More after the break

NAS is the way to go… Local storage is sooo 2008 :p
My new toy: http://www.synology.com/enu/products/DS410j/index.php

On www.synology.com you can find more info about the NAS’ and the OS on it. Wil try to post a review in a few weeks.

I noticed that quite a lot of people ask questions on mailing lists and forums requesting a method to automatically remove any duplicate IP’s that might exist within a given chain.

Well, that’s quite easy to accomplish really, just run this little PHP script I created as root, and your Iptables is once again clean as a whistle!

/**
 * Configuration
 */
$chain = "Blocklist";
$safelist = array("x.x.x.x"
                 ,"y.y.y.y"
                 ,"z.z.z.z");
 
$data = shell_exec('iptables -S '.$chain);
$iparr = explode(' ',$data);
$j = 0;
$ref = array();
for($i=0;$i<sizeof($iparr);$i++) {
        if(substr_count($iparr[$i],".")==3) {
                $ref[$j] = $iparr[$i];
                $j++;
        }
}
sort($ref);
 
for($i=0;$i<sizeof($ref);$i++) {
        $ip = $ref[$i];
        $ref[$i] = "";
        if(stristr($ip,"0.0.0.0")) $ip="";
        if(strlen($ip)>2 && !in_array($ip,$safelist) && in_array($ip,$ref)) {
                echo "Duplicate IP found: $ip\r\n";
                while(in_array($ip,$ref)) {
                        shell_exec('iptables -D '.$chain.' -s '.$ip.' -j DROP');
                        $ref[array_search($ip,$ref)] = "";
                }
        }
 
}

The regex used won’t capture all attempts, but with my configuration only 1 hit is enough to get you banned (the scripts these scans call are main.php and config.inc.php, which aren’t to be called directly, especially not when they fail with a 404 like these), and all scanning attempts I’ve seen so far cycle through at least 20 different combinations.

Well, enough talk, here is the filter.d file:

# Fail2Ban configuration file
#
# Author: Remco Overdijk
#
# $Revision: 4 $
#

[Definition]
 
# Option:  failregex
# Notes.:  regex to match the 404'ed PMA file in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching and is only an alias for
#          (?:::f{4,6}:)?(?P<host>\S+)
# Values:  TEXT
#
failregex = <HOST> -.*"GET .*(php|pma|PMA|p/m/a|db|sql|admin).*/(config/config\.inc|main)\.php.*".*404.*
 
# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =

And this is of course accompanied by a bit in jail.conf:

[apache-pma]
 
enabled = true
filter = apache-pma
action = iptables-allports[name=pma]
mail-whois[name=pma, dest=<YOURADDRHERE>]
logpath = /var/log/apache2/access_log
bantime = -1
maxretry = 1

Works for me, another 20 additional IPs/day onto the shitlist!

Update: It seems another variation of these scans are hitting the NIC’s quite often; One for Zen Cart to be more precise.
You can easily add support countering this scanner as well, simply by expanding the failregex with this line:

^<HOST> -.*"GET .*(cart|boutique|catalog|butik|shop|zen|store).*/install\.txt.*".*404.*

You can put multiple regexes within one failregex, just put each one on a new line.

Owl City from Endeavor Media Group on Vimeo.

En van dit nummer is (nog) geen clip volgens mij, maar wellicht het mooiste nummer van het album, dus allicht moest ik hem wel posten

TRUE/EPIC METAL:
Our hero reaches the castle and beats the dragon in a terrible battle, and raises his sword, bathed in the dragon’s blood, and then makes love to the princess inside the castle

THRASH METAL:
Our hero reaches the castle, fights with grenades and machineguns against the dragon, saves the princess, and f*cks her around Detroit.

HEAVY METAL:
Our hero reaches the castle in a Harley Davidson, kills the dragon, has some beers with the princess and then they do it.

FOLK METAL:
Our hero arrives with some friends playing accordion, pipes, violin and other weird instruments. The dragon falls asleep because of too much dancing and they leave… without the princess

VIKING METAL:
Our hero arrives in an old boat, kills the dragon with an axe, cooks it and eats it. He then rapes the prioncess, raids the castle and sets everything on fire before he leaves.

DEATH METAL:
Our hero arrives, kills the dragon, fucks the princess, beats her to death, and leaves…

BLACK METAL:
He arrives before dawn, in the middle of the fog, kills the dragon and impales it in front of the castle. Sodomizes the princess, cuts her with a dagger and drinks her blood in a ritualn ritual. Afterwards he discovers she wasn’t a virgin and impales her next to the dragon.

BRUTAL DEATH:
Our hero kills the princess and fucks the dragon.

GORE METAL:
Arrives, kills the dragon, climbs to the tower, fucks the princess, and kills her. Then he fucks her again, burns her dead body and fucks her again.

DOOM/GOTH METAL:
Reaches the castle, sees the size of the dragon, he gets depressed and he kills himself. The dragon eats our hero’s body and then the princess.

NU METAL:
Reaches the castle and brags about how good he is at fighting and that he can beat the dragon. He is miserably defeated and is left in pieces. Runs away and finds the princess, he tells her of his tragic childhood. The princess slaps his face, and runs to find the “Heavy Metal” hero. The “Nu” hero, takes a Prozac and goes to record a “The best of…” CD

PROGRESSIVE:
Arrives, plays a virtuous guitar solo for 26 minutes. The dragon dies of boredom. Gets to the princess and plays another solo, exploring all of the techniques of tones and compasses learned last year in conservatory(music school). Princess runs away after the “Heavy Metal” hero.

