My Ultimate .htaccess Recipe

About a year ago, I got really tired of seeing infinite "script not found or unable to stat (that's how you spell start, apache?) : xmlrpc.php" in my error logs. This file does not, did not, and will never exist on my server, yet bots from too many IP addresses to block would request it anyway, over and over... and over... 24/7.

So I turned to Google for a solution and discovered that .htaccess files can be pretty damn handy. Here is the .htaccess file of one of the servers I maintain, and explanations of what each directive does:

First, it's good to use custom error pages. Except for 404's, I like to send bogus error messages back to the user, because it throws attackers off. So, I have a friendly 404 page that explains the page the visitor is looking for does not exist, and that it's totally my fault, with a link back home and the webmaster (my) email address. All other common errors are sent to a generic "Error 696" page that explains an undeclared error has occured, and redirects them back home.

<Files *errorpage.php>
allow from all
</Files>

ErrorDocument 400 /errorpage.php
ErrorDocument 401 /errorpage.php
ErrorDocument 403 /errorpage.php
ErrorDocument 404 /404_errorpage.php
ErrorDocument 500 /errorpage.php
ErrorDocument 501 /errorpage.php

Next, we have mod rewrite directives. Mod rewrite kicks ass, and as you can see,  I can use it to send requests of questionable nature to 'mytrap.php' (a script I found online, credit to author 'Inque187' for writing it! I wish I could find his page to link you to.) Mytrap.php grabs the attackers IP address and adds a Deny from x.x.x.x to the end of the .htaccess file. This permanently bans the IP address, and with the custom error page, they get a bogus '696' error page forever after being greeted by mytrap.php's harsh "F*** You, Don't Come Again" page.

RewriteEngine On
RewriteRule ^cgi-bin /mytrap.php [NC,L]
RewriteRule ^cgi-bin/(.*)$ /mytrap.php [NC,L]
RewriteRule ^(/*.*)?cgi(.*/*)?$ /mytrap.php [NC,L]
RewriteRule ^(/*.*)?chat(.*/*)?$ /mytrap.php [NC,L]
RewriteRule ^(/*.*)?db(.*/*)?$ /mytrap.php [NC,L]
RewriteRule ^(/*.*)?pma(.*/*)?$ /mytrap.php [NC,L]
RewriteRule ^(/*.*)?rpc(.*/*)?$ /mytrap.php [NC,L]
RewriteRule ^(/*.*)?xmlrpc(.*/*)?$ /mytrap.php [NC,L]
RewriteRule ^(/*.*)?wp-login(.*/*)?$ /mytrap.php [NC,L]
RewriteRule ^(/*.*)?ssh(.*/*)?$ /mytrap.php [NC,L]
RewriteRule ^xmlrpc.php /mytrap.php [NC]
RewriteRule ^(/*.*)?admin(.*/*)?$ /mytrap.php [NC,L]
RewriteRule ^(/*.*)?config(.*/*)?$ /mytrap.php [NC,L]
RewriteRule ^(/*.*)?manager(.*/*)?$ /mytrap.php [NC,L]
RewriteRule ^(/*.*)?webdav(.*/*)?$ /mytrap.php [NC,L]
RewriteRule ^(/*.*)?wp-content(.*/*)?$ /mytrap.php [NC,L]
RewriteRule ^(/*.*)?cgibin(.*/*)?$ /mytrap.php [NC,L]
RewriteRule ^(/*.*)?phppath(.*/*)?$ /mytrap.php [NC,L]
RewriteRule ^(/*.*)?xbxb(.*/*)?$ /mytrap.php [NC,L]
RewriteRule ^(/*.*)?phpMyAdmin(.*/*)?$ /mytrap.php [NC,L]
RewriteRule ^(/*.*)?myadmin(.*/*)?$ /mytrap.php [NC,L]
RewriteRule ^(/*.*)?.git(.*/*)?$ /mytrap.php [NC,L]
RewriteRule ^(/*.*)?phpmyadmin(.*/*)?$ /mytrap.php [NC,L]
RewriteRule ^(/*.*)?Admin(.*/*)?$ /mytrap.php [NC,L]
RewriteRule ^(/*.*)?webmin(.*/*)?$ /mytrap.php [NC,L]
RewriteRule ^(/*.*)?cpanel(.*/*)?$ /mytrap.php [NC,L]
RewriteRule ^(/*.*)?panel(.*/*)?$ /mytrap.php [NC,L]
RewriteRule ^(/*.*)?restricted(.*/*)?$ /mytrap.php [NC,L]

