Aug 20 2009

Firewalling brute force attempts with IPTables

Published by Brian under Computers, Linux, Networking, Tlf

Almost 24 hours per day, The Linux Fix is inundated with FTP and SSH brute force attempts to our server farm.   This has compromised a few our our customer’s accounts from time to time, and I decided it was time to come up with a solution.

The problem is tricky–we must leave FTP and SSH open to the entire world, but at the same time be selective on what we black list.   How do you make that determination?  Strictly on bad login credentials?

We could, but that would mean that we’d inadvertently lock out real users.  A better solution we found has to do with timing connection attempts.   With IPTables, we can keep a counter based upon source IP–and track how many new socket attempts are made within a certain span of time.     For instance, if we detect the IP address 1.2.3.4 making 5 connection attempts within 60 seconds, there is a darn good chance it isn’t someone mistyping a password.

Here is how we did it, based upon another script we found out in the Internets:

#!/bin/bash
/sbin/iptables -N SSH
/sbin/iptables -N SSH_BLACKLIST
/sbin/iptables -A SSH_BLACKLIST -m recent --name SSH_COUNTER --set -j LOG --log-level warn --log-prefix "Blocked: "
/sbin/iptables -A SSH_BLACKLIST -j REJECT
/sbin/iptables -A SSH -m recent --name SSH_COUNTER --update --seconds 300 -j REJECT
/sbin/iptables -A SSH -m recent --name SSH --rcheck --seconds 60 --hitcount 5 -j SSH_BLACKLIST
/sbin/iptables -A SSH -m recent --name SSH --rcheck --seconds 2 -j LOG --log-level warn --log-prefix "Added: "
/sbin/iptables -A SSH -m recent --name SSH --update --seconds 2 -j REJECT
/sbin/iptables -A SSH -m recent --name SSH_COUNTER --remove -j LOG --log-level warn --log-prefix "Removed: "
/sbin/iptables -A SSH -m recent --name SSH --set -j ACCEPT
/sbin/iptables -A INPUT -m state --state NEW -p tcp -m tcp --dport 22 -j SSH

This creates two new tables, SSH and SSH_BLACKLIST.   Upon the intial connection attempt, the IP is added to the SSH_COUNTER counter.   If the same IP address is seen again within 60 seconds, it is duly noted–however no action is taken until the hitcount reaches 5.   In that case, the rules jump to the SSH_BLACKLIST table, it is logged, and subsequent connections from that IP are dropped for 5 minutes until things calm down.   In order to do this for FTP, just rename the targets as appropriate and change the target port to 21 on the last line.

The nice thing about this set up is that it is auto-cleaning.  After 5 minutes of no activity, the counter forgets about the IP address and things return to normal.   We’ve found that this is just enough protection to drastically reduce bruteforce attempts, yet not get in the way of normal usage by our customers.  Over time, this has become our favorite technique and we’ve begun to implement it on any Internet-facing machine with open SSH ports.

One response so far

Mar 06 2009

The Art of Asking a Question

Published by Brian under Funny, Miscellaneous

Being a polymath I tend to get asked questions on a lot of different things.   Over the years, I’ve often wondered how many wasted minutes were spent deflecting questions with a question regarding the original question.   Anyone in a support-type role knows what I’m talking about, but for the sake of illustration bear with me this example:

Q: Hi Brian, I don’t remember the username.

A: “Username” for what?

Clearly there is an expectation of telepathy, which I have not quite mastered as of yet.   To further cement my issue, allow me another example:

Q: I don’t remember what directory we put that stuff in, do you?

A: What stuff?

My point is, that if you’re initiating a conversation with a question, and you’d really like an answer to that question, try to ensure there is no questioning its completeness.   Here is a wrong/right example:

Q – WRONG: Where did you download that thing from?

Q – RIGHT: The program you used to connect to server2 via the keyboard yesterday… where did you download it from?

As a general rule of thumb, if your question contains any of the following words:

  • thing
  • stuff
  • place

It probably needs some adjustment.

Try to remember the person attempting to answer your question may be juggling dozens of different things, probably has hundreds of numbers, passwords, and other data to remember, and would greatly appreciate the reduced mental workload a few extra words provides.

Your favorite support person will thank you!

4 responses so far

Feb 05 2009

States Delcaring Sovereignty

Published by Brian under Politics

Due to an overbearing Federal Government ignoring  the 10th Amendment of the Constitution, several states (including California and Michigan) have begun to declare their independence from the Federal Government to curb the use of unlawful powers not delegated to it (and there’s plenty these days).

