jimw54321 has asked for the wisdom of the Perl Monks concerning the following question:

Hi, I apologize if this is too far off-topic, but I am unsure of what other forum site to post on.

I am in the process of building a personal website using Perl Template Toolkit. Part of that is exposing some parts of the configuration that would not compromise security, such as that I disabled direct root login.

Specific questions:

  1. If I were to state that I am using Perl Template Toolkit, PostgeSQL, Apache with mod_perl, CentOS, does that expose me to attack giving away information on possible vulnerabilities?
  2. I installed a firewall and interface to iptables to attempt to limit attacks. Is it possible to state which firewall without giving away too much information?

I am currently reading a security book I bought from O'Reilly, but I also want advice from others.

Thanks for your help and time,
Jim

Replies are listed 'Best First'.
(OT) Re: Need advice with Perl and website
by hippo (Archbishop) on Jun 09, 2016 at 17:21 UTC
    If I were to state that I am using Perl Template Toolkit, PostgeSQL, Apache with mod_perl, CentOS, does that expose me to attack giving away information on possible vulnerabilities?

    Not for a personal website which presumably would not be singled out for attack for any specific reason. Only the volume-based bots will likely impact a personal site and they won't be reading anything you've written to see what you are running. Anyone running a non-wordpress site will testify to that.

    I installed a firewall and interface to iptables to attempt to limit attacks. Is it possible to state which firewall without giving away too much information?

    Same answer for the same reason. Note that iptables is a firewall interface (to netfilter).

[reply]

      "Anyone running a non-wordpress site will testify to that."

      Yes, indeed. I have run my own web/mailserver from home for years as a hobby, and do not use PHP (or even have it installed). The amount of hits you get with bots (and I think compromised MS machines) looking for wp php files is a pain.

      A few years ago I got fed up with this nonsense, so knocked up a bit of perl that tails httpd access_log for such requests - if found, a bit of perl regex grabs the ip, then adds it to IPSETS group - instant firewall drop forever until I clear the IPSET.

      Now, one strange thing is these 'bots' (or rather the code that does it) seems to be intelligent, and once dropped, it seems to remember - as I clean out and reset my firewall sometimes, the same IP's never come back - but new ones do. I will have to do some proper analysis on it one day

      I run similar code on my mail server logs too for 'other' type bots.

      FYI I last cleared it out and reset 5th June 2016 - here is the captured IP's since:

      46.118.158.214 httpd Sun Jun  5 12:29:17 2016
157.55.39.56 httpd Sun Jun  5 13:57:17 2016
133.130.124.174 httpd Sun Jun  5 13:57:22 2016
207.46.13.150 httpd Sun Jun  5 13:58:49 2016
51.254.97.219 httpd Sun Jun  5 14:35:11 2016
212.83.177.193 httpd Sun Jun  5 16:03:56 2016
5.9.89.170 httpd Sun Jun  5 16:09:49 2016
69.30.198.178 httpd Sun Jun  5 16:19:27 2016
136.243.152.18 httpd Sun Jun  5 17:14:30 2016
51.254.129.9 httpd Sun Jun  5 19:41:22 2016
157.55.39.205 httpd Sun Jun  5 20:28:26 2016
5.9.73.227 httpd Sun Jun  5 20:31:14 2016
162.210.196.100 httpd Sun Jun  5 23:08:18 2016
51.254.215.143 httpd Mon Jun  6 03:10:05 2016
5.249.157.205 httpd Mon Jun  6 05:35:40 2016
40.77.167.33 httpd Mon Jun  6 06:09:06 2016
190.7.136.147 httpd Mon Jun  6 08:57:51 2016
199.58.86.206 httpd Mon Jun  6 12:14:57 2016
207.46.13.117 httpd Mon Jun  6 12:40:24 2016
207.46.13.128 httpd Mon Jun  6 12:57:29 2016
62.210.90.118 httpd Mon Jun  6 13:32:46 2016
157.55.39.100 httpd Mon Jun  6 14:29:09 2016
178.0.26.166 httpd Mon Jun  6 15:15:16 2016
109.248.32.78 httpd Mon Jun  6 16:51:17 2016
157.55.39.208 httpd Mon Jun  6 18:56:04 2016
157.55.39.179 httpd Mon Jun  6 22:03:25 2016
178.211.164.180 httpd Mon Jun  6 23:53:44 2016
207.46.13.180 httpd Tue Jun  7 00:05:58 2016
1.55.245.42 httpd Tue Jun  7 01:15:40 2016
40.77.167.12 httpd Tue Jun  7 02:42:36 2016
178.162.211.200 httpd Tue Jun  7 02:59:22 2016
103.231.44.52 smtpd Tue Jun  7 09:34:16 2016
157.55.39.148 httpd Tue Jun  7 11:33:48 2016
91.200.12.132 httpd Tue Jun  7 13:18:25 2016
69.197.177.50 httpd Tue Jun  7 20:33:49 2016
207.46.13.105 httpd Tue Jun  7 20:35:22 2016
144.76.93.46 httpd Tue Jun  7 20:42:42 2016
51.254.32.82 httpd Tue Jun  7 21:34:10 2016
188.126.129.20 httpd Tue Jun  7 22:02:18 2016
181.143.8.34 httpd Tue Jun  7 22:10:46 2016
106.184.3.122 smtpd Tue Jun  7 22:17:17 2016
62.210.107.201 httpd Tue Jun  7 22:25:19 2016
5.9.111.70 httpd Tue Jun  7 23:40:23 2016
157.55.39.28 httpd Wed Jun  8 00:08:55 2016
51.254.129.91 httpd Wed Jun  8 02:29:19 2016
51.254.141.30 httpd Wed Jun  8 03:15:36 2016
157.55.39.213 httpd Wed Jun  8 07:05:58 2016
71.6.165.200 smtpd Wed Jun  8 08:00:40 2016
69.197.177.26 httpd Wed Jun  8 08:04:28 2016
195.154.185.20 httpd Wed Jun  8 15:32:17 2016
142.54.184.90 httpd Wed Jun  8 16:51:53 2016
183.182.100.26 smtpd Wed Jun  8 17:14:12 2016
208.100.26.231 smtpd Wed Jun  8 23:36:36 2016
104.41.203.153 httpd Wed Jun  8 23:56:00 2016
40.77.167.6 httpd Thu Jun  9 09:18:38 2016
169.229.3.91 httpd Thu Jun  9 10:13:03 2016
144.76.29.162 httpd Thu Jun  9 19:41:56 2016
46.4.32.75 httpd Thu Jun  9 20:49:59 2016
144.76.7.107 httpd Thu Jun  9 21:06:52 2016
51.254.32.67 httpd Fri Jun 10 00:15:29 2016
149.202.54.5 httpd Fri Jun 10 01:22:23 2016
143.202.77.99 httpd Fri Jun 10 04:40:51 2016
195.154.187.115 httpd Fri Jun 10 04:43:25 2016
51.255.194.31 httpd Fri Jun 10 05:14:35 2016
157.55.39.225 httpd Fri Jun 10 09:19:22 2016
5.39.216.131 httpd Fri Jun 10 15:39:39 2016
157.55.39.147 httpd Fri Jun 10 15:55:12 2016

      [download]

      Nick

[reply]
[d/l]
Re: Need advice with Perl and website
by Your Mother (Archbishop) on Jun 09, 2016 at 17:53 UTC

    You can certainly state the technologies you use. Their signature is often on everything from a hacker perspective anyway. The trick is you have to commit to vigilance with the security updates. Saying CentOS means that when a CentOS exploit is announced, for example, you need to be patched the same day the patch or workaround is available or be vulnerable.

    Any given question on these topics will be better, and more currently, addressed here: https://www.owasp.org/. Web security is rarely Perl specific.

[reply]

Back to Seekers of Perl Wisdom