HARD ROCK:
Reaches the castle in a red convertible with two big-breasted blondes and drinking a bottle of Jack Daniels. Kills the dragon with a knife and then makes an orgy with the blondes and the princess.

GLAM ROCK:
Reaches the castle. The dragon laughs his ass off when he sees him and lets him through. Enters the castle, steals the princess’ varnish and lipstick. Then he convinces the dragon to paint the castle pink, and to highlight his hair.

(Klik op lees meer voor meer Kabouter Wesley hilariteiten miljaar!)

However, in addition to Cacti I also use Munin to monitor various system parameters. Wouldn’t it be nice to incorporate graphs for fan speeds and temperatures in Munin? I thought so, so I developed a way to do this.

In this case the solution consists out of 2 munin plugins and a PHP script that formats the IPMI values for graphing use. This could also be done directly in the plugins, but since I’m not such an awk and sed expert I chose to let a PHP script handle the transformation, so I’d be done sooner (time is money my friends!).

First up, the PHP script:

/usr/bin/ipmi.php

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

#!/usr/bin/php
<?php
$handle = fopen("/dev/shm/dell.ipmi","r");
while(!feof($handle)) {
  $line = fgets($handle);
  if(preg_match("/AmbientTemp/",$line)) echo "tambi.value ".fgets($handle);
  if(preg_match("/CPU1Temp/",$line)) echo "tcpu1.value ".fgets($handle);
  if(preg_match("/CPU2Temp/",$line)) echo "tcpu2.value ".fgets($handle);
  if(preg_match("/Fan1/",$line)) echo "fan1.value ".fgets($handle);
  if(preg_match("/Fan2/",$line)) echo "fan2.value ".fgets($handle);
  if(preg_match("/Fan3/",$line)) echo "fan3.value ".fgets($handle);
  if(preg_match("/Fan4/",$line)) echo "fan4.value ".fgets($handle);
  if(preg_match("/Fan5/",$line)) echo "fan5.value ".fgets($handle);
  if(preg_match("/Fan6/",$line)) echo "fan6.value ".fgets($handle);
  if(preg_match("/PlanarTemp/",$line)) echo "tplan.value ".fgets($handle);
  if(preg_match("/RiserTemp/",$line)) echo "trise.value ".fgets($handle);
}
fclose($handle);
?>

With the SHM values now being prefixed with matching Munin values, we can graph them in 2 plugins:

/etc/munin/plugins/ipmitemps

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

#!/bin/sh
 
if [ "$1" = "autoconf" ]; then
        if [ -r /dev/shm/dell.ipmi ]; then
                echo yes
                exit 0
        else
                echo no
                exit 1
        fi
fi
 
if [ "$1" = "config" ]; then
 
        echo 'graph_title Dell 2850 IPMI Temperatures'
        echo 'graph_order tcpu1 tcpu2 tambi tplan trise'
        echo 'graph_vlabel Temperature (Deg C)'
        echo 'graph_scale yes'
        echo 'graph_info This graph shows sensor temperatures'
        echo 'graph_category system'
        echo 'tcpu1.label CPU1'
        echo 'tcpu1.warning 80'
        echo 'tcpu1.critical 90'
        echo 'tcpu1.info XEON CPU 1 Temperature'
        echo 'tcpu2.label CPU2'
        echo 'tcpu2.warning 80'
        echo 'tcpu2.critical 90'
        echo 'tcpu2.info XEON CPU 2 Temperature'
        echo 'tambi.label Ambient'
        echo 'tambi.warning 80'
        echo 'tambi.critical 90'
        echo 'tambi.info Ambient Temperature'
        echo 'tplan.label Planar'
        echo 'tplan.warning 80'
        echo 'tplan.critical 90'
        echo 'tplan.info Planar Temperature'
        echo 'trise.label Riser'
        echo 'trise.warning 80'
        echo 'trise.critical 90'
        echo 'trise.info Riser Temperature'
        exit 0
fi
/usr/bin/ipmi.php

and

/etc/munin/plugins/ipmifans

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

#!/bin/sh
 
if [ "$1" = "autoconf" ]; then
        if [ -r /dev/shm/dell.ipmi ]; then
                echo yes
                exit 0
        else
                echo no
                exit 1
        fi
fi
 
if [ "$1" = "config" ]; then
 
        echo 'graph_title Dell 2850 IPMI Fanspeeds'
        echo 'graph_order fan1 fan2 fan3 fan4 fan5 fan6'
        echo 'graph_vlabel Fanspeed (RPM)'
        echo 'graph_scale yes'
        echo 'graph_info This graph shows fanspeeds'
        echo 'graph_category system'
        echo 'fan1.label Fan1'
        echo 'fan1.info Fan1 speed'
        echo 'fan2.label Fan2'
        echo 'fan2.info Fan2 speed'
        echo 'fan3.label Fan3'
        echo 'fan3.info Fan3 speed'
        echo 'fan4.label Fan4'
        echo 'fan4.info Fan4 speed'
        echo 'fan5.label Fan5'
        echo 'fan5.info Fan5 speed'
        echo 'fan6.label Fan6'
        echo 'fan6.info Fan6 speed'
        exit 0
fi
/usr/bin/ipmi.php

restart your munin-node, run the munin crons, and voila, graphs!
With these settings they will look like this:

Dell IPMI Temperatures

Dell IPMI Fan Speeds

You can modify the params to change the graphs ofcourse.