Remember we’re the United States of America.   One nation of individual states.   A local government works for you and with you due to vested interest in its outcome, distant does not.    Support these bills!

2 responses so far

Feb 02 2009

Checkride!

Published by Brian under Flying

On January 30th, 2009, I passed the FAA Practical Exam (aka “the checkride”) to the satisfaction of my examiner.  I was a nervous the whole time, thinking I was unprepared.   The fact of the matter was that I was PLENTY prepared, but being nervous about the entire process ended up being far more detrimental than worrying about missing a question or two. For those curious or about to take their checkride, here was my experience.

The short version:  If you’re about to take your checkride, relax.  RELAX!  It won’t be that bad.  Just show up, be friendly and polite and you’ll do fine.   Quiz yourself here and there with real-world scenarios, and study up on the things you know you’re weak on.  Pay attention to details on your cross-country plan.   It’ll be a piece of cake.   If you weren’t ready, your instructor wouldn’t have recommended you!

And now, the long version.

The exam was scheduled for 9:00 AM at Hillside Aviation in Redding.  The week before, when scheduling it with him, the examiner provided me a cross-country flight plan of Benton Airpark to Fresno.   I show up at 8:00AM (tired from not getting a wink of sleep the night before) to get organized as well as get my cross-country weather from Flight Service one last time.   I had completed the majority of the weather planning the night before with Phaedrah using DUATS.  I’m wigged on coffee in an attempt to wake up.  My nerves are going nuts at this point.  My stomach is in knots.

I finish up the last bit of planning at about 8:15 AM after walking out to the plane and getting the magnetic deviation off the compass card in the plane.   I double check that I have the driver’s license, all the required entries in the pilot log, the maintenance records, etc.   I start scanning through the FAR/AIM one last time.

The examiner walks in at about 9:05 and introduces himself.  Where’d that past 45 minutes go??  I realize I’d met him once before while he was giving another checkride to another student earlier in my training.  At time, I could barely fathom being here for the same myself!   My first impression is that he’s a really friendly and easy-going guy–disarming even.  I relax a bit.

We go through the initial introductions as well as the basic structure of how the exam will work.   No surprises, first the oral part of the test, a short break, followed up by the flying portion.   He indicates the basic constructs of the testing, i.e. we’ll follow the PTS, he expects me to stick to those standards.  He also says the oral part with partially extend into the flying portion–I should be ready to answer questions at any time.

The oral part of the exam begins at about 9:15 AM.

The first couple questions are point blank and pretty straight forward.   What kind of airplane are we flying today?   What is the maximum weight? (I goof this answer by 100lbs, stupidly responding with an answer I memorized from a generic C-172 POH versus the actual POH from my test plane, but realize and recover).   Is this airplane ready to fly today?

“Sure is.  I’ll show you, if you like”  I explain the necessary requirements:  The Annual, the 100-hour check, 12-month ELT, 24-month Pitot-static, and the 24-month transponder checks.   We go through the airframe logs and he has me point out all the checks.   Wait a second… where’s the transponder?   The last check was from 4/2006.   My instructor and I just reviewed this the day before!?  What the?!

The DPE calmly says, “If I were you, I’d take this down to the mechanics downstairs to make sure something isn’t missing.  Of course I can’t tell you to do that, but I would if I were you”.  Basically, he’s saying “get this fixed before the oral is over, and you’ll still have a shot at passing today!”

Feeling like an idiot about missing something so basic,  I scoot my rear downstairs fast and find out that it indeed is NOT ready to go, they were intending to finish it for me this A.M., but got backed up.  I then remember my instructor mentioning “the transponder check will be there in the morning” the night before.  ACK!  I then run back upstairs and tell the examiner the transponder will be ready in an hour.

“I certainly hope your instructor isn’t flying that airplane around with an expired transponder check!”, he says with a grin.   We both chuckle about it a little bit, and it helps lighten the mood.  He then starts to drill in to more specific questions.

I do pretty well until we get to the sectional charts.   He points at Benton, and says… “What airspace are we in here?”

“Class E with a 700AGL floor”, I say confidently.

“What is the minimum weather requirements here?”

“3 miles visibility, clear of clouds and objects 500ft below, 1000ft above, and 2000ft laterally.”

“Good.”

He then presents me with a weather story-problem about flying from Benton to Red Bluff.   I remember there being a broken cloud layer at 900 AGL, an overcast layer at 2000AGL, and whether or not we could fly there.

