Archives for technology

Securing your datacenter – Physical aspects

Securing your datacenter - Juha Jurvanen JufCorp AB

A basic guide to securing your datacenter- part 1

This blog post is intended only as a basic guide to securing your datacenter and it’s a repost with some new stuff added into it. I also wrote a couple of follow ups to it that I will repost later.

It is not intended to be the gospel of security since, well.. let’s be honest, there is no such thing as absolute security.

As an example, in Sweden there was a case where a computer was locked in a vault, with no network access whatsoever and only a few people had access to it and still, it leaked information to foreign countries. Yes . a computer controlled by the military.

Absolute computer security is a myth and a beautiful dream. With that said, system administrators can still do a lot to make more difficult to access data and prevent attacks and sabotage to their systems.
Let’s start off with physical aspects .

The actual georgraphic location

Where is your server actually located and who has physical access to it?

Resetting administrator passwords or root passwords

Once you gain physical access to a sever, there are numerous way of accessing the data. The root password or Active Directory Domain Administrator password or NDS Admin password can be easily reset (yes, the sentence “easily reset” is used loosely) with a USB stick and booting the server. Have look a at for instance HIren’s Boot CD, Burglar for NDS or just play around with Google and search for terms such as “Reset administrator password”, “decrypt password” and so on .
You’ll be amazed when you realize how easy it actually is. Personally, I always carry with me some USB stick that enables me to boot up any system and “have my way with it”
So, we need to secure the server from outside access. The data center must be protected with card keys, cameras and access control. We need to who and why they are in the data center in the first place.For instance, a janitor or cleaning staff tends to have complete access due to what they do. Many companies hire outside help to get these kinds of jobs done.

Sabotage and disrupted data services

If I wanted to gain access to server, I would try to infiltrate one of those subcontractors to get a job as a let’s say janitor, and try to gain access to the data center somehow and from there, I can basically do what ever I wanted with the servers.
Maybe my goal wouldn’t be to steal data but to kill the data operations by corrupting the filesystems on the servers (for instance just “piping” data into various files from command prompt or hding files behind other files ), randomly switch disks on RAID systems or just put small holes in network cables to cause network errors, trigger an EMP in the data center and so on .
There would be numerous ways to disrupt the data operations, once i gained access to the data center or servers room.

Information theft

If I’m out to steal data, I would probably not target the servers themselves but instead I’d start looking for backup tapes or backup disks. Far too many companies have their backups in the same location as the servers themselves and since the backups usually are not encrypted , I’d go for stealing a complete backup set, go home and start doing a scan of the tapes to figure out what backup software was used and then do a complete restore of it all.
The backups are most likely to contain the data I’m after, although probably a maximum of 24 hours old but from them I can gain access to all kinds of information about the operations and crack administrative passwords for the server systems and so on . In the comfort of my own data center. or my couch.
This way would of require some skill of Disaster Recovery scenarios and how to get data back from backups but I’m fairly sure I’m not he only one in the world who has the expertise in those matters.

Backups are always a weak point from several aspects.

You need to know who has access to them , at all times.
If you are company that for instance have your backups shipped to another location on a daily basis or weekly, you need to know that people handling them haven’t been compromised. It wouldn’t take that long for anyone with the proper skills do clone your tapes or disks en route to their destination and you would have no way of telling they’d been cloned. In that scenario, all of your critical data would be in the wild, without you actually knowing it.

If you are using any kind of online backup service, remember to choose your encryption password wisely and be extremely restrictive with who has the password. A lot of backup software do not let you change the encryption password without doing the first backup all over again, thus doubling your usage of space and your costs.
Still , I highly recommend you use an encryption password for several reasons.
If you don’t use it, it’s just pure laziness and fear of administrative hassle and that’s just not an excuse. The risk of people at your online backup provider being able to access your data is of course also an obvious risk. Do you know these people and how could you be absolutely certain that they aren’t poking around in your data and maybe giving it to your competitors?

If you are thinking about online backups there are a few very essential questions you should ask yourself but we’ll get back to that later in another post.
Do not use the same encryption password as you have for Root / Administrator / Admin . That´s just crazy talk. Use a password generator to create a unique password. This is also very much valid for tape backups or backups on NAS / disk. Always encrypt your backups with password and be very, very restrictive with who has the password.

If an employee quits your company or an outside consultant quits his project and he / she has had knowledge of the password, change it.

If you’re doing a planned Disaster Recovery test for instance, change the administrative passwords right after the DR test , thus not enabling anyone to reuse what they’ve found out during the test
During the actual DR test, you should be there and be the one that actually types in the encryption password for the backups, not any outside technicians or consultants , not even the online backup service provider or your Disaster Recovery Service Provider. You , and you alone should be the one that has those passwords.
I’ll will return to backup questions and stuff regarding DR plans and so further down the line in some upcoming blog post
So, the conclusion is, always know who and why people are in proximity of your servers and NEVER let anyone be there alone without supervision and here’s a few more pointers.