Note: for all this to work properly, you need to make sure that the <Files> directives above allows access to the error pages. This is because if an attacker gets banned, he will get a double-403 error, as he is denied access to the error pages as well. That's not only not pretty, it's counterproductive. The code for mytrap can be found here, if you're interested. To be fair, I have modified it somewhat. The original code was slightly kinder to the attacker.

And of course, it is desirable to stop image 'hot-linking', because it consumes bandwidth. This works with mod rewrite as well, and makes sure that if the http referrer came from anywhere but my site, they are given a 403 (or, "696" in this case) error.

#hotlink kill


    RewriteCond %{HTTP_REFERER} !^$
    RewriteCond %{HTTP_REFERER} !^http://(www.)?donotaccept.tk/.*$ [NC]
    RewriteRule .*.(gif|jpg|jpeg|png|js|css)$ - [F]

To get you started, here is a starter list of IP addresses that have tried funny stuff on my server over the last year or so:

# Since Implementing mytrap.php:

Deny from 89.46.101.153
Deny from 50.7.139.156
Deny from 50.7.139.117
Deny from 50.7.139.116
Deny from 50.7.139.154
Deny from 50.7.139.158
Deny from 94.242.206.199
Deny from 187.33.2.88
Deny from 31.210.96.90
Deny from 209.126.74.118
Deny from 87.98.252.201
Deny from 176.31.72.184
Deny from 162.217.204.10
Deny from 94.102.63.56
Deny from 89.248.172.145
Deny from 94.102.63.54
Deny from 89.248.169.48
Deny from 93.174.95.125
Deny from 94.102.49.207
Deny from 162.213.155.182
Deny from 184.107.148.154
Deny from 58.137.44.212
Deny from 185.56.80.133
Deny from 80.82.78.112
Deny from 46.105.132.145
Deny from 94.100.17.134
Deny from 91.223.89.150
Deny from 91.223.89.141
Deny from 91.223.89.148
Deny from 94.102.52.144
Deny from 85.17.123.29
Deny from 203.195.212.30
Deny from 176.109.195.139
Deny from 94.102.49.168
Deny from 176.123.2.6
Deny from 176.102.37.84
Deny from 94.102.49.218
Deny from 94.102.63.55
Deny from 50.30.42.71
Deny from 202.201.1.248
Deny from 94.102.52.76
Deny from 89.46.101.196
Deny from 76.73.74.82
Deny from 162.253.224.5
Deny from 69.64.72.41
Deny from 125.24.141.182
Deny from 61.144.224.28
Deny from 178.32.92.98
Deny from 188.40.114.21
Deny from 173.193.120.242
Deny from 1.214.212.74
Deny from 220.177.198.41
Deny from 115.239.248.58
Deny from 31.7.63.210
Deny from 176.123.7.31
Deny from 108.175.157.140
Deny from 222.190.118.224
Deny from 91.208.16.3
Deny from 77.238.15.68
Deny from 212.59.30.101
Deny from 84.17.0.17
Deny from 176.31.215.59
Deny from 162.248.101.225
Deny from 187.45.241.242
Deny from 37.57.231.220
Deny from 80.82.78.57
Deny from 93.174.93.204
Deny from 81.200.30.230
Deny from 212.152.254.101
Deny from 67.23.228.70
Deny from 209.151.165.199
Deny from 54.218.56.220
Deny from 192.42.116.16
Deny from 149.154.67.29
Deny from 107.170.53.191
Deny from 116.213.70.52
Deny from 54.232.227.221
Deny from 2.229.27.202
Deny from 80.82.65.50
Deny from 119.18.109.10
Deny from 162.243.209.165
Deny from 115.239.248.112
Deny from 118.26.205.224
Deny from 91.209.192.252
Deny from 50.7.139.198
Deny from 50.7.139.197
Deny from 50.7.139.202
Deny from 50.7.139.203
Deny from 94.242.206.146
Deny from 94.242.206.244
Deny from 61.227.20.77
Deny from 193.108.160.213
Deny from 118.161.189.190
Deny from 74.81.91.130
Deny from 67.23.249.124
Deny from 187.207.85.34
Deny from 222.186.56.7
Deny from 110.78.155.33
Deny from 92.63.104.233
Deny from 116.74.1.158
Deny from 111.252.179.12
Deny from 104.36.83.104
Deny from 117.21.191.205
Deny from 162.248.101.236
Deny from 198.46.158.94
Deny from 162.248.98.68
Deny from 212.227.114.158
Deny from 180.210.204.141
Deny from 216.128.23.172
Deny from 189.51.133.144
Deny from 91.202.25.217
Deny from 162.248.98.154
Deny from 188.143.234.100
Deny from 130.211.104.110
Deny from 5.45.74.37
Deny from 120.192.174.170
Deny from 95.111.68.120
Deny from 197.162.105.201
Deny from 114.46.8.59
Deny from 188.26.174.234
Deny from 58.177.134.182
Deny from 188.226.3.77
Deny from 207.46.13.98
Deny from 85.17.141.182
Deny from 186.155.250.225
Deny from 61.191.62.7
Deny from 69.85.84.88
Deny from 107.167.176.110
Deny from 46.18.76.4
Deny from 82.146.38.254
Deny from 66.85.171.10
Deny from 182.18.23.26
Deny from 193.169.195.67
Deny from 146.0.72.182
Deny from 195.3.144.84

