grep -ir 'invalid user' /var/log/*

Example output

/var/log/auth.log.0:Aug 15 18:14:40 sshd[20296]: Invalid user production from 85.214.40.85
/var/log/auth.log.0:Aug 15 18:14:42 sshd[20296]: Failed password for invalid user production from 85.214.40.85 port 54327 ssh2

That’s when I noticed usernames like

minecraft, eggbreaker2 ,batman ,sir , queen, elmo, frenzy, christmas, idiot, birdseed, einstein123, breast, knight, cookie, eminem, asshole123, googol, denied

and decided to make some graphs with the data.
Using perl I extracted the information from the log files.
This is what I got from ~20.000 failed attempts (spread over couple days)

Popular usernames

Existing usernames

Invalid usernames

Bots tried ~5500 invalid usernames in ~15500 attempts

Invalid vs. existing usernames

Overall

It’s not surprising ‘root’ came out on top, it was used in 18.8% off all attempts.
That doesn’t seem much but it is, since the bots tried that many different usernames.

You can disable root login by opening sshd_config and changing the ‘PermitRootLogin’ setting to ‘no’.

# Authentication:
PermitRootLogin no

Don’t forget to restart the SSH daemon.
P.S. don’t lock yourself out by forgetting you other administrator users passwords

SSH Recommendations

Found out Symantec did the same thing a year ago, you can check their findings and recommendations if you want to protect against these attacks.

Setup a chroot jail

We have no FTP running on our server, users need to connect through SFTP.
Everyone gets a unix user and home folder on the server, to hide the server structure and
limit the users to their home folder we had to setup chroot. It also blocks those user to login
with SSH, SFTP is the only allowed service.

Creating a chroot jail is fairly easy providing you use openssh 5.x.
This explanations is only valid for those versions, and I assume openssh is correctly installed.
If you need to install openssh I suggest you visit http://adamsworld.name/chrootjailv5.php

Modify sshd_config

Mine is located at /etc/ssh/sshd_config (depending on your installation)
Comment all lines starting with ‘Subsystem’ and add ‘Subsystem sftp internal-sftp’.
Add the 4 lines containing the match block at the end of the file.

# Subsystem sftp /usr/lib/openssh/sftp-server
# Setting up chroot jail
Subsystem sftp internal-sftp    
 
Match group users
       ChrootDirectory /home/%u
       ForceCommand internal-sftp
       AllowTcpForwarding no

This jails all users in the group ‘users’ to their home folder. You can also jail induviduals with another match rule : ‘Match user username’.

Change ownership & rights

Create the group ‘users’, and add the persons you want to jail to the group.
The jail needs to be owned by the root user, so lets say you want to jail ‘john’ (homefolder : /home/john.com)

chmod 755 /home/john.com
chown root:root /home/john.com

Restart SSH daemon

# Debian, Ubuntu
sudo /etc/init.d/ssh restart
 
#Fedora, CentOS
sudo /etc/init.d/sshd restart

And you’re done!
The files and directories inside the home-folder can have whatever rights and owner you please.

Here are some of the most important new features :

• Minimize/Close to tray (WINDOWS)
• Local Books
• Online Books Download
• Inline Search
• Performance Upgrade (SQLITE)
• Custom tree icons
• Complete design makeover

Take a look on our website to learn more …

Somethings been bugging me while skinning a flex application :

The label from the selected tab from the TabNavigator component is 1px lower than the other tabs. As you can see in the example.
(It has something to to with the bottom border I’m guessing).

This can help as a visual support you are on a different tab, but I found it rather annoying, so here is my fix for it.
A quick fix by changing the “paddingTop” property.

View source is enabled so can download the example there.
http://ninetynine.be/blog/wp-content/uploads/2009/12/srcview/index.html

Code after the jump.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

import mx.events.IndexChangedEvent;
import mx.events.FlexEvent;
 
/*
*	@author: Michiel Vancoillie
*	http://www.ninetynine.be
*/
 
private function init():void{
 
	//fix the first selected tab
	fixedTabNav.addEventListener(Event.ADDED_TO_STAGE,onTabNavCreated);
	//fix the newly selected tab
	fixedTabNav.addEventListener(IndexChangedEvent.CHANGE,onTabNavChanged);
 
	//JUST ADD THE SAME EVENTLISTENERS TO ALL TABNAVIGATORS YOU WANT FIXED
	//notfixedTabNav.addEventListener(Event.ADDED_TO_STAGE,onTabNavCreated);
	//notfixedTabNav.addEventListener(IndexChangedEvent.CHANGE,onTabNavChanged);
}
 
private function onTabNavCreated(e:Event):void{
	var tabNav:TabNavigator = e.target as TabNavigator;
	tabNav.getTabAt(tabNav.selectedIndex).setStyle('paddingTop',-1)
}
 
private function onTabNavChanged(e:IndexChangedEvent):void{
	var tabNav:TabNavigator = e.target as TabNavigator;
	//reset the old tab
	tabNav.getTabAt(e.oldIndex).setStyle('paddingTop',0);
	//fix the new tab
	tabNav.getTabAt(e.newIndex).setStyle('paddingTop',-1);
}

MamppControl

Hey,

Yesterday I had some spare time, so I decided to take a look at the Cocoa collection of frameworks, APIs, and accompanying runtimes that make up the development layer of Mac OS X.
I’ve created this first application with XCode in Objective-C and named it MamppControl.