A short cheatsheet for datacenters

  1. Always have you data center locked and secured from unauthorized access, If you have the means, also have it secured against an EMP attack from the outside. Of course, I haven’t even touched the subjects but be sure your data center has all the necessary fire prevention/extinction equipment in place, UPS backups and , if possible, also an outside source for generating current in case the UPS or battery runs out of current. There should also be a system in place for protecting you servers against spikes in current.
    Be sure to know where water pipes are running in the building so you don’t place your server directly underneath one.
  2. Don’t keep cardboard or any other kind of flammable materials in the data center. Be sure to take them with you when you’ve set up a new server or switched disks. Don’t be lazy. The cost of laziness can be extreme.
  3. In the data center, always have your servers locked in cabinets that requires keys and access card to gain physical access to keyboards and stuff. Also remember to protect the cabling and the back of the servers! Never have a server logged on the console. Be sure to have all cabling to the and from the firewall and the internet access secured.
  4. If you’re “expecting company” i.e. external consultant and so on, be sure to think abut NOT having different kinds of network maps, administrative passwords and different kinds of information in plain sight for anyone to see. I’ve seen it hundreds of times, the IT department having their entire IT operations and information of their systems on white boards or on print on documents next to their workstations. It’s very quick and easy to take a picture of it with a cell phone and once you understand the infrastructure you can also start exploring weak points in it.
    Sure , it makes their lives easier but as one might gather, it also makes the life of the attacker easier. Knowledge is a powerful weapon, especially when it comes to data protection
  5. Don’t have software laying around in the data center with software keys and stuff on them . All it takes is a mobile phone for someone to coy your license keys thus possibly putting you in an awkard situation having to explain to Microsoft for instance how come that your Volume License keys are a bit too easy to find on Piratebay, thus putting you n the risk of your licenses becoming invalid and bringing your server operations to a halt , or at least a shoer disruption.
  6. Know where your backups are, at all times. Have them encrypted. If using online backup services, be sure to use an encryption key and , if possible, be sure to have restrictions on the online backup service providers end on to and from where backups and restores are allowed
  7. Do not allow mobile phones in the data center due to the risk of people photographing your equipment or software license keys or using the mobile phones to copy data via USB cables and stuff.
  8. If possible, disable any USB ports on your servers. This can be done in the BIOS (and of course also have a sysmtem password for accessing the BIOS, a unique one for each server ) or you can physically kill it by putting glue or semothing in there (I haven’t tried that myself so do try at your own risk .. )
  9. If you are sharing a data center with others, there is no need for you to have your company logo or anything revealing the servers are yours. Keep it as anonymous as possible. There is also no need for you to tell anyone where your servers are physically located (although it can be fairly easy for anyone to fin out using traceroute commands and so on ),
  10. Be sure to have a Disaster Recover Plan (DRP ) / Business Continuity Plan (BCP) if your site is compromised or an accident should occur. Also in this case, treat the secondary DR location as mission critical data. Far too often, the secondary site is forgotten and poorly updated.
  11. Once again, do not underestimate the powers of social engineering. Although it’s not hacking in the usual sense, it’s merely good acting but it can still be as harmful as I’m trying to point out here

So, there’s a few tips anyway and that’s just the start really. It’s not a complete recipe for securing your physical environment and I’m sure I’ve missed out loads of stuff but it’s a start anyways.

I hope you you liked this post and I’d love to hear you thoughts on it and if you want me to write a few others on the matters of securing your server operations, I was thinking in the lines of brute force protection, change management, 0day attacks, certificate management , password policies, protecting web servers and so on , You get the picture 🙂

// Juha Jurvanen

Contact me

Senior consultant in backup, IT security, server operations and cloud

Syspeace rapport – Exchange Server attackerad över 400 gånger på några timmar

konsult inom backup It säkerhet molntjänster och infratruktur Att göra en server nåbar över Internet , oavsett vad den gör, kommer per automatik att att göra den till måltavla för olika typer av intrångsförsök.
Det finns många olika typer av intrångsförösk och även med olika syften. En del attacker handlar om att på ena eller andra sättet få kontroll över hårdvara som CPU, RAM, Disk för att användas i andra attacker. Andra attaker syftar till att stjäla data och en del försöker bara använda t.ex. en mail server för att gör s.k. realying d.v.s skicka SPAM meddelanden eller andra mail via en mailserver för att inte riskera att ens egen IP adress bli svartlistad. Här är en tidigare artikel jag skrev om olika typer av hacking attacker . OBS . På engelska.

Den här listan nedan är ett bra exempel på precis en sån attack som inträffade igår och är en automatisk genererad Syspeace rapport som kommer per mail till systemaadministratören.
Varje rad är alltså en Ip adress som försökte använda min mailserver till att skicka ut SPAM mail .
Samtliga attacker blockerades dock automatisk av Syspeace.
Notera gärna timmarna mellan kl 08 – 12 längre ner i sammanställningen på antalet attacker per timme.