# since server transfer

Deny from 78.191.212.15
Deny from 91.232.21.238
Deny from 114.252.43.77
Deny from 157.55.39.203
Deny from 192.227.227.107
Deny from 107.178.219.218
Deny from 23.251.155.105
Deny from 162.243.197.28
Deny from 91.121.18.214
Deny from 123.110.225.234
Deny from 176.123.3.14
Deny from 111.207.253.234
Deny from 46.105.24.37
Deny from 69.28.85.57
Deny from 207.46.13.0
Deny from 159.224.160.42
Deny from 86.34.134.179
Deny from 157.55.39.139
Deny from 96.8.115.114
Deny from 115.239.248.56
Deny from 69.174.245.163
Deny from 157.55.39.140
Deny from 117.21.191.208
Deny from 184.171.255.59
Deny from 117.21.226.160
Deny from 218.188.39.201
Deny from 184.154.150.120
Deny from 208.70.160.45
Deny from 117.27.158.108
Deny from 222.76.242.219
Deny from 88.35.245.157
Deny from 23.250.11.26
Deny from 124.160.193.67
Deny from 207.46.13.63
Deny from 108.178.24.130
Deny from 104.131.231.235
Deny from 202.176.80.22
Deny from 207.46.13.65
Deny from 198.57.210.19
Deny from 182.52.60.66
Deny from 81.82.255.164
Deny from 130.211.101.147
Deny from 5.248.87.10
Deny from 82.107.207.117
Deny from 218.245.6.22
Deny from 117.21.225.176
Deny from 114.24.153.21
Deny from 188.226.216.40
Deny from 162.253.66.76
Deny from 8.18.225.37
Deny from 50.6.77.43
Deny from 74.208.16.123
Deny from 83.64.10.186
Deny from 183.91.14.219
Deny from 194.72.112.130
Deny from 207.12.89.139
Deny from 216.158.84.92
Deny from 208.89.211.195
Deny from 189.164.59.181
Deny from 95.211.188.230
Deny from 46.105.121.70
Deny from 125.25.203.57
Deny from 89.42.216.25
Deny from 64.34.169.249
Deny from 69.64.38.144
Deny from 184.168.200.12
Deny from 68.90.68.227
Deny from 184.168.200.33
Deny from 96.8.125.27
Deny from 114.45.29.212
Deny from 122.155.174.172
Deny from 103.253.73.170
Deny from 207.46.13.104
Deny from 216.158.84.79
Deny from 201.219.60.5
Deny from 95.211.188.234
Deny from 74.91.127.130
Deny from 123.204.159.141
Deny from 146.0.72.185
Deny from 114.35.47.170
Deny from 114.35.183.103
Deny from 117.21.191.211
Deny from 217.40.96.250
Deny from 212.126.101.3
Deny from 140.119.19.28
Deny from 211.22.8.125
Deny from 50.22.53.71
Deny from 77.38.197.67
Deny from 140.113.146.59
Deny from 115.84.107.150
Deny from 192.210.200.51
Deny from 23.94.13.28
Deny from 217.70.142.135
Deny from 110.168.5.86
Deny from 62.210.167.201
Deny from 114.40.49.196
Deny from 103.31.204.82
Deny from 23.94.13.30
Deny from 192.210.200.254
Deny from 192.210.200.253
Deny from 192.210.200.130
Deny from 46.28.206.150
Deny from 23.94.13.106
Deny from 192.210.200.115
Deny from 220.133.153.220
Deny from 211.149.187.150
Deny from 222.74.129.6
Deny from 117.21.173.155
Deny from 81.88.49.30
Deny from 79.170.44.113
Deny from 184.168.200.234
Deny from 123.240.235.46
Deny from 188.225.72.145
Deny from 114.35.8.11
Deny from 64.187.235.199
Deny from 192.99.144.140
Deny from 27.28.52.129
Deny from 125.230.145.168
Deny from 195.206.253.146
Deny from 189.222.228.125
Deny from 188.225.34.139
Deny from 69.26.171.195
Deny from 74.63.199.120
Deny from 113.107.235.80
Deny from 218.152.216.82
Deny from 123.157.150.56
Deny from 162.17.16.249
Deny from 82.104.65.14
Deny from 187.174.166.135
Deny from 23.94.13.43
Deny from 27.159.203.63
Deny from 213.136.75.23
Deny from 123.192.113.27
Deny from 46.165.244.13
Deny from 75.102.34.114
Deny from 218.248.232.24
Deny from 5.11.36.140
Deny from 188.120.253.137
Deny from 5.238.81.96
Deny from 209.54.40.31
Deny from 213.136.79.113