At this point, I try to think it out but start to crack.  I ask for a second to think about it.  I waaaay over think it, forgetting that Red Bluff is surface Class E airspace, so even if we could stay clear of the clouds on the way down, it’d be a bad idea and probably even impossible to land with the necessary cloud clearances that low.   In a defeated fashion my answer is simply, “Well, for sure I wouldn’t fly it”.

“That’s not what I asked though, is it legal?”

Brain activity: gone.   At this point I’m freaking out that I’m failing the test.  My instructor walks in and sits at his desk (we were using his office).   This only adds to my panic state, knowing I’m now going to embarrass myself as well as my instructor!  The examiner moves on to another question.

I feel like the rest of the oral exam is going 50/50.  Some stuff I recall instantly, straight from the books–but my thinking capacity is deadlocked.  I get the weight and balance questions answers okay, but the next one regarding figuring out ground roll at a high-altitude airport puts me in mental shutdown.   I surrender and finally say “I’m sorry it’s taking so long, I just can’t seem to get the answers straight in my head at this point…”, as I pointlessly fumble with the E6B flight computer.  “I’m sorry I’m so nervous”, I admit.

The Examiner in his infinite wisdom comes out and says, “Why don’t you try looking in the POH.  You’re doing fine so far.  Just try to think out the questions.”

That sets me at ease.  OF COURSE the ground roll information is in the performance section of the POH.  DUH.  I get him the answers he was looking for.   We look at my weather and navigation logs for our theoretical trip to Fresno.  He makes a comment that he’s very pleased with my cross-country planning, probably the best he’s seen (wow!), and that after a break we can begin the flight-portion of the test.

Stunned that I’d made it through that train wreck, I go down to verify the transponder check was completed and recorded, and begin to pre-flight the airplane.   I think whether or not I should show the examiner, I remember him pointing out specifically that I’m pilot in command, and all judgement calls are mine.   I take that to mean he trusts my checking it.

I grab a quick drink of water and head out to the airplane.  The examiner walks out about half-way through the preflight.

“What’s that antenna for?”   ELT.

“What are you looking for in the gas?”   Sediment, water, color of the fuel.

“What type of fuel does this airplane use?”   100 octane, low-lead.

“What does that hole on the wing do?”  Stall warning.

“How does fuel get to the engine?”  I stupidly brain fart and after correctly saying it’s a gravity-fed system, that the engine fuel pump pulls it from the sump.   I’ve worked on car engines so much lately it just slipped out.

“It has a fuel pump?”  No, sorry sir.  I said that by accident.  It’s a gravity-feed system.

“How do these brakes work?”  Disc, hydraulic caliper/rotor system.  No problem.

“If that air filter in the front of the plane gets clogged, what happens?”   I remember from my training that newer 172’s have a spring-loaded airbox that will open if the filter gets plugged.   I tell him I think that’s how it works, and I remember reading that somewhere, but he says it doesn’t.

“Open the carb heat.” he says.  Really?   Well, yea, that makes perfect sense.   Carb heat pulls air from a baffle around the exhaust pipe.   Separate air source.  “Oh cool, that’s logical enough!” I say somewhat nervously.

We hop in the plane.  No comment during the initial checklists.   I brief him on seat belts, as well as making sure the door is locked.  I mention that since we’re planning on maneuvers I’d appreciate his extra set of eyes for other traffic.  I also re-instate that I’d like specific confirmation of the flight controls changing hands.   “Sounds good, I’m all set if you are” he says. “I’d like to start with our flight to Fresno, if you wouldn’t mind.”

“Okay, sir”, I say lightheartedly.   Truth be told my heart wasn’t so lighthearted at that point.

Run-up, no comments.

We do a normal take off from Benton (sort of expected a special short-field or soft-field).   I begin doing the time checks for our cross country flight.   Level off checkpoint is about 2 minutes late.  I tell the examiner we might be running a little behind schedule, possibly due to less of a tailwind than expected.

He asks I re-calculate the ETA to the next check point, which I do fairly quickly.  I practiced doing this extensively during the solo cross-country.   “11:04 we’ll be at the RBL VOR”, I say.

“1:04, you mean”?  Oh oops…where did I learn to read a watch again?

“Oh haha, sorry yes sir.  1:04″.   He looks at me and grins a little, knowing I’m still on edge.

Rest of the cross-country is me simply trying to get the plane trimmed out for level flight.  Having a heck of a time keeping her level for some reason.  We show up directly over the RBL VOR at 11:04, on heading, on alititude.

“Those flight computers really work!” I say jokingly, trying to relax myself a little.  He smiles and nods.