Report for 2015-05-12

IP address Times Host name and country
——————– —– ——————————-
1.52.87.190 3 ; Vietnam (VN)
1.52.122.126 3 ; Vietnam (VN)
2.186.14.221 3 ; Iran, Islamic Republic of (IR)
2.189.154.42 3 ; Iran, Islamic Republic of (IR)
5.219.42.205 3 ; Iran, Islamic Republic of (IR)
5.223.24.99 3 ; Iran, Islamic Republic of (IR)
5.223.104.20 3 ; Iran, Islamic Republic of (IR)
5.251.38.50 2 ; Kazakhstan (KZ)
14.99.136.249 3 static-249.136.99.14-tataidc.co.in; India (IN)
14.161.37.108 3 mail.ttp.net.vn; Vietnam (VN)
14.169.155.10 3 ; Vietnam (VN)
14.169.222.5 3 ; Vietnam (VN)
14.177.134.252 2 ; Vietnam (VN)
27.3.128.183 3 ; Vietnam (VN)
27.77.34.63 3 ; Vietnam (VN)
27.77.135.131 3 ; Vietnam (VN)
27.77.144.136 2 ; Vietnam (VN)
27.79.105.254 3 ; Vietnam (VN)
27.105.42.42 3 27-105-42-42-adsl-khh.dynamic.so-net.net.tw; Taiwan (TW)
27.106.116.239 3 239.116.106.27-n4um-net4uindia.net; India (IN)
36.37.145.176 3 ; Cambodia (KH)
36.83.229.50 2 ; Indonesia (ID)
37.212.120.220 3 ; Belarus (BY)
37.215.118.21 3 ; Belarus (BY)
37.237.204.87 3 ; Iraq (IQ)
39.32.30.128 3 ; Pakistan (PK)
41.252.185.60 2 41.252.185.60.adsl.km4.dynamic.ltt.ly; Libya (LY)
41.254.2.208 3 41.254.2.208.zte-tip.wimax.dynamic.ltt.ly; Libya (LY)
41.254.9.101 2 ; Libya (LY)
46.99.147.11 3 ; Albania (AL)
46.100.132.7 3 ; Iran, Islamic Republic of (IR)
58.187.106.146 3 ; Vietnam (VN)
59.88.207.6 2 ; India (IN)
59.90.243.106 2 static.chennai.mp.59.90.243.106/21.bsnl.in; India (IN)
59.95.143.222 3 ; India (IN)
59.97.206.213 3 ; India (IN)
59.98.1.61 3 ; India (IN)
60.172.95.98 1 ; China (CN)
77.242.28.138 3 ; Albania (AL)
77.247.94.71 2 ; Albania (AL)
78.8.153.141 3 dynamic-78-8-153-141.ssp.dialog.net.pl; Poland (PL)
78.110.160.161 4 logistics1.openearth4.com; United Kingdom (GB)
78.152.183.58 2 ; Ukraine (UA)
79.106.12.167 3 ; Albania (AL)
79.129.40.59 2 scdental.static.otenet.gr; Greece (GR)
83.111.204.10 1 ; United Arab Emirates (AE)
85.96.192.37 3 85.96.192.37.static.ttnet.com.tr; Turkey (TR)
85.113.53.5 3 dynamicip-85-113-53-5.pppoe.samara.ertelecom.ru; Russian Federation (RU)
88.248.172.102 3 88.248.172.102.static.ttnet.com.tr; Turkey (TR)
92.55.100.130 3 ; Macedonia (MK)
93.74.5.218 3 ambassador.appraise.volia.net; Ukraine (UA)
93.91.194.24 3 ; Iraq (IQ)
93.117.11.244 3 ; Romania (RO)
94.178.105.94 3 94-105-178-94.pool.ukrtel.net; Ukraine (UA)
95.56.242.70 2 ; Kazakhstan (KZ)
95.188.132.199 2 ; Russian Federation (RU)
95.188.138.142 3 ; Russian Federation (RU)
103.14.251.218 3 218.loopback.sinet.com.kh; Cambodia (KH)
103.23.51.24 3 ; Mongolia (MN)
103.39.156.142 3 ; N/A (–)
103.247.239.55 3 ; Bangladesh (BD)
104.149.254.98 3 ; N/A (–)
108.13.189.113 1 static-108-13-189-113.lsanca.fios.verizon.net; United States (US)
109.66.42.117 3 bzq-109-66-42-117.red.bezeqint.net; Israel (IL)
109.188.125.10 3 client.yota.ru; Russian Federation (RU)
109.188.126.4 2 client.yota.ru; Russian Federation (RU)
113.160.225.43 3 static.vdc.vn; Vietnam (VN)
113.162.122.116 3 ; Vietnam (VN)
113.163.99.246 3 dynamic.vdc.vn; Vietnam (VN)
113.169.5.43 3 EUROPA.JUFCORP.COM; Vietnam (VN)
113.182.12.8 3 EUROPA.JUFCORP.COM; Vietnam (VN)
113.182.44.52 3 EUROPA.JUFCORP.COM; Vietnam (VN)
113.182.53.185 3 EUROPA.JUFCORP.COM; Vietnam (VN)
113.186.108.210 3 EUROPA.JUFCORP.COM; Vietnam (VN)
113.191.253.254 3 dynamic.vdc.vn; Vietnam (VN)
113.193.189.62 1 ; India (IN)
115.72.235.46 3 adsl.viettel.vn; Vietnam (VN)
115.85.46.82 3 82.46.85.115.dsl.service.eastern-tele.com; Philippines (PH)
115.97.81.229 2 ; India (IN)
115.118.237.21 3 115.118.237.21.static-mumbai.vsnl.net.in; India (IN)
115.248.39.17 3 ; India (IN)
116.106.42.185 3 ; Vietnam (VN)
116.111.6.136 3 ; Vietnam (VN)
116.111.65.141 3 ; Vietnam (VN)
116.111.110.135 3 ; Vietnam (VN)
116.111.202.214 3 ; Vietnam (VN)
116.118.39.241 1 ; Vietnam (VN)
116.202.34.111 3 ; India (IN)
117.6.209.45 3 ; Vietnam (VN)
117.192.221.94 2 ; India (IN)
117.196.150.228 3 ; India (IN)
117.197.98.6 1 ; India (IN)
117.197.103.89 2 ; India (IN)
117.200.120.8 2 ; India (IN)
117.206.187.240 2 ; India (IN)
117.206.190.40 3 ; India (IN)
117.207.48.68 2 ; India (IN)
117.217.112.199 3 ; India (IN)
117.217.132.132 3 ; India (IN)
117.220.153.136 2 ; India (IN)
117.222.68.125 2 ; India (IN)
117.223.117.142 3 ; India (IN)
117.242.204.189 2 ; India (IN)
118.71.185.84 3 ip-address-pool-xxx.fpt.vn; Vietnam (VN)
118.137.210.68 3 fm-dyn-118-137-210-68.fast.net.id; Indonesia (ID)
119.59.122.239 2 ; Thailand (TH)
120.60.134.142 3 triband-mum-120.60.134.142.mtnl.net.in; India (IN)
120.72.88.221 3 ; India (IN)
120.206.3.2 2 ; China (CN)
122.160.41.49 3 abts-north-static-049.41.160.122.airtelbroadband.in; India (IN)
122.161.169.72 2 abts-north-dynamic-072.169.161.122.airtelbroadband.in; India (IN)
122.169.71.69 2 abts-mum-dynamic-069.71.169.122.airtelbroadband.in; India (IN)
122.176.9.144 2 abts-north-static-144.9.176.122.airtelbroadband.in; India (IN)
123.20.208.52 3 ; Vietnam (VN)
123.23.107.243 2 ; Vietnam (VN)
123.23.119.68 3 ; Vietnam (VN)
123.26.33.67 3 EUROPA.JUFCORP.COM; Vietnam (VN)
124.248.189.95 3 fiber-189-95.online.com.kh; Cambodia (KH)
139.228.227.58 3 fm-dyn-139-228-227-58.fast.net.id; Indonesia (ID)
151.233.102.88 3 ; Iran, Islamic Republic of (IR)
159.224.41.1 3 1.41.224.159.triolan.net; Ukraine (UA)
171.224.128.102 3 ; Vietnam (VN)
171.224.192.59 3 ; Vietnam (VN)
171.249.123.136 2 ; Vietnam (VN)
178.90.76.90 3 178.90.76.90.megaline.telecom.kz; Kazakhstan (KZ)
178.91.64.52 3 178.91.64.52.megaline.telecom.kz; Kazakhstan (KZ)
178.91.90.125 3 178.91.90.125.megaline.telecom.kz; Kazakhstan (KZ)
178.122.98.193 2 mm-193-98-122-178.brest.dynamic.pppoe.byfly.by; Belarus (BY)
178.122.120.116 1 mm-116-120-122-178.brest.dynamic.pppoe.byfly.by; Belarus (BY)
179.24.79.20 3 r179-24-79-20.dialup.adsl.anteldata.net.uy; Uruguay (UY)
182.56.2.58 3 static-mum-182.56.2.58.mtnl.net.in; India (IN)
182.56.164.66 2 static-mum-182.56.164.66.mtnl.net.in; India (IN)
182.56.207.163 2 static-mum-182.56.207.163.mtnl.net.in; India (IN)
182.68.19.114 1 abts-north-dynamic-114.19.68.182.airtelbroadband.in; India (IN)
185.23.124.43 3 ; Saudi Arabia (SA)
188.121.117.89 3 ; Iran, Islamic Republic of (IR)
190.81.45.19 3 ; Peru (PE)
190.187.12.84 3 ; Peru (PE)
190.239.96.110 3 ; Peru (PE)
191.101.31.118 1 ; Chile (CL)
193.110.72.211 3 ; Ukraine (UA)
193.238.128.178 4 193.238.128.178.sta.211.ru; Russian Federation (RU)
194.158.210.210 3 ; Belarus (BY)
197.200.18.195 2 ; Algeria (DZ)
202.63.116.173 3 173-116-63-202.southernonline.net; India (IN)
203.189.159.71 3 ; Cambodia (KH)
211.99.28.17 2 ; China (CN)
212.34.12.182 3 ; Jordan (JO)
212.164.234.254 2 b-internet.212.164.234.254.nsk.rt.ru; Russian Federation (RU)
213.55.109.85 2 ; Ethiopia (ET)
213.55.115.35 4 ; Ethiopia (ET)
213.110.98.167 3 ; Ukraine (UA)
213.230.77.71 3 71.64.uzpak.uz; Uzbekistan (UZ)
213.230.82.48 2 48.64.uzpak.uz; Uzbekistan (UZ)
213.230.82.223 3 223.64.uzpak.uz; Uzbekistan (UZ)
213.230.83.74 1 74.64.uzpak.uz; Uzbekistan (UZ)
217.12.116.218 3 static.217.12.116.218.tmg.md; Moldova, Republic of (MD)
217.146.251.100 3 207302.user.farlep.net; Ukraine (UA)
220.231.122.253 3 ; Vietnam (VN)
222.74.81.42 2 42.81.74.222.broad.wh.nm.dynamic.163data.com.cn; China (CN)
222.252.223.2 3 ; Vietnam (VN)