Deny from 179.182.55.179
Deny from 192.99.152.38
Deny from 201.155.192.248
Deny from 213.136.75.34
Deny from 202.129.28.14
Deny from 37.187.78.33
Deny from 219.139.115.221
Deny from 117.26.248.30
Deny from 187.210.68.89
Deny from 186.37.78.157
Deny from 91.232.21.1
Deny from 103.253.73.229
Deny from 23.250.37.218
Deny from 201.243.63.188
Deny from 188.54.6.140
Deny from 81.17.20.38
Deny from 117.21.191.206
Deny from 120.43.22.104
Deny from 213.136.84.220
Deny from 123.30.213.33
Deny from 117.26.253.251
Deny from 27.153.231.194
Deny from 27.159.210.3
Deny from 114.32.175.165
Deny from 118.244.201.4
Deny from 201.163.235.196
Deny from 219.84.201.20
Deny from 196.42.30.146
Deny from 37.57.200.107
Deny from 95.70.30.78
Deny from 220.161.168.201
Deny from 27.159.213.115
Deny from 192.99.47.125
Deny from 27.159.252.12
Deny from 123.192.250.35
Deny from 202.119.166.37
Deny from 178.205.85.192
Deny from 93.94.219.69
Deny from 120.37.235.107
Deny from 222.79.146.2
Deny from 190.215.113.83
Deny from 110.169.153.246
Deny from 116.0.23.222
Deny from 188.40.137.21
Deny from 198.101.223.246
Deny from 88.100.179.195
Deny from 213.108.208.111
Deny from 89.248.166.139
Deny from 198.12.87.153
Deny from 203.158.167.2
Deny from 173.54.103.58
Deny from 46.105.158.150
Deny from 192.228.107.187
Deny from 114.27.35.93
Deny from 205.186.157.200
Deny from 117.26.255.56
Deny from 202.29.178.12
Deny from 27.159.202.129
Deny from 219.77.242.61
Deny from 201.166.63.25
Deny from 207.46.13.18
Deny from 189.167.17.122
Deny from 96.8.117.98
Deny from 140.123.226.217
Deny from 198.12.87.152
Deny from 113.252.247.235
Deny from 39.118.12.172
Deny from 93.89.232.19
Deny from 207.46.13.49
Deny from 189.236.145.1
Deny from 89.207.135.125
Deny from 71.86.48.83
Deny from 59.124.2.157
Deny from 84.52.30.37
Deny from 23.95.113.232
Deny from 201.214.3.74
Deny from 121.40.134.116
Deny from 192.187.110.179
Deny from 204.11.35.6
Deny from 173.45.100.18
Deny from 218.30.21.144
Deny from 60.18.147.183
Deny from 5.39.90.148
Deny from 125.212.197.67
Deny from 94.102.49.82
Deny from 140.117.53.39
Deny from 178.18.250.4
Deny from 193.150.120.74
Deny from 116.113.96.171
Deny from 104.192.103.24
Deny from 94.242.58.132
Deny from 74.208.105.217
Deny from 209.190.11.26
Deny from 162.244.32.47
Deny from 176.10.100.226
Deny from 142.4.215.115
Deny from 207.46.13.44
Deny from 200.90.118.98
Deny from 5.39.222.250
Deny from 46.4.93.52
Deny from 198.8.90.61
Deny from 182.48.49.155
Deny from 79.170.40.232
Deny from 209.239.114.46
Deny from 174.136.50.43
Deny from 192.163.236.48
Deny from 69.162.74.146
Deny from 203.114.105.46
Deny from 104.192.103.3
Deny from 117.21.173.34
Deny from 94.102.52.84
Deny from 149.210.135.28
Deny from 192.3.140.202
Deny from 146.71.111.226
Deny from 85.25.199.119
Deny from 88.135.0.50
Deny from 80.82.78.87
Deny from 91.200.12.28
Deny from 192.161.174.151
Deny from 128.73.172.235
Deny from 123.196.124.103
Deny from 46.72.212.75
Deny from 59.126.171.82
Deny from 58.96.172.3
Deny from 107.182.136.203
Deny from 109.86.15.95
Deny from 198.46.154.202
Deny from 173.199.73.34
Deny from 140.113.68.233
Deny from 110.82.157.175
Deny from 200.85.205.25
Deny from 176.102.38.45
Deny from 124.121.248.39
Deny from 124.192.229.236
Deny from 60.164.173.49
Deny from 188.225.76.82
Deny from 86.57.189.220
Deny from 180.186.121.254
Deny from 182.92.11.194
Deny from 80.244.35.222
Deny from 188.225.76.102
Deny from 178.20.229.132
Deny from 200.93.183.56

