Geek Speak in thwack CommunityWhere is this forum or group located?

Log in to follow, share, and participate in this community. Not a member? Join Now!

CSS

HTML

Recent Blog Posts

Refresh this widget

Don't Be a Sitting Duck!

 

Script kiddies test the defenses of FTP servers and SFTP servers (using SSH) every minute of every day.  IT administrators have gotten used to these probes, and smart ones have already enabled IP lockouts on their perimeter servers.  (This setting is on the "Server Settings" pane in Serv-U FTP Server.)

 

sitting_duck.jpg

However, there are a number of "well known" usernames that should never be used as usernames on FTP servers and SFTP servers because they are just too easy to guess.

 

10. administrator -  Very popular in Windows environments.  Don't use it on your FTP server.

9. oracle - Companies that like to write big checks to Larry often cut corners elsewhere to make the payments.  Don't follow the herd using "oracle" on systems that connect to the enterprise database.

8. mysql - Don't use the names of other databases or back-end infrastructure either. (Also avoid "sa", "sqlserver" , "nas", "postgres", etc..)

7. user - Popular test account, often set up with too many permissions, and often rolls over from the evaluation environment to production.

6. guest - "Sure, c'mon in.  You can use the bathroom, the phone and my checkbook."

5. apache - It's also common to see people name accounts after the web application they support with their FTP or SFTP services. (Also avoid "iis", "serv-u", "nginx", "www", etc.)

4. info - I'm honestly stumped on why "info" is popular (if you know, tell me in the comments), but it is.

3. test - "It's just a test account.  I promise I'll delete it - soon."

2. admin - Tempting to use in web applications (including Serv-U) because it's so short. Pick usernames like "[your initials]admin" instead to avoid script kiddies.

1. root - By far, the most popular attack target.  If you're building a honeypot, include root.  If not, don't.

 

Other Usernames to Avoid

 

Did I miss some the usernames you expected to see?  If so, tell me about them in the comments section below.

Recently, the Geeks at the SolarWinds Lab landed themselves in a bit of a pickle. Which one is faster – installing a virtual appliance with Hyper-V ® or VMware ®?

Our Head Geeks, Lawrence Garvin and Patrick Hubbard, were certain that there was only one way to get to the bottom of the situation – A Virtual Application installation bout!

 

Our head geeks also explain why noisy pagers or flooded mailboxes are not the only problems for IT. The biggest challenge is to have all your alerts in one place for analysis, adding notes and performing initial triage before assigning it to the right person in the right department.

 

Pick your favorite early and root for your favorite geek or hypervisor! (Remember, this is not a competition, it is only an exhibition - please, no wagering.)

 


Did your favorite Geek win? Well ,there are no losers in this battle. All IT specialists receive a gold medal with our free SolarWinds Alert Central - the perfect tool to consolidate and manage all your alerts. Just follow along with Lawrence and Patrick to install it on your virtual machine and fire it up to:

 

  • Consolidate your alerts from all your IT monitoring software
  • Setup automatic escalation workflows that work for each team
  • Schedule on-calls using the intuitive calendar interface
  • View status/priority of alerts with easily distinguishable icons


Put an end to those critical ignored alerts that get lost in somebody’s inbox that only your boss seems to know about.

 

Alert Central is not just one of our many free tools.  It’s a free product capable of handling tens of thousands of alerts for hundreds of users.


Download Alert Central for Hyper-V or VMware and get your weekends back.

On March 5th of this year, Network Topology Mapper v1.0 was made available to the public.  Since then it has quickly become one of the more popular products that SolarWinds offers.  It’s a great tool for MSPs and IT Consultants that travel from one client location to the next because with only one license of NTM, an unlimited number of networks can be scanned and mapped.  It’s also a nice complement to SolarWinds Network Performance Monitor (NPM) because maps created in NTM can be exported to the Network Atlas format and then imported for use in NPM.

 

NTM_1-0_NETWORK_MAPPING_REGULATORY_COMPLIANCE_Base_EN.png

 

On 5/13/13, the first service release of NTM was made available.  This update includes some great new features.  Among a few bug fixes, this service release includes:

 

  • Nodes with multiple IP addresses are now supported in tooltips, details windows, and search queries
  • Spanning tree now reports states in English instead of stored values
  • Link speeds of up to 10Gb are now identified
  • Maps can now be exported to Visio 2013 vsdx format

 

For those of you who have already purchased NTM, visit the customer portal and download the latest release for these updates.  If you haven’t tried NTM yet, now is the perfect time!  For those who would like to try NTM, we’ve unlocked a few of the features in the trial to make the experience better. Download NTM v1.0.1 today and see how easy it is to create an accurate and detailed map your network.

We keep hearing about Denial of Service (DoS) attacks, owing a large part of it to our dependency on the Web. A typical DoS situation could be a website going offline. Also, you may have faced situations where a sudden increase in traffic causes the site to load very slowly. Sometimes the traffic can be good enough to shut the site down completely. A perfect case for Distributed Denial of Service (DDoS).

In short, DoS and DDoS attacks are some of the most inventive hacking practices on the rise bringing down businesses critical services, and inhibiting user Web access and business continuity.

So, the question is what exactly are DoS and DDoS? More importantly, how do we guard our IT assets from them?

 

Denial of Service

It’s an attack where the attempt is to prevent legitimate users from accessing information or services. It usually targets your system and its network connections, or the network of critical sites that you may often use. The most common type is flooding a network. For example, when you type a URL of a particular website, what you actually do is send a request to access the page. There are only a certain number of requests that the site’s web server can process at a time and hence cannot process your request, precisely “Denial of Service”.

