I love my Snort, I really do. But sometimes, I just don’t need all the extra overhead – sometimes the resources on a server are somewhat, limited. Looking for a solution I stumbled upon PSAD , a way to detect port scans. Since port scans are often one of the first tactics used to find vulnerabilities on a server, it is a pretty good idea to detect them. Depending on the attack, I receive a nice little email telling me what is going on. To test it out I first fired up nmap, and received a few emails. Next I fired up nessus with updated plugins – you can be the judge. I now have 50 emails from myself telling me somebody is doing something naughty:

Historically I’ve used the ever-so-popular AutoMySQLBackup script. While it seems to work just fine, I’ve decided to give another solution a whirl. This solution, provided through Zmanda, seems to be less hackery and more enterprise. The instructions are very clear, and the backup test went as planned. Looks like this is another gem for the toolchest.

My buddy Ian mentioned Amazon’s S3 service, and the potential for using it for fun webapps. While utilizing it for webapps will have to wait a few months, I was able to use it as a cheap backup for my home server (pictures, documents, etc,.) – and my server that houses my email and websites. The setup is pretty quick, and most of it can be detailed in this S3 backup walkthrough. The ruby package is available at s3sync.net I’ll toss in my recommendation to use the jets3t Cockpit application for viewing the buckets, especially considering the Firefox extension didn’t work as advertised. My only two comments will be this:

I’ve run into this error quite a few times, might as well toss blog entry about it: ERROR 1064 at line 17: You have an error in your SQL syntax near ‘ENGINE=MyISAM DEFAULT CHARSET=latin1’ at line 7 One likely reason this comes about is because the data being imported/exported is not compatible with the database version. For instance, at home you export the information from a mysql5 database. Then you try to import it on a mysql3.23 database somewhere else – and it fails on you. Bummer. The solution is quite simple:

Ian keeps bugging me at how great Quicksilver is. Knowning that there must be an alternative built for linux, I accidently stumbled across Katapult. While it still has a little room to grow, Katapult makes a great tool in any KDE toolchest. Press ALT+SPACE, and your widget fires up, ready to take your orders. Since words don’t really do this justice, I created a screencast. Katapult Screencast from Kelvin Nicholson on Vimeo.

In the next year I plan to make a little video, nothing fancy likely, but something that will require an editor. However, I don’t own a mac (which rules our Final Cut Pro + After Effect and iMovie, which Ian and I both have had too much fun with. Inside joke.) I’m also a die-hard Linux fan, trying to hold out buying a mac for as long as possible. SF to the rescure. There are four editors listed, and in the next year I’ll try them all. Overalll, they look quite promising.

Yea, you read that right. Three commands and you can run a pen-test on your website/webserver. So, how? kelvin@home:~$ sudo apt-get install nikto kelvin@home:~$ sudo nikto -update kelvin@home:~$ nikto -h www.thoughtdeposit.net As you can see, Nikto is a web server scanner, apparently for over 3200 dangerous files/vulnerabilities. Additional features can be seen at the Nikto website, yet you will certainly want to add this old gem to your webserver toolbelt as soon as possible.

I’ll admit, I think one of the thickest barriers to entry regarding Linux is variety. I love variety, but general end users don’t adjust well to change (IMHO). Thus enter the stage: Portland. So, what does this mean to the end user? This means that, eventually, the UI throughout linux will all look similar – regardless if it is designed to utilize GTK, QT or anything else (that is, if it is built off the Portland standard).

I like most standards, I can’t deny it. One thing that I find too humorous is the amount of sites that are not valid, even sites that claim they are. One tool in my box is HTML Validator, an extensioin for Firefox. A nice little icon appears in the lower right, indicating whether a page is valid, not-so-valid, or really-not-so-valid. Makes it easy to check your own sites, and others.

Information is power, or so many of us think. As an I.T. administrator, no matter what the level, it is of my opinion that knowing what your network is doing is important. This includes regular operation, what it could do in the event of a disaster, or when it is just slightly not functioning. Editor’s note: This 2006 post describes an old monitoring workflow at a high level. Identifying details are intentionally omitted or obscured.