It allows you to start, stop, reload Mampp from the tray, with a handy tray icon & menu.
Mampp is the other name for Xampp on Mac.

XAMPP is an easy to install Apache distribution containing MySQL, PHP and Perl. XAMPP is really very easy to install and to use – just download, extract and start.

More information about Xampp here.

I know that there is a launcher includes in the xampp package, but it has no tray icon and stay’s visible in the dock.

Default Xampp Control Panel

At the moment Mampp supports only the basic commands (start, stop, reload). If there is need for the other start/stop settings, contact me through the contact page on this blog or shout it here in the comments.

Mampp needs root access to start the xampp, that’s why you get the security login at start.

1

sudo /Applications/xampp/xamppfiles/mampp start

You only have to do this once for the lifetime of the process. And when you change the path setting.

Also keep in mind that there could be some delay when starting or stopping Xampp, since ProFTPD usually takes a few seconds to launch (at least on my laptop it does ).

MamppControl checks if Xampp is already running on startup, and behaves appropriately with that knowledge …

Screenshots

 

 Quicksilver

 

 Security login

 

 Tray Icon

 

 Tray Menu

Download

MamppControl is licensed under the MIT license.

Copyright (c) 2009 Ninetynine.be

Permission is hereby granted, free of charge, to any person
obtaining a copy of this software and associated documentation
files (the “Software”), to deal in the Software without
restriction, including without limitation the rights to use,
copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the
Software is furnished to do so, subject to the following
conditions:

The above copyright notice and this permission notice shall be
included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
OTHER DEALINGS IN THE SOFTWARE.

Download : MamppControl - 116.76 kB


Current version: 2.0
Requirements:

   • Mac OS X 10.5 or higher.
   • Xampp installation @( /Applications/xampp/xamppfiles/mampp )

Version History

v1.0

• First public release

v2.0

• Added support for latest Xampp for Mac OSX (1.0.1)
• Added option to choose path to “xampp” executable
• Added complete events for starting & stopping & reloading
• Some minor changes internally

‘Why is this useful?’, you could ask. Well one situation is you’re creating an online rich text editor, and you want to add a font
to the font list. You would only have to edit the css and upload the new swf instead of the whole application. Or you want a client
to be able to add fonts without him having the source code from the application.

Luckily it’s possible in Flex to load runtime CSS compiled as an SWF with the StyleManager class.
StyleManager on LiveDocs

Fonts.css Example :

1
2
3
4

@font-face {
    src:url("fonts/Arial.ttf");
    fontFamily:"Arial";
}

How to compile the CSS to SWF?



In Flex Builder you can right click any CSS inside your source and check the “compile CSS to SWF” option.


An alternative way to compile the CSS to SWF is using the command line :

1

mxmlc Fonts.css

Loading the compiled stylesheet

For the example where we just compiled the Fonts.css to Fonts.swf

1
2
3

import mx.styles.StyleManager;
 
StyleManager.loadStyleDeclarations("Fonts.swf");

It’s as simple as that… you can now start using the font.
The nice thing about this is you can now load your fonts visually using an intermediate loader or animation.


Loading the stylesheet visually with intermediate loader

First thing we do is create a custom titlewindow with a preloader in it to show the loading.
We can catch the StyleEvent.COMPLETE with an IEventDispatcher.
Right click the example for the source code.

You can use this to ‘preload’ any stylesheet.

Compiling CSS to SWF and loading it runtime is also used for application with theme support.
You can read more about that and view an example here : Understanding runtime CSS

Happy coding!

The as3growl library is an ActionScript library that leverages new TCP socket communication functionality within the Growl notification framework to allow Adobe AIR and Flash applications to register with, send notifications, and receive events from the Growl service.

You can grab the latest as3growl here or with the svn :

1

svn checkout http://as3growl.googlecode.com/svn/trunk/ as3growl-read-only

The support for AIR and flash is not yet in the release version, so the first step is download the nightly build from growl :

http://bitbucket.org/evands/growl/changeset/eb9d3e4d9fa3/

1. Unzip
2. Open Growl.xcodeproj in Xcode 3.1
3. Set target to “Deployment”
4. Build
5. Double click the “Build/Deployment/Growl.prefPane” file to install the compiled Growl.

To start using the as3growl API, you can check out the example on the wiki:
http://code.google.com/p/as3growl/wiki/UsingTheLibrary

I’ll probably post a little tutorial later!