Hourly breakdown (blocks per hour)
00 x4
01
02 x2
03 x1
04 x2
05 x1
06
07 x1
08 x69
09 x64
10 x13
11 x252

12 x4
13 x1
14 x2
15
16 x2
17 x3
18
19
20 x2
21 x4
22
23

Generated 2015-05-13 00:04:01 for machine europa.jufcorp.com by Syspeace v2.5.2.0

För mer information om hur du kan skydda era servrar från ordboksattacker , kontakta mig här

Backup/Restore och Disaster Recovery

Backup/restore, Disaster Recovery och kontinuitetsplaner

Hur ser backuptagningen ut med t.ex. Full, Differentiell och Inkrementell backup eller t.o.m kanske Delta / Block level? Vad är för- och nackdelarna med de olika sätten?
Vad är deduplicering? Vilka konsekvenser får det ? Räcker tiden för backupfönsret till?
Behövs en annan lösning eller går det att effektivisera det Ni har?
Att effektivisera och förbättra det ni har kan spara mycket tid och pengar.

Vad behöver vara med i backuperna ? Är det tillräckligt för att användas vid en restore av servern eller hela systemet?

Vad är minimum för backuper för att kunna återställa ett komplett systemhaveri eller bara delar av det?
Finns det dokumenterat HUR det ska göras? Har ni system som är beroende av varandra och i vilken ordning måste en restore göras för att så snabbt som möjligt att återgå till normal drift igen ? Hur fungerar just Ert server- operativ?
Microsoft Windows, Novell NetWare, SUN Solaris, Linux .. alla beter de sig olika vid restore.

Tar backuperna för lång tid och för mycket plats ? Går de att förbättra utan stora investeringar?

Vid återställnng av t.ex Microsoft Exchange bör man t.ex. exkludera vissa saker som kan “trassla” vid restore. Exemplen är många. Att backa onödigt mycket kostar bara tid, band och bandbredd. Går det kanske att effektivisera ? Backas en massa onödiga, privata filer som tar plats, tid och utrymme på backuperna?
Ska arbetstationer och laptops backas? Hur, isåfall?

Backupdrift och övervakning ? Backuploggar, vem läser dem och åtgärdar eventuella fel? Vem övervakar och tar ansvar för backupen?

Att missa felmeddelanden i backupen kan få ödesdigra konskvenser om Ert kritiska data inte finns med när det verkligen behövs. Enda sättet att veta är att göra en genomgång och analys av era backuper och göra en DR test (återstartstest).

Hur förvaras backuperna? Dags att tänka på online backuper?

Tänk på att allt Ert företagsdata ligger på banden/mediat och med rätt kunskap kan det användas fel.
och vem har tillgång till dem ? Och när ? Vem har ansvaret om de försvinner på vägen? Går det att lita på onlinebackuper ?

