Web Server Security?

[VirtualPanther]

Hey guys,
I have noticed a few failed attempts to connect to my HomeTroller from China: seven tries from the same IP in the last 24 hours. I noticed entries in the log, simply while looking for something else. No idea if it happened before.

Searched around, found nothing useful in these forums, but found a report of a known HS vulnerability: http://www.exploit-db.com/exploits/18567/

So... How do you guys go about protecting your server, short of IP blocking in router?

[Rupp]

That exploit was fixed shortly after it was discovered. These failed attempts happen all the time and as far as I know no one has ever got hacked. There are some settings to block ipaddress that fail x number of times in a row. Look for "Enable IP Hack Blocking" in the HS setup for some settings to assist with these hackers.

[VirtualPanther]

That exploit was fixed shortly after it was discovered. These failed attempts happen all the time and as far as I know no one has ever got hacked. There are some settings to block ipaddress that fail x number of times in a row. Look for "Enable IP Hack Blocking" in the HS setup for some settings to assist with these hackers.

Rupp,
I do have the IP blocking enabled after three attempts. Unfortunately, my attempts happened about three hours apart - all seven of them. So this did not work. Even if it did, IP blocking is pretty primitive: use a VPN or a proxy server and you get around them. Especially blocking one IP at a time. I was looking for suggestions on intelligent filtering, such as IP ranges determined from reverse trace of host. I'd go for a country-specific tracking: I don't know anyone in China and don't have any reason to open my IP to them

[Rupp]

Sure but as I say it's only a nuisance as most all of these are just probing bots. You can spend the rest of your life running from these guys or simply ignore the log file as they aren't getting anywhere.

[macromark]

If you're running vnc on the HomeTroller, I would highly recommend that you change the default password. That should prevent any unwanted VNC hacks.
As for the HomeSeer webserver itself, change the default username and password to something else and you should be as secure as you are with any other username/password protected website.

[VirtualPanther]

If you're running vnc on the HomeTroller, I would highly recommend that you change the default password. That should prevent any unwanted VNC hacks.
As for the HomeSeer webserver itself, change the default username and password to something else and you should be as secure as you are with any other username/password protected website.

VNC has been long gone (I use Logmein instead). User name and pass are custom. Sounds good.

[prsmith777]

I get the Chinese bots about once a month trying to hack in.

Also have seen Netherlands, Italy, Spain, Korea ( can't remember north or south), among others.

Have you checked out Jon00 script WhoIs? It keeps track of all logins and attempts and displays them on a nice web page inside HomSeer.

[Jebus]

Put a linux router distro between your internal lan and your ISP provided router/modem and use another NAT range to protect your network. Adding Knock and Snort will protect your Lan even more. I have used freesco for over twelve years and I have never seen any attempts in my logs. You have the added benefit of installing a self updating hosts file package that protects your browser from malware too...

[jlikonen]

In my case it happens every now and then that I get blocked when trying to connect from work so the IP blocking works really effectively. If I get blocked I can then use VNC.

[dilbert1]

I don't have a HomeTroller, but was wondering if it will let you block a range of IP addresses? If so, there are sites like blockcountryip.com or countryipblocks.net that you can use to look up the range that an entire country may be using, and decide which countries you would like to block.

Jeff

[Pete]

I agree with using a software linux or BSD firewall between your ISP connection and your internal LAN.

Envision your network at home as an onion with layers on it with the core of the onion being the most protected ....

You can then protect all of your internal LAN stuff and literally layer the access to the outside world....

[prsmith777]

I have a sonic wall network appliance which has ip blocking by country feature.

It doesn't always work. They must be able to spoof ip addresses because I still get china hits on my server quite often.

[VirtualPanther]

I have a sonic wall network appliance which has ip blocking by country feature.

It doesn't always work. They must be able to spoof ip addresses because I still get china hits on my server quite often.

I was looking at exactly that: hardware firewall or, ultimately, a Unified Threat Management (UTM) appliance to protect entire LAN. Which model are you using and do you use their subscription services?