#Since server upgrade


Deny from 89.163.227.192
Deny from 72.249.47.87
Deny from 184.154.202.243
Deny from 94.102.77.42
Deny from 207.240.10.33
Deny from 212.59.30.110
Deny from 37.57.231.123
Deny from 84.45.122.217
Deny from 159.226.170.29
Deny from 46.4.97.132
Deny from 174.142.192.166
Deny from 5.248.10.80
Deny from 213.175.205.68
Deny from 93.170.147.174
Deny from 177.224.62.184
Deny from 144.76.70.133
Deny from 89.248.171.2
Deny from 193.150.120.176
Deny from 198.23.149.154
Deny from 94.102.63.155
Deny from 64.95.98.210
Deny from 64.95.98.214
Deny from 23.229.20.17
Deny from 95.128.246.45
Deny from 95.128.246.45
Deny from 95.128.246.45
Deny from 200.98.200.144
Deny from 37.115.185.37
Deny from 208.97.71.66
Deny from 187.61.61.120
Deny from 95.172.83.162
Deny from 1.10.218.171
Deny from 62.133.183.223
Deny from 82.165.150.150
Deny from 23.95.82.42
Deny from 217.126.50.212
Deny from 5.39.222.252
Deny from 174.129.126.216
Deny from 37.57.231.110
Deny from 198.211.30.100
Deny from 46.118.159.153
Deny from 74.208.173.45
Deny from 5.102.190.148
Deny from 93.158.200.18
Deny from 94.247.40.140
Deny from 37.57.231.235
Deny from 189.1.161.210
Deny from 120.126.36.198
Deny from 24.97.237.154
Deny from 188.40.84.105
Deny from 198.154.60.143
Deny from 203.146.170.165
Deny from 61.147.103.173
Deny from 64.95.98.10
Deny from 176.209.215.188
Deny from 93.186.202.16
Deny from 176.67.25.127
Deny from 46.32.239.84
Deny from 201.2.79.42
Deny from 190.221.1.136
Deny from 93.158.200.40
Deny from 85.17.25.195
Deny from 208.52.149.222
Deny from 111.226.131.113
Deny from 176.102.38.151
Deny from 176.103.49.29
Deny from 194.126.139.13
Deny from 23.94.186.154
Deny from 217.114.212.26
Deny from 2.139.237.110
Deny from 37.187.169.132
Deny from 89.46.101.145
Deny from 175.102.9.100
Deny from 76.178.222.142
Deny from 65.196.87.161
Deny from 198.154.63.131
Deny from 192.3.182.186
Deny from 64.95.98.11
Deny from 108.166.85.126
Deny from 23.94.17.82
Deny from 62.210.189.161
Deny from 85.194.82.10
Deny from 37.220.35.142
Deny from 195.154.169.102
Deny from 82.213.78.2

