Why relying on secrecy alone is insufficient, plus practical tools for monitoring and responding to security threats.
"In security engineering, security through obscurity (or security by obscurity) is the reliance on the secrecy of the design or implementation as the main method of providing security for a system or component of a system. Security experts have rejected this view as far back as 1851, and advise that obscurity should never be the only security mechanism."
We often rely on our security being through some sort of obscurity. "If they don't know about it, they can't use it to get in." Common household door locks only have so many combinations, yet we can rely on the lock of our front doors because we know that a thief would have to try every combination or break-the-door-down. However, on the Internet, who is watching your front door, so a thief cannot try every combination?
Fortunately, our web-server has an access.log file that is automatically updated and archived for us.
The output should be a list with two columns — one containing the number of entries counted, and the second column is the IP address associated with each web request made. The easiest way to get the most information from a reverse IP lookup is by using the following command:
Rather than rely on an external web service, you can do some digging after you install some tools that are not included by default with the Pi:
Install dnsutils for DNS queries:
Does the location seem suspicious? Try grepping for the activity — the zgrep command includes compressed files:
By looking at the web requests that were made from the IP address, you can determine whether the activity is suspicious. Typically, you will find that these IP addresses are from bots looking for vulnerabilities in your security. You can manually block IP addresses to your blacklist or you can just deny all and allow select IP addresses. If you haven't already, you'll want to install and setup a firewall.
Instead of manually blocking IPs, use fail2ban to automatically ban attackers. See Hardening a Self-Hosted Server for complete setup instructions.
fail2ban monitors log files and automatically bans IPs showing malicious behavior. Here's a quick setup for Apache:
After one week of running fail2ban on my server, it had automatically banned 47 IPs attempting to brute-force WordPress and phpMyAdmin — none of which I would have caught manually.
Your answers shape what we write next.
Questions, experiences, or ideas — we're listening.