For most hackers, Web servers are the ideal choice for launching attacks as they have more computing and network capacity compared to a home PC. A very similar thing happened with Mt. GOX servers recently. So, to crash a web server, a DoS threat attacks the following services:

  • Network bandwidth
  • Server memory
  • Application exception handling mechanism
  • CPU usage
  • Hard disk space
  • Database space
  • Database connection pool

To a large extent, organizations tend to rely on firewalls to defend their networks against DoS attacks. Although firewalls are a key component of an organization's security solution, they are not individually capable enough to thwart a targeted DDoS attack.

 

Distributed Denial of Service

In a DDoS attack, the hacker is likely to take control of the security vulnerabilities to control  your system and use it to attack other systems in the network. A perfect example for this is sending out spam, sending overloaded information to a website. In simple terms, the attack is distributed, where the user uses multiple computers to launch the DoS attack.

Symptoms like slow network performance, sudden spike in receiving spam content, and inability to access certain websites suggest that there are chances your network is under attack. It’s best to be proactive and shield yourself against possible threats. You need to continuously monitor the activities on your web server, firewalls and endpoints. Using a security information and event management software would be an ideal choice.  It helps you by monitoring all the logs collected from various entities in your IT environment, and analyzing and correlating events in real time for advanced incident awareness.

 

If you want to safeguard your IT against DoS and DDoS threats, you need to ensure that your SIEM tool uses active responses to respond to critical security events, and shuts down threats immediately. Some key built-in responses that you might need for sure are:

  • Send incident alerts, emails, pop-up messages, or SNMP traps
  • Add or remove users from groups
  • Block an IP address
  • Kill processes by ID or name

Microsoft SharePoint is a web application commonly used for document and file management, collaboration, search, business intelligence, social networking and other functions.  With its widespread use, internal and external customers are dependent upon SharePoint’s availability to get things done.  Below are the top 5 causes of a slow-responding SharePoint application, and how you can proactively identify these problems and fix them before end users even know there is an issue.

 

1) Network devices and bandwidth:  The most obvious reason for network latency is often bandwidth capacity.  However, latency issues can still exist even in a large bandwidth network, particularly if the *devices* involved in the interconnections – switches, routers, firewalls, etc. are introducing the latency. At its core, these devices are all ‘store and forward’. When the ‘store and forward’ takes longer than optimal, latency is introduced. Locational issues are caused by distance (the round trip takes a while) or due to a location’s network infrastructure where the internal WAN may be slow.
2) Volume of requests/application usage: Each and every click is recorded as a transaction.  If the volume of transactions exceeds the available resources, it causes application latency.  An increase in the number of concurrent users also can cause responsiveness to suffer. A high memory usage, low disk cache memory or a storage I/O may cause latency in loading components required by SharePoint.
3) Load time for integrated components.  SharePoint allows adding widgets, applications like Java, SQL. An issue or delay in loading the components may cause delay and latency issues.
4) Database issues.  SharePoint heavily relies on the database infrastructure. I/O problems could indicate a problem with the disk.  Latency could also be caused by slow queries.

 

To proactively detect these issues, here is some guidance on what to monitor in your SharePoint environment.
Monitor the network.  This includes utilization of each interface as well as the network latency and packet loss for each node. 
Monitor web transaction response times from multiple locations.  With a good website monitoring tool, you can determine if a slow page is locational or if the problem is native to the application. 
Monitor page load times for the entire transaction.  By monitoring all the pages/steps in a transaction is necessary to pinpointing where the user experience breaks down.

sharepoint pages.PNG

 

When looking at an individual page, it’s good to have a waterfall chart to view which element is consuming the most time to determine if the issue is related JavaScript, DNS lookup, etc.

sharepoint waterfall.PNG

Monitor database performance & query times.  Because a database issue can be the cause of a SharePoint performance problem it is important that your server management tool can monitor key performance metrics of your database.   Key metrics include lock wait time, fragmentation, and deadlocks among others.  You also want to monitor how long it takes for SQL queries to perform to get an indication if the query written requires a change to improve performance.

SQL monitoring.PNG

 

Monitor underlying server resources for CPU, Memory and Disk constraints. CPU utilization issues can indicate underperforming hardware or perhaps a virtual machine has insufficient resource allocation.  It is also very important to keep close tabs on disk I/O and disk latency to understand how storage performance is impacting your application.  This is a major issue with heavy data intensive applications like SharePoint.
Monitor specific SharePoint performance metrics such as:
-SharePoint request wait time.  As the number of wait events increase, page-rendering performance will deteriorate.  If wait time is consistently trending up, you should consider adding additional web servers to support your application.
-SharePoint requests rejected.  If there are any requests rejected (showing a 503 HTTP status code), there are insufficient server resources, and you should consider implementing additional web servers.
-SharePoint Worker process Restarts.  Any worker process restarts can indicate a problem such as a memory leak, access violations or process settings.  Investigate process restarts to prevent issues.

-Requests per second.  This provides an indication of current throughput of the application.  If this metrics gets out of a certain range, you will need to add additional resources to cope with the increased load.

 

The SolarWinds Web App Monitoring Pack provides the ability to monitor web application page load times and provides out-of-the-box monitoring for SharePoint 2013, 2010 and 2007. Try it free for 30 days.

More

Ad

Recent Content

Refresh this widget
Filter by Categories & Tags