Vilka riktlinjer och IT policies gäller och hur följs de ?

Finns det policies uppsatta för överskrivning av banden ?
Hur långt tilbaka skall drifts-data kunna återläsas?
Hur länge arkiveras data ?
Vad säger lagen i Ert fall ?
Vilka riktlinjer är uppsatta från ledningen ?

I de här tidigare artiklarna har jag sammanställt några frågor och planer
Disaster recovery på svneska samt Grundmall för kontinuitetsplanering IT och återstartsplanering IT

Kontakta mig för hjälp med att se över era backuper och rutiner.

Att migrera eller importera sin hemsida till WordPress

importera sin hemsida till WordPress

Skapa hemsidor för mobila enheter som iPad, Android o.s.v. genom att importera sin hemsida till WordPress

De flesta företag och organisationer har en hemsida och har haft det i många år men utvecklingen på hur folk söker på nätet och vad de använder har ändrats radikalt de senaste åren.-

Många använder nu mobiltelefoner, surfplattor som iPad och Samsung Tablets och en äldre hemsida är inte riktigt trevlig att titta på i dem.
Hemsidan behöver minimieras vad gäller text, grafik och menyer o.s.v och det ska vara intuitivt för besökaren att välja i men meny vad du vill de ska gör t.ex. kontakta er eller beställa saker

Ett sätt att göra detta mer modernt är t.ex. att skapa en helt ny hemsida i HTML5 och kopiera alla text o.s.v. från den gamla och sedan peka om allt till den nya sidan.
Att utveckla en hemlt ny websida är dock ganska dyrt om man anlitar folk till det och om man gör det själv blir det kanske inte så bra som man tänkt sig och det tar tid att sätta sig in i hur allt fungerar och hänger ihop med t.ex. SEO.

Ett annat sätt är att sätta upp en WordPress (eller annat system men jsut WordPress är enligt min uppfattning väldigt lättarebetat) och hantera mobiler enheter den vägen, utan att behöva göra om allt jobb som man gjort innan. Här är alltså ett par tips om hur man kan importera sin hemsida till WordPress.

Första installerar man en WordPress (eller använder t.ex. en one click blog hos sin domänleverantör eller hos WordPress.com själva.
Här finns naturligvis ganska många saker att tänka på vad gäller säkerhet o.s.v. men att få igång själva grunden är välsigt enkelt.

Vill ni ha hjälp med detta så kontakta mig

På sin hemsida sätter man sedan upp en kort kod som känner av om besökaren kommer med en mobil enhet och skickar sedan över den automatiskt till den mobilanpassade sidan.
Koden för detta kan se ut så här.
Den här koden placecas i din HEAD – tag dvs före på din startsida (eller på alla dina sidor på hemsidan)
Byt helt enklt ut adressen där det står https://www.jufcorp.com/wordpress till den sida dit du vill ha trafiken.

Du måste även ta bort tecknen före och efter där det står script och lägga till < ihop med script.
Anledningen till att jag lagt dem där är att koden annars tolkas som just script och mobil enhet fortsätter ladda startsidan på den här hemsidan kontinuerliogt dvs en loop.

/+/ script type=”text/javascript”>
if (navigator.userAgent.indexOf(‘iPhone’) != -1) {
document.location = “https://www.jufcorp.com/wordpress”;
}
if (navigator.userAgent.indexOf(‘iPad’) != -1) {
document.location = “https://www.jufcorp.com/wordpress”;
}
if (navigator.userAgent.indexOf(‘Blackberry’) != -1) {
document.location = “https://www.jufcorp.com/wordpress”;
}
if (navigator.userAgent.indexOf(‘Android’) != -1) {
document.location = “https://www.jufcorp.com/wordpress”;
}
” /script> /+/

Nu kommer alla enheter som är mobila att automatisk skickas till den nya , mer mobilanpassde sidan medans besökare med en PC eller MAC kommer att stanna kvar på sidan som den såg ut.
Testa mot t.ex. http://www.jufcorp.com från en PC och en smartphone.

Flytta gamla hemsidan eller ha den parallellt ?

Anledningen till att inte helt flytta sin gamla hemsida är att man på det sättet kan behålla sin plats på Google och ändå jobba parallellt med att få upp besöksantalet på sin nya sida med SEO dvs sökmotoroptimering. Man kan också vara väldigt nöjd med den för just PC och MAC men vill ändå ha en mobilvänlig sida för sina nya besökare och kunder.

Man kan till stor del återanvända sin hemsida som den ser ut vad gäller färger och layout med olika verktyg för att automatisk importera det.
Att importera själva texten och innehållet kan också göras automatiskt, antingen online eller om man har sin kod lokalt sparad så kan man använda t.ex. HTML2 importer.

Efter man importerat sin hemsida i WordPress sätter man sig ner och planerar menystrukturer så det blir en logisk ordning på saker för besökaren.
Här kan man t.ex. välja att kategorisera vissa bloginlägg samma ämne som t.ex “Molntjänster” och sedan se till att ha en menypunkt som pekar på just kategorin “Molntjänster”.
På det sättet komemr besökaren att kunna välja “Molntjänster” i menyn och automatisk få upp alla inlägg ni skrivit om “Molntjänster”

Säkerhet och SEO bla.i WordPress

Till WordPress finns en väldig massa färdiga s.k. plugins som är till för säkerhet, SPAM minimimering, kontaktformulär, CAPTCHA och sökmotoroptimering för att få t.ex. Google att upptäcka ens sida.

En del av dem är väldigt enkla att förstå hur de fungerar och väldigt många är gratis.

Att sätta sig i dem tar ofta inte så lång tid men om ni vill ha hjälp med tips och förslag eller hjälp att genomföra just det jag skriver om här så är ni välkomna att kontakta mig

Troubleshooting Syspeace

Syspeace

syspeace – intrusion prevention for Windows serevr

 

<h2>From the  Troubleshooting Syspeace manual and a few new added entries   </h2>

So, as a general troubleshooting Syspeace  tip , check how your firewall is enabled and verify that it indeed is the correct network profile in there, or, enable the firewall for all three profiles.