About 30 seconds later, he says that he’d like to divert to a new airport.  “I’d like to go to Ruth”, he says.  We looked at that one during the oral.  However I don’t remember it at all, being in a fog of fear the entire time.

“Would you mind folding the chart over to that while I go through the diversion checklist?”, I ask.  He seems pleased at the idea of me using a checklist for diversion I had prepared on my kneeboard.   “Sure”, he says.

I roughly plot our current location on the sectional with an “X”, mark the current time next to it, then hastily calculate a new heading and ETA.   I made the mistake of doing these before turning to the new heading, and he politely pushes me: “I’d like to go to Ruth, please”.   I get it, and turn to 250 right away.

I explain that Ruth requires us to climb to at least 8500 feet to clear obstacles (based on the sectional chart) and he says that’s fine, so I begin the climb.  About a minute goes by and he says he’d like to start the instrument portion of the test.  “Put your foggles on”, he says.

I reach in the back seat, grab my instrument training glasses, and put them on.  “You’ve just entered into a cloud! It looks like there is a fog bank all the way to Ruth”, he says.  “What do you do?”

“First thing I will do is a 180-degree standard turn to get out of the weather we just ran into”, I explain.  He says that’s fine and that once I’ve done that, he’d like me to intercept a radial off the KRDD VOR to fly back home.

“Ok”, I explain.   I also state that the OBS in my airplane is very lazy and that we may not be able to pick up KRDD’s station from our current location.  Sure enough, we don’t.   I tell him that our current altitude (6500 feet) is plenty high to clear us of obstacles in our area, and that flying on a heading of 360 will put us in range of the KRDD VOR without danger.

“I’ll trust your judgment”, he says.  What does that mean?  I’m walking into a trap?  Ack!

We finally get a reliable signal and I intercept the 030 radial and begin to fly it. No comments, so I assume that’s a good sign.

Shortly thereafter he explains he’s going to get into unusual attitude recovery while I’m under the hood.   I hand over controls, he throws the plane into a banking climb, and I recover it no problem.

Ever since I started training, I’ve had a good “seat-of-the-pants” feel of the plane.   I also seem pretty resilient to vertigo, so putting my head down and closing my eyes does little to throw off my senses.

Next is a diving bank to the right, which actually threw me a little.   I see the airspeed increasing quickly, and instinctively yank off the throttle, and put the carb heat on.   I gently level her out and bring her back to straight-and-level flight at about 5500 feet.

“Ok, you can take your foggles off.   I’d like to do slow flight next.  Stay at this altitude, and hold us at 5500 feet at heading 270.”

“Ok, sir, will do”.  I slow the plane down by backing off the throttle, neutralize the trim and put on full flaps.   I get the plane to about 50 knots holding steady, thinking I’m spot on.

“I said I’d like slow flight”, he says.   I’m somewhat confused, as my instructor had us practice at 50 knots.   I asked for clarification, and he said that meant about 40 knots in our C-172 at full flaps.

HOLY CRAP, I think.   She stalls at mid-30’s with 40-degrees clicked in.    “Ok sir”, I say semi-worried.

The next 5 minutes I was pretty focused on nothing else than the airspeed indicator and the DG.   “Keep her on heading!”, as I slid a bit off.   She’s acting like a greased goose on a bowling ball.   If I slightly lose the coordination between the rudder and the ailerons, she wants to stall to the side.   Outside the windshield is nothing but sky.  I’m pitched up about 35 degrees just maintaining altitude.  I then manage to pull in two 90-degree turns without dropping a single foot while flying at roughly 39-40 knots.   I even impressed myself!

He tells me to level off and get back to cruising speed.   We run through the stalls:  Power on, power off, as well as banked.   I had some trouble getting her to stall in the power-on, but it finally happened.   He comments I need to work on recovering with losing less altitude, but that we were still within spec.   Whew.

We’re roughly over RBL’s airspace and I suggest making a few more clearing turns before more maneuvers.  He agrees.  Coming out of my bank to the right I notice the engine stopping.   I look over at him, “Oops!” he says.

Ok this ought to be easy, I think to myself.   I’m 2 miles south of a perfect final approach on a huge (6500 foot) runway.  I’m at 6000 feet and have plenty of time.   I explain to the examiner that I’m planning on landing into the wind at RBL.  “Perfectly acceptable”, he says.  I pretend to call “Mayday, Mayday!” and simulate switching the transponder to 7700.

