I happen to like apache 1.3 and see no problems with the 2.4 kernel. The SA version in stable is 2.2 so it's quite out of date. Then there is exim using version 3.36. The thing I like about stable is that the security patches happen first in stable. Having been hacked once, I tend to be a bit more conservative these days (*and by the way, I've also been seeing a lot of those scripted hack attacks). At least where my "production" software is concerned. At home I run testing/unstable. Not sure how I accomplished that, but there it is.

* I've added some code to my firewall rules to read in my personal blacklisted ipaddresses from a file and make drop rules out of it.

Now I need to write a little script to put in cron to scan my logs once a day and extract ip-addresses that are attempting to login and add them to the blacklist and restart the firewall.

something like:

MYADDR=xxx.xxx.xxx.xxx BLACKLIST=/etc/blacklist.txt FWSCRIPT=/etc/init.d/firewall.sh

cat /var/log/auth.log |grep -i failed\ password | cut -d\ -f11 |uniq > nuiq.txt if [ -e nuiq.txt ] then while read ipaddr do if [ $ipaddr ne $MYADDR ] ; then echo $ipaddr >> $BLACKLIST fi done < nuiq.txt $FWSCRIPT restart fi

My only problem here is sometimes I need to use 'cut -d\ -f11' and sometimes 'cut -d\ f12'. Sometimes I have to do both in the same file. So I guess it's time to pull out the sed pocket reference I have and learn something in there to help. It's because of the way the date is being posted to the log file: Oct 9 ... Oct 10 ... So I get one extra delimiter when the date has one digit. I'd also like to be able to skip the saving of the list to a file step. Alas my script skill are insufficient for the task. Also I might soon need to use a case or some other control method to ignore perhaps a half a dozen ipaddresses or even a range of ipaddresses for other users of the system.

Brian

-----Original Message----- From: Jeremy Turner

I said the heck with it and pinned my server on sarge. It'll be the new stable soon enough. I can't stand SA 2.4 or whatever is in stable, same with 2.4 kernel, Apache 1.3, etc.

Jeremy

-- Jeremy Turner jeremy@linuxwebguy.com Linux Tips and News! ---> http://linuxwebguy.com