The usual troubleshooting tips we give are described in the manual in the troubleshooting section

1. Make sure you’ve enabled the firewall (as described in Firewall), firewall enabled, prefferably on all profiles.

2. Make sure you’ve enabled the auditing (as described in Windows login detection prerequisites).

3. Verify that the server can reach https://s.syspeace.com/ping . (You should see a message saying Hello from Stockholm. and the local time of the server and recommended Syspeace version)

4. In some instances, when running Terminal Server or Remote Desktop Services there’s actually the scenario where the Windows server itself fails to obtain the source IP address of the login attempt (you can verify this by checking the Windows event log and look for Source Network Address: ) Sometimes, that entry is empty, thus disabling Syspeace from actually having anything to block. Syspeace will attempt to corroborate the IP address from some other logs. If it doesn’t find any, there is not much that Syspeace can do.

5. In any applicable firewall or antivirus software, allow Syspeace access to https://s.syspeace.com/ (port 443).

6. Verify any proxy settings, if applicable.

7. Some methods of Windows authentication actually attempts to log in several times. Two failures may be part of one log in attempt. Syspeace has no way of knowing how many attempts were intended and has to work with the actual failures. Due to counting failures instead of attempts, rules may be triggered seemingly ahead of time.

8. One way of quickly verifying functionality is to use a workstation (not whitelisted) and attack your server with the net use command from the command prompt. After the number of tries defined in the current rules, the workstation should be blocked from communicating with the server. Example of the command: net use * \server name or server IP addressanyshare /user:syspeacetester “anypassword”

9. If you want to submit logs to us, start Syspeace, go to Management → System settings, enable logging and start the service. The log file is created in a subfolder of the Syspeace installation folder.

10. When submitting logs,
Please create a .zip file of the logfiles, include any relevant information from Windows Eventlogs (application, system and security and when applicapble, the Syspeace eventlog ) and also create a .Zip-file of the database and email them directly to the devteam . The email address can be found in the manual

11. If your server doesn’t pick up the source IP address in your eventlog , please have a look a this blog article

12. If your database has grown above the size limit of 4 GB, in the current version ( 2.5.2) you will have to manually delete the database and set up your Syspeace again. in the upcoming version this has been fixed.

by Juha Jurvanen

How to battle slowgrind #bruteforce attacks against #msexchange #windows server #remotedesktop #sharepoint with #Syspeace

Syspeace automatically blocks attacks that occur according to the rules.
The default rule is that if an intruder fails to login more than 5 times within 30 minutes, the intruders IP address is blocked, tracked and reported for 2 hours and simply is denied any access to the server.

A new trend though has emerged and that is for bruteforce attackers to “slowgrind” through servers, trying to stay “under the radar” really from IDS/IPS HIPS/HIDS such as Syspeace.
They’ve got thousands and thousands of computers at their disposal so they’ll basically just try a few times at each server and then move on to next one in the IP range or geographical location hoping not to trigger any alarms or hacker countermeasures in place.

An easy way to battle this is actually simply to change the default rule in Syspeace from the time windows of 30 minutes to for example 5 days.

This way , I’m pretty sure you’ll see there are quite a few attackers that only tried 2 or three times a couple of days ago and they’re back again but still only trying only a few times.

With the “5 day” windows, you’ll catch and block those attacks too.

Here’s actually a brilliant example of an attack blocked, using a 4 day window.

Blocked address 121.31.114.99() [China] 2014-08-11 15:06:00
Rule used (Winlogon):
        Name:                   Catch All Login
        Trigger window:         4.00:30:00
        Occurrences:            5
        Lockout time:           02:00:00
        Previous observations of this IP address:
        2014-08-11 13:05:51     aksabadministrator
        2014-08-10 22:06:48     aksabadministrator
        2014-08-10 06:39:12     aksabadministrator
        2014-08-09 15:39:52     aksabadministrator
        2014-08-09 00:32:05     aksabadministrator

Syspeace has blocked more than 3 285 300 intrusion attempts against Windows Servers worldwide so far.

Syspeace - intrusion prevention for Windows servers

Syspeace website

Another weekly report of prevented intrusions against #Windowsservers by #Syspeace

Reported and blocked intrusion attempts against Windows Server

This is another report generated at a single server for one week. THis isn’t actually a highly targeted server compared to a lot of the servers running Syspeace out there but it does you you an idea of how common it is with dictionary attacks and brute force attacks.
All of these attacks were succesfully blocked, tracked and reported by Syspeace.

If you want to see if your Windows servers, Terminal Servers, Exchange and OWA, Citrix, Sharepoint, SQL server are targeted,  simply download a fully functional 30 day trial of Syspeace and see for yourself.
You might be surprised.

