Securing an ssh server with fail2ban

There are all kinds of ways to secure an ssh server, with varying degrees of increasing security and decreasing flexibility. For example by limiting your server to only accept connections from certain known IP's, you are secure from random hackers on the internet, but you lose the ability to connect to your machine from anywhere you want to. Perhaps while travelling, for example.

Port knocking and listening on a high numbered non-standard port. make it harder for an attacker to even start trying to hack your connection. But this also requires you connect with a machine that you have the knock program installed on. Again, less convenient, more secure.

However, once an attacker does find your port there's nothing to stop brute force password hacking. If you look in your log file, you should see people connecting to your ssh port quite frequently and trying password attacks.

cat /var/log/auth.log

If you have a secure password then it would require days of brute force hacking to gain access to your ssh account, but even so, if you don't watch your logs then it's perfectly possible somebody will gain access eventually.

Brute force attacks can be limited using fail2ban. There's a great article on setting it up here. This program will scan your auth.log for you, using a regular expression to find failed password attempts. On a specified number of failures from a given IP, it will then modify the iptables on your machine (the firewall), to lock that IP out for a specified time.

Now instead of watching your auth.log fill up with reams of failed passwords, you'll see a greatly reduced amount of brute force attacks, and you can watch your fail2ban log file fill up with the IP addresses of hackers.

Using screen

When running a linux app, perhaps on a remote box, you don't want it to terminate when you close the terminal window. You can run some applications as daemons, or run them with the nohup command (no hang up).

For example:

nohup ./myapp > output.txt

will run the program myapp and send the output to output.txt.

You can then follow the output.txt with a command

tail -f output.txt

but if you hit Ctrl-C or close the terminal (or have a power cut), the application will still be running on the remote machine.

A more powerful solution is the Gnu screen application. This lets you run multiple shell sessions and switch between them. Using screen you can be logged into a server in your office, then detach from the screen session, go home and reattach to it there (assuming you have network access to the computer).

Here's a cheat sheet for using screen.

Running it:

screen

Learning to use it:

Ctrl-a help

Important commands:

Ctrl-a c (open a new window)

Ctrl-a p (prev window)

Ctrl-a n (next window)

exit or C-a q to exit

How to reattach to the screen session:

screen -ls

That shows screen sessions on the machine your logged on to, and then you reattach using:

screen -r name

That's all folks!

Transparent emacs on windows

Here's a handy function which lets you choose a transparent level (0 is fully transparent and 100 is opaque), for the main emacs frame in both focused and unfocused state.

(defun transparent(alpha-level no-focus-alpha-level)
 "Let's you make the window transparent"
 (interactive "nAlpha level (0-100): \nnNo focus alpha level (0-100): ")
 (set-frame-parameter (selected-frame) 'alpha (list alpha-level no-focus-alpha-level))
 (add-to-list 'default-frame-alist `(alpha ,alpha-level)))

To run M-x transparent. 

Enter the values you want for when the window has focus and when it does not. In the background you can see system status information on the desktop, which is another excellent utility from sysinternals called BgInfo. It let's you display useful info about your system right on your desktop, similar to tools you may find on linux. 

MSDOS iterating filenames in a file

In an earlier post I covered finding the writable files in a directory, which is something you often need to do when messing around with source control. For example, if there's a writable file in your source folder that isn't checked out, then you know you need to add it before checking in. In fact I have a tool that compares my changelist with the list of writable files, and lets me know if I'm about to break the build when I check in.

Anyway I digress. Once you have found the writable files using:

dir source_folder /a-r-d /s /b > files.txt

then you may want to run some operation on them; for example make them read only.

Here's how to do that with the windows for command (see here for documentation)

for /F %i in (files.txt) do attrib -R %i

The for command with the /F option can iterate through a file full of filenames, which is what we generated with the first command, and run the operation after the do instruction.

It's actually quite powerful; you can specify comment markers, delimiters, and choose which of a number of columns you want to make into variables.

Windows command window title

Did you know you could change the title in the window of a command prompt using the title command? Example:

title Poop ha ha

Now that's only really useful for making windows with rude words in their title bars right? Well actually, I've found a great use for it. If you have a bunch of command prompt windows open then you have no idea which one is which on the Windows taskbar, once they are stacked. So naming them is a really useful habit since once named you can see which window is which.

English quote in Common Lisp

(defun today() (cadr days-of-your-life))

Making emacs growl

I've always wished emacs could notify me of it's doings. For example the message function just pops up text in the minibuffer and is easy to miss, and impossible to see when the window is not in focus. So I was pleased when looking through the twit.el code to find out about todochiku, and emacs interface to Growl.

Download Growl for windows and set it up. Send yourself a test growl at the command prompt like this:

"C:/Progra~1/Growlf~1/growlnotify.exe" /T:"title" "message"

Once that's working you can send notifications from emacs. todochiku is an emacs package for sending notifications to growl, snarl or whatever you have. In our case we have growl. Unfortunately the windows default is to use snarl, and there's no support for growl. I've made a few modifications to the original to get that working and uploaded the new file here. (Ideally I should make it so it searches both for windows and for growl or snarl being installed but for now the choice is made manually)

heyes-jones.com/todochiku.el

Download the elisp file into a directory in your emacs load-path (or add it) and add the (require 'todochiku) command to your .emacs file. Reload emacs, or just hit C-x e after the (require command in your .emacs)

You will need (require 'cl) somewhere before this is loaded (.emacs perhaps)

Customize the variables for the program using M-x customize-group todochiku

You'll need to set the `todochiku command' to something like this:

C:/Progra~1/Growlf~1/growlnotify.exe

Use "Dir /x *" in a folder to find out what the 8 character name is.

If you want icons that come with todochiku then download them from the todochiku wiki page and point to them with the variable `todochiku icons directory'. For example mine is set to:

~/localemacs/todochiku-icons

Finally you can do a growl... try this

(growl "Emacs" "Hello")



There's also `todochiku-message' which let's you specify an icon. This can be an image filename, and url, or an icon symbol from the built in list of icons you can find by the variable `todochiku-icons'.

(todochiku-message "Emacs" "You're growlingnow" 'social)

(todochiku-message "Emacs" "You're growlingnow" "http://www.growlforwindows.com/gfw/images/downloadlatest.gif")

(todochiku-message "Emacs" "You're growlingnow"
"c:/cygwin/home/Justin/localemacs/todochiku-icons/binary.png")

There's a command `todochiku-in' which will send you a notification from emacs in a set number of minutes.

(todochiku-in "hello" 3)

If you use twit.el you should find that todochiku automatically notifying you of tweets if you have called `show-recent-tweets'.

It's very simple to use todochiku and growl so you should find all kinds of applications for this. Have fun!