I trim the plane out for 65 knots, begin a gentle descending left-hand spiral to scrub altitude.  I run through the engine-out checklists on my kneeboard and realize he had simply pulled the mixture out.   I explain that I can push it back in to get it started.  “Go ahead”, he says.

I push in the mixture to full rich and the engine kicks back in.   For a second, I think I may not have to do an engine-out!   Vrrrorooompuh.  The engine quits again.  “That didn’t work”, he says with a smile.

Ok, back to plan one.  I’m going to have to land her.  I finish going through the ditching checklist, simulating turning off all the extra electrics and popping the doors open.   I make a call to the area traffic that I’m on a simulated engine out roughly 2 miles south of the airport, and I’m doing a controlled spiral descent from 4000′ to make a straight-in final approach.

Three other planes call back saying they’re inbound, including a Skylane 5 miles further south than me, coming in for a straight-in final approach as well.   I don’t panic, but instead just call them back and ask if they could slow down or spin around to make room.

The other traffic on 123.00 hears my plight, and I think they all figured out I might have been on a checkride.  Much to my surprise, all THREE say they’ll just stay out of the way until they have a visual on my landing.   How awesome of them!

Instead of making one last turn around to scrub off more altitude, I make a judgment call to play it safe from the other inbound airplane south of me and head for the runway, using full flaps and some light slipping to drop fast.  I start in at about 3500′ and make it a point to explain I’m just going for the center of the runway to make sure the traffic to the south is way clear.   “Good idea”, he says.

I drop in and make a bit of a rough touchdown due to my steep approach, but he says that works for him.

We do two more spins around the pattern to do a short field take-off, as well as soft-field take offs and landings.   No comments.   The last spin around, he tells me to do a short-field landing on downwind.  I set up and am lined up for a beautiful one.  About 20 feet AGL on final he says “GO AROUND GO AROUND!”

Based on the panic-sound in his voice, I actually think there’s something wrong, so I mash the throttle and mistakenly retract the flaps to 10-degrees (I intended to going to 20).   The airplane sinks and literally drops within maybe 5 feet of the runway, but I keep the nose down to build up speed and eventually she picks up steam.

“That was close” he says.   “I agree!” I say back.   We fly back, and do a single turn about a point at a building.   “Let’s head back to Benton”, he says.

Somewhat comforted that the whole ordeal was almost over, I take my time and do a full approach with a 45-degree entry on downwind at Benton.   I didn’t want to push my luck doing a long straight in.  Pattern is good!

On downwind, he explains he wants a short-field landing.   “Ok, sure thing” I say.   The approach is perfect, but about 10 feet from the runway a sinker pushes the airplane down pretty badly.  This happens a lot at Benton, so I just recover with throttle and set her down on the numbers, a little more rough and fast than I intended.   It wasn’t a great short-field at all.   No comments from the examiner.   I clear the runway half-expecting him to say “do it again”.   Instead, he instructs me to go back and park it.

At this point, I’m thinking I might have actually done it!   No comments during the taxi and shutdown.

After the engine shuts off, the examiner takes off his headset and says:  “Ok. How do you think you did?”  I focused on the rough spots (maintaining heading, rougher-than-normal touchdowns, as well as my sloppy stalls).   “I think I batted about 80-85%”, I say rather glumly.

“I agree.   I have some notes here that I want to go over with you.”   At this point, I think I’ve blown it, and he’s going over the failure items.  Just as I’m accepting the fact that I blew it, he juts in again:

“But, overall, I can tell you’re going to be a safe pilot.  Your planning and accuracy for the cross-country was great, and your emergency calls and decision-making at Red Bluff were very well executed.   I think we’re going to make you a private pilot”.

“HOLY SHIT!” I say rather excitedly without concern for manners.  He gets out of the plane, laughing, and begins walking back to the office as I sit in the plane and just take it all in.   It takes me at least twice as long to put everything away and write down the Hobbs because I’m shaking with glee.

We head back to the office and I sit down with my instructor and the examiner.  He explains he thought I could have done better on the oral, but that he thought nerves had a lot to do with it.   I agree with him, and explain I’m planning on studying all the things I had trouble in.   I get the standard dialogue of the license being a license to learn and that I shouldn’t ever take it for granted.

I truly take those words to heart, shake all their hands, and head home at 3:00PM being a new private pilot.   I slept better that night than I have in weeks.

2 responses so far

Jan 30 2009

Private Pilot Checkride:

Published by Brian under Flying

I PASSED!!!!

I’ll write up a play-by-play a bit later.  I’m too excited to type it out right now!

One response so far

Next »