Report for week 2014-02-03 – 2014-02-09

— All Week ——

IP address Times Host name and country
——————– —– ——————————-
5.141.82.190 5 ; Russian Federation (RU)
31.168.75.16 11 bzq-75-168-31-16.red.bezeqint.net; Israel (IL)
37.28.157.63 1 d157063.artnet.pl; Poland (PL)
37.49.224.172 3 static-37-49-224-172-vstarvps.estroweb.in; Netherlands (NL)
46.105.59.195 2 ; France (FR)
50.52.142.2 1 static-50-52-142-2.drhm.nc.frontiernet.net; United States (US)
54.251.246.9 2 ec2-54-251-246-9.ap-southeast-1.compute.amazonaws.com; Singapore (SG)
62.20.107.114 1 ns.sdata.se; Sweden (SE)
74.95.168.97 1 74-95-168-97-Philadelphia.hfc.comcastbusiness.net; United States (US)
77.31.241.106 1 ; Saudi Arabia (SA)
77.72.55.67 1 ; Denmark (DK)
78.40.146.2 7 spider.man.kcahost.co.uk; United Kingdom (GB)
80.25.156.62 1 62.Red-80-25-156.staticIP.rima-tde.net; Spain (ES)
80.250.173.121 1 ; Russian Federation (RU)
81.204.76.158 1 ip51cc4c9e.speed.planet.nl; Netherlands (NL)
82.166.16.190 3 82-166-16-190.barak-online.net; Israel (IL)
82.199.95.156 2 STU-09-PC; Netherlands (NL)
83.218.73.146 1 ; Sweden (SE)
85.17.24.130 3 hosted-by.leaseweb.com; Netherlands (NL)
85.30.164.153 1 host-85-30-164-153.sydskane.nu; Sweden (SE)
85.225.211.107 1 c-6bd3e155.222-6-64736c12.cust.bredbandsbolaget.se; Sweden (SE)
85.234.222.197 1 85.234.222.197.wls.11-bba11has1.adsl.dyn.edpnet.net; Belgium (BE)
90.230.83.147 1 90-230-83-147-no110.tbcn.telia.com; Sweden (SE)
109.247.81.115 1 ; Norway (NO)
117.121.25.16 1 ; China (CN)
119.146.85.18 6 ; China (CN)
132.199.96.83 1 pc1011103133.uni-regensburg.de; Germany (DE)
148.160.16.132 1 host16-132.bornet.net; Sweden (SE)
165.228.5.204 1 tayper1.lnk.telstra.net; Australia (AU)
180.96.11.24 1 ; China (CN)
185.2.155.18 10 WIN-LMHRI4L8OR1; Sweden (SE)
188.20.178.75 2 ; Austria (AT)
188.75.83.216 1 ; Iran, Islamic Republic of (IR)
194.243.151.67 2 rub067.te00.c2.interbusiness.it; Italy (IT)
195.22.37.8 1 pedro.adsllink.cz; Czech Republic (CZ)
195.47.35.37 1 195.47.35.37.adsl.nextra.cz; Czech Republic (CZ)
198.200.30.110 1 198-200-30-110.dia.static.wsisd.net; United States (US)
202.105.224.22 1 ; China (CN)
203.146.30.32 5 ; Thailand (TH)
213.96.201.224 1 224.Red-213-96-201.staticIP.rima-tde.net; Spain (ES)
213.243.63.116 1 VCENTERB; Turkey (TR)
217.15.198.140 1 ; Russian Federation (RU)
222.186.32.224 1 mail.mxhichina.com; China (CN)

Hourly breakdown (blocks per hour)
00 x5
01
02 x1
03 x4
04 x4
05 x1
06 x3
07 x3
08
09 x6
10 x2
11 x6
12 x6
13 x5
14 x4
15 x7
16 x6
17 x3
18 x5
19 x4
20 x4
21 x4
22 x3
23 x6

– 2014-02-03 —

IP address Times Host name and country
——————– —– ——————————-
5.141.82.190 1 ; Russian Federation (RU)
46.105.59.195 2 ; France (FR)
50.52.142.2 1 static-50-52-142-2.drhm.nc.frontiernet.net; United States (US)
78.40.146.2 6 spider.man.kcahost.co.uk; United Kingdom (GB)
80.250.173.121 1 ; Russian Federation (RU)
85.234.222.197 1 85.234.222.197.wls.11-bba11has1.adsl.dyn.edpnet.net; Belgium (BE)
109.247.81.115 1 ; Norway (NO)
180.96.11.24 1 ; China (CN)
194.243.151.67 2 rub067.te00.c2.interbusiness.it; Italy (IT)
213.243.63.116 1 VCENTERB; Turkey (TR)

Hourly breakdown (blocks per hour)
00 x2
01
02
03 x2
04
05 x1
06
07 x1
08
09 x1
10 x1
11 x1
12
13 x3
14
15 x1
16 x1
17
18
19
20 x1
21
22
23 x2

– 2014-02-04 —

IP address Times Host name and country
——————– —– ——————————-
37.49.224.172 1 static-37-49-224-172-vstarvps.estroweb.in; Netherlands (NL)
82.199.95.156 2 STU-09-PC; Netherlands (NL)
117.121.25.16 1 ; China (CN)
119.146.85.18 1 ; China (CN)
185.2.155.18 5 WIN-LMHRI4L8OR1; Sweden (SE)
188.75.83.216 1 ; Iran, Islamic Republic of (IR)

Hourly breakdown (blocks per hour)
00
01
02
03
04 x1
05
06
07
08
09 x1
10
11 x1
12
13 x1
14 x2
15 x1
16 x1
17
18 x1
19
20
21 x1
22
23 x1

– 2014-02-05 —

IP address Times Host name and country
——————– —– ——————————-
5.141.82.190 4 ; Russian Federation (RU)
37.49.224.172 2 static-37-49-224-172-vstarvps.estroweb.in; Netherlands (NL)
62.20.107.114 1 ns.sdata.se; Sweden (SE)
74.95.168.97 1 74-95-168-97-Philadelphia.hfc.comcastbusiness.net; United States (US)
80.25.156.62 1 62.Red-80-25-156.staticIP.rima-tde.net; Spain (ES)
81.204.76.158 1 ip51cc4c9e.speed.planet.nl; Netherlands (NL)
82.166.16.190 1 82-166-16-190.barak-online.net; Israel (IL)
83.218.73.146 1 ; Sweden (SE)
90.230.83.147 1 90-230-83-147-no110.tbcn.telia.com; Sweden (SE)
119.146.85.18 2 ; China (CN)
148.160.16.132 1 host16-132.bornet.net; Sweden (SE)
185.2.155.18 5 WIN-LMHRI4L8OR1; Sweden (SE)
188.20.178.75 1 ; Austria (AT)
195.22.37.8 1 pedro.adsllink.cz; Czech Republic (CZ)
195.47.35.37 1 195.47.35.37.adsl.nextra.cz; Czech Republic (CZ)
213.96.201.224 1 224.Red-213-96-201.staticIP.rima-tde.net; Spain (ES)

