Will Bradley - Latest Comments

Re: Concrete5 ‘Unable to send mail’ error patch

1plm — Tue, 24 Jan 2012 16:42:37 -0000

Thanks and be Blessed.

Re: Contact

dmg — Fri, 30 Dec 2011 21:31:48 -0000

I want that nagios board. I WANT IT. I live in Phoenix and can pick it up at your convenience.

Re: Tennis For Two: Vintage Videogames

David — Mon, 12 Dec 2011 09:48:37 -0000

cool

Re: Test-Driven IT

willbradley — Mon, 25 Oct 2010 15:12:49 -0000

Indeed, I'd like to find something closer to the holy grail as well. For web developers obviously scripting is a good choice, but for pure system/network people I think tools like IPMonitor do a great job of testing things like the contents of an HTML page or the size of a file. Only problem with IPMonitor is that it costs a fair bit of money.

Re: Test-Driven IT

Harry — Mon, 25 Oct 2010 12:45:37 -0000

That's in some ways the holy grail of monitoring software. An IT shop that has their monitors setup in such a way that whenever a change occurs the tests pass or fail is a happy IT shop. Too often though people setup monitors that ping or maybe check to see that a particular port is listening and leave it at that. Good monitors need to poll your systems the same way your customers do. A few packages I've run into over the years that can do that include MS SCOM, HP Sitescope (formerly had a free version but not since bought by HP), Zabbix (currently free, but a pain to setup IMHO), WhatsUpGold, plus many others. The key seems to be finding a system that doesn't rely too heavily on ping and SNMP. SNMP is great but cryptic as hell if you have to write your own mibs.

Another method I've resorted to in the past is to write your own tests. In windows, WMI can be your best friend. AutoIt automation macros can be used to test legacy GUIs that can only be tested in the GUI or with low level Win32 calls, and .NET has a ton of automation tools that can be used to script just about any test imaginable. Just write your test in .NET or shell scripts in Linux and have it output to html with a simple code like 0 or OK and something meaningful for error conditions . Then check the outputs with a free web scraper monitoring system like Zabbix.

Re: Security for Developers

Ryan Gasparini — Mon, 26 Jul 2010 16:43:41 -0000

What do you think about fail2ban? Our legacy managed hosts think that will stop portscanning and DDoS attacks.

Re: Security for Developers

willbradley — Thu, 22 Jul 2010 16:52:20 -0000

Thanks Ryan! bcrypt is definitely useful for storing database dumps securely. Blowfish is a symmetric cipher, which means that the original data can be recovered. For passwords, however, you will want an asymmetric hash like SHA2-- the original password can't be recovered, only compared.

Changing SSH to a port other than 22, and disabling root logins via SSH, is good advice, but don't let that lull you into relaxing your security. Basically it just weeds out portscanning bots-- anyone who's run a blog knows that bots are 90% of the problem but the remaining 10% is still a big concern when you're talking about a dozen attempts per second.

Re: Security for Developers

Ryan Gasparini — Thu, 22 Jul 2010 16:16:35 -0000

+ bcrypt or bust
+ change port defaults to custom value