#Since move to new server


Deny from 64.188.44.114
Deny from 220.132.34.57
Deny from 220.241.216.6
Deny from 189.170.162.100
Deny from 58.96.180.91
Deny from 59.124.165.52
Deny from 103.253.113.172
Deny from 59.148.184.220
Deny from 219.232.247.108
Deny from 189.222.209.244
Deny from 121.199.17.183
Deny from 211.67.208.79
Deny from 212.175.87.57
Deny from 103.240.220.164
Deny from 42.3.128.111
Deny from 110.78.141.125
Deny from 194.27.60.106
Deny from 77.223.129.145
Deny from 194.27.68.28
Deny from 199.217.115.37
Deny from 186.115.6.148
Deny from 113.53.250.75
Deny from 222.124.155.106

 Enjoy.

Vps Deploy (stable!)

This is a script I am working on. The point is to quickly secure and configure a vps and install necessary software. The script will attempt to quickly guild the user through the process. I hate getting root passwords in the mail. Eventually this script should copy itself and automatically run on the target system to minimize the time that the server is sitting like lame duck with port 22 wide open and the root password emailed in plain text...

Script should be placed in a directory with a sub directory called "conf" with your public key file on one line in a file named "authorized_keys", and also your desired sshd_config file. The entire directory should be uploaded to the server with scp or similar. So the structure is
/folder/script+directory "conf"
Directory "conf" contains:
authorized_keys/
sshd_config".

I have not tested it yet. I am open to suggestions. Excuse my blogs formatting, this looked better in the terminal.

Updated 2/18/15 to reload open-ssh after configuration + fix format errors.

Updated again, removed many syntax errors (2/19/15) and simplified things. About to test it on a VM...

Updated 2/22/15: Script works great and is available on github: https://github.com/darkerego/vpsdeploy

OpenVPN: Something to Keep in Mind.

I initially called this a "potential vulnerability", but it's actually just something to be aware of. Always use the VPN ip when accessing the server. Duh. I have been trying to figure this out for a while. I have a few OpenVPN servers scattered across the cloud, and at least one of them has multiple IP addresses. A while ago, I noticed that when connected to the VPN, if I then SSH into that server, than the SSH connection appeared to be coming from my real IP address, and thus was not being routed through the VPN, like all my other traffic was. At first, I figured that was due to netstat not being able to show the VPN addresses:

anon@randombox~$ netstat | grep 2222

tcp        0    208 randomserver.example:2222 1.2.3.4              ESTABLISHED

But then I noticed that on one of servers with dual IP addresses, the opposite thing was happening, and the ssh connection was being routed through the VPN, as it ought to be:

 anon@randombox~$ netstat | grep 2222

tcp        0    208 randomnserver2.xx:2222 10.8.0.8:56789          ESTABLISHED

Checking my routing table, I realized the reason this happens is because any traffic destined for the VPN server's IP address will be routed through your default interface (ie when not connected to the VPN, let's say eth1):

anon@somebox:~$ route

Kernel IP routing table
Destination     Gateway         Genmask                Flags   Metric Ref    Use Iface
default           10.8.0.5                 0.0.0.0                  UG      0        0        0 tun0
10.8.0.1          10.8.0.5                255.255.255.255 UGH    0         0        0 tun0
10.8.0.5           *                          255.255.255.255   UH      0        0        0 tun0
vpn.rando      192.168.1.1     255.255.255.255   UGH   0        0        0 eth0
192.168.1.0      *                         255.255.255.0       U        1         0        0 eth0