Hourly breakdown (blocks per hour)
00
01
02 x1
03 x1
04 x2
05
06 x2
07
08
09 x2
10
11 x1
12 x3
13
14
15 x3
16
17 x2
18 x3
19 x1
20 x1
21 x2
22 x1
23

– 2014-02-06 —

IP address Times Host name and country
——————– —– ——————————-
77.72.55.67 1 ; Denmark (DK)
85.225.211.107 1 c-6bd3e155.222-6-64736c12.cust.bredbandsbolaget.se; Sweden (SE)
119.146.85.18 2 ; China (CN)
165.228.5.204 1 tayper1.lnk.telstra.net; Australia (AU)
198.200.30.110 1 198-200-30-110.dia.static.wsisd.net; United States (US)
203.146.30.32 1 ; Thailand (TH)

Hourly breakdown (blocks per hour)
00
01
02
03
04
05
06
07
08
09 x1
10
11 x2
12 x1
13
14
15
16
17
18 x1
19 x1
20
21 x1
22
23

– 2014-02-07 —

IP address Times Host name and country
——————– —– ——————————-
31.168.75.16 5 bzq-75-168-31-16.red.bezeqint.net; Israel (IL)
85.30.164.153 1 host-85-30-164-153.sydskane.nu; Sweden (SE)
119.146.85.18 1 ; China (CN)
202.105.224.22 1 ; China (CN)
217.15.198.140 1 ; Russian Federation (RU)

Hourly breakdown (blocks per hour)
00 x2
01
02
03 x1
04
05
06
07 x1
08
09
10
11
12
13
14 x1
15 x1
16 x2
17
18
19
20
21
22
23 x1

– 2014-02-08 —

IP address Times Host name and country
——————– —– ——————————-
31.168.75.16 6 bzq-75-168-31-16.red.bezeqint.net; Israel (IL)
77.31.241.106 1 ; Saudi Arabia (SA)
82.166.16.190 1 82-166-16-190.barak-online.net; Israel (IL)
85.17.24.130 1 hosted-by.leaseweb.com; Netherlands (NL)
132.199.96.83 1 pc1011103133.uni-regensburg.de; Germany (DE)
188.20.178.75 1 ; Austria (AT)
203.146.30.32 1 ; Thailand (TH)

Hourly breakdown (blocks per hour)
00
01
02
03
04 x1
05
06 x1
07 x1
08
09
10
11
12 x2
13
14
15 x1
16 x2
17
18
19 x1
20 x1
21
22 x1
23 x1

– 2014-02-09 —

IP address Times Host name and country
——————– —– ——————————-
37.28.157.63 1 d157063.artnet.pl; Poland (PL)
54.251.246.9 2 ec2-54-251-246-9.ap-southeast-1.compute.amazonaws.com; Singapore (SG)
78.40.146.2 1 spider.man.kcahost.co.uk; United Kingdom (GB)
82.166.16.190 1 82-166-16-190.barak-online.net; Israel (IL)
85.17.24.130 2 hosted-by.leaseweb.com; Netherlands (NL)
203.146.30.32 3 ; Thailand (TH)
222.186.32.224 1 mail.mxhichina.com; China (CN)

Hourly breakdown (blocks per hour)
00 x1
01
02
03
04
05
06
07
08
09 x1
10 x1
11 x1
12
13 x1
14 x1
15
16
17 x1
18
19 x1
20 x1
21
22 x1
23 x1

Generated 2014-02-10 00:03:15 for machine ****.****.**** by Syspeace v2.3.1.0

 

By Juha Jurvanen

Syspeace - intrusion prevention for Windows servers

Syspeace website

Syspeace is now in the Microsoft Pinpoint listing

We’ve now proudly also been listed in the Microsoft Pinpoint directory.

Syspeace @ Microsoft Pinpoint

Syspeace - intrusion prevention for Windows servers

Syspeace website

Intrusion prevention for Windows – Syspeace 2.3.1 released today!

We’re happy to annonunce that we’ve released 2.3.1 today!

The new release fixes some issues with reporting, non English OS, better error handling with communications failure to the license server and other fixes
http://syspeace.com/free-download/version-info/syspeace-231/

See the Syspeace website for a free, fully functional trial for intrusion prevention for Windows Servers, Exchange Servers, SQL Servers , Citrix, Terminal Server and more

Syspeace - intrusion prevention for Windows servers

Syspeace website

Syspeace for internal brute force protection on Windows Servers

After installing Syspeace , the tech guys started getting notifications that their Exchange Server was trying to login to another server and it was rejected. There was no reason for this server to do so whatsoever and it had not been noticed earlier so it’s hard to say when it actually started.

After disabling the whitelist for the LAN at the customer site they started getting mail notifications that every workstation on their LAN was actually trying to login to various servers using various usernames and password, hence a brute force attack/dictionary attack from the inside.

Most likely a trojan has been planted somewhere and it has infected the rest.

This is a fairly simple example of how Syspeace can actually reveal a security breach a customer wasn’t even aware of had occured.

It is totally up to any customer to use whitelists for the LAN but as a precaution, I personnally wouldn’t recommend it since it acutally gives you a great heads up that something has happened if a computer or multiple computers suddenly starts to try and login to servers they’re not supposed to.

As a system administrator, you get the chance to get attack automatically blocked, logged, traced and reported and you can have a closer at the computer responsible for the attack or have a word the user to see what’s going on.

You can even create extensive reports on all activity originating from that user or computer using the Access Reports section in Syspeace to get a more clear view on how long it’s been trying and so on.

Since Syspeace automatically protects failed logins using Winlogon authentication, your Windows servers are also protected from computers/users trying to use the “net use” or “map network drive” with invalid logon credentials trying to acces shares they’re not supposed to.

If you don’t have processes in place for scanning logs, saving them and monitoring every login activity, it will become grusome task to even know if there’s something going on at all. You simply won’t have the tools to do so.

Have your own servers run the fully functional Syspeace free trial and see if you get any unexpected login failures from the internal network and from Internet.
You might be surprised.

By Juha Jurvanen

Syspeace