunker machine I had, running NT4 would have been more trouble than it was worth.
Apache is quite low-maintenance (more like no-maintenance) for what I use it for, although I may just install Tomcat and play around with some Java Server Pages for it...
:D-->
I don't use the X desktop--too slow on that box. The command line interface is usually good enough for anything I have to do, and I can ssh into Webmin for most stuff. I do hate the vi editor though...the cutting edge of 1975 technology.
-->
Secret Signature of the Day==v
Link to comment
Share on other sites
GarthP2000
Wasn't the vi editor the first screen based editor for Unix and workalikes? I think up till then only line based editors were used.
And this was *w-a-y-y* before multi-talented word processors like M$ Word came into vogue. Like back during the days of DOS 2 and edlin.
Prophet Emeritus of THE,
and Wandering CyberUU Hippie,
Garth P.
www.gapstudioweb.com
Link to comment
Share on other sites
Bluzeman
VI was the first full-screen editor, to my knowledge. It followed ed, which M$ stole later and called Edlin.
VI is STILL the best text editor I have ever used, for programming. The Set commands, which are abbreviated by se are very powerful. As are global substitutions. But that would be a thread unto itself, to go into all that!
:)-->
Rick
Link to comment
Share on other sites
Mister P-Mosh
aI am a big fan of vi. I don't know what you all think is wrong with it^ESC:wq
Link to comment
Share on other sites
Mister P-Mosh
Also, for those that may be interested in anti-bot scripts and such, I've written some in PHP that work well. If you have root on your own server you can even block them with whatever firewall you run on the server (it's trivial to update the /etc/hosts.deny file) or set up your .htaccess file (if you're using mod_rewrite with apache) to block bad people.
I've taken the protection of my visitors pretty seriously, as well as come up with ways to foil those bots that look for email addresses to spam. The latest version of my script looks for the ISP of the spambot (which is blocked in robots.txt) and then sets up a honeypot that creates a list of 1000 fake email addresses that will go back to the ISP they are using, so they end up harassing their own ISP. At the same time, I block them from visiting my site ever again, and then redirect them to a vulgar site.
Link to comment
Share on other sites
GarthP2000
P-mosh, the master white hat hacker and spam destroyer!
Prophet Emeritus of THE,
and Wandering CyberUU Hippie,
Garth P.
www.gapstudioweb.com
Link to comment
Share on other sites
Mister P-Mosh
Well, I've been getting too much spam lately, so I'm going to drop my cable modem ISP when I move, and I've already moved my personal email to my own server, which uses a few spam filtering programs. I have SpamAssasin, as well as some filters I set up myself, and I'm thinking of implementing a whitelist so that only people send me email that I allow to send it to me. That way, only my friends and family can send me email directly, plus any random people that visit my site can use the forms I set up to send me email rather than exposing an email address.
Link to comment
Share on other sites
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.