So it seems that if you initiate an OpenVPN connection, and then access that same server on some other port, it will not be routed through the VPN, rather it will be treated as another VPN connection. Now, this is not a huge deal, as SSH is pretty secure, and any sensitive traffic should be sent using encryption. However, it could definitely break your privacy, and also opens up the possibility for other DNS or browser based exploits to occur. Personally, I do not trust my ISP or government, so I try to avoid using a direct connection whenever possible, and route my traffic overseas, into some other country that does not spy on civilians.

There are of course very easy solutions to this issue. You could simply tweak the iptables on your server to only allow ssh through the VPN (tun/tap) interface, or if you have multiple IP addresses on your server, you could simply connect to a different IP than your inbound VPN uses. I'm sure you could also alter the routing table on your pc, but I cannot think of a way that would work as of this moment, because this is kind of just how VPN's work.

Perhaps a patch for OpenVPN could be written that ensures that only traffic destined for the VPN's gateway port is routed through the default interface. This way, you would not have these kind of leaks.

Unleash Your Routers Power with OpenWRT

It is now 2015 and many cyber-security experts are predicting this will be a bad year for internet security. Many people have switched from insecure, proprietary software systems towards more secure open source operating systems on their PC's and phones. This is always a great move, but the weakest link in your network's security likely can be found at the source: your router.

After all, every packet that reaches each of your client devices first passes through your router. Thus, it seems to me that in a logical world, the routers security should be the primary concern of a good system administrator. If you can stop the bad packets before they ever reach your internal network, then your systems will be a lot safer. Surprisingly, this fact is often overlooked, at least in the non-technical populace.

A router, modem, or access point is an embedded system. These systems seldom get security updates, and are often used for long periods of time before they are replaced. Some of them (especially the router/modem/AP combo that Verizon or Comcast gave you), are insecure by design, containing backdoors that allow access to your network at any given time. If you are lucky, there may be a firmware update issued every year or so. But in my experience, the average person never even logs into their router to check if these updates are available. To make matters worse, typically router firmware is closed source, maintained by the company that built the device, and full of security holes. Seldom does a company ever update firmware on existing units yet to be sold, even when a serious exploit is discovered. Why should they care? If your router bricks on you, then you have to buy another router...

So the fate of embedded systems is often a dark one of becoming part of a bot-net, or maybe hosting a trogran, allowing unknown entities to spy on the owners network traffic. Sometimes these entities are Russian hackers, sometimes they are the NSA, sometimes your own ISP,  and sometimes they are the same entity or company that built the device, working with law enforcement, happily giving up their encryption keys for a bribe.

I suspect that this may have happened to me recently when my TP-Link WR841N got infected by some nasty piece of malware. I tried reflashing the official firmware over and over, but the virus remained. For a week or so my router sat in my closet, and I ordered a new one. The new router, a Netgear (can't remember the model) that costed me about $70 was even worse than my $20 TP-Link. Netgear firmware is definitively the worst firmware I have ever had the displeasure of using. It was completely dumbed down, and offered less features than the cheap TP-Link did. Only your Great Grandma would benefit from such simplicity. For example, it lacked the ability to act as a WPA2 client bridge. Only WEP was offered. Now again, this is 2015. Everyone knows that WEP is broken. Why the hell does a device sold in this day and age only offer WEP as a security option for a WDS system? Pathetic! Not to mention there is no reason in hell that could justify such lameness. That hardware is fully capable of acting as a WPA2 client bridge.

So I returned the Netgear router and finally tried installing OpenWRT on my bricked TP-Link. The only time I've ever been close to as happy with my router is when I was running DD-WRT a few years ago. Since ditching the stock firmware, virtually all of the odd things happening on my network stopped. No longer are there any questionable open ports on any devices, or unexplainable, hostile looking traffic showing up on Wireshark. Everything just works.

OpenWRT is alternative, open source, 3rd party firmware that runs on the Linux kernel. It greatly increases not only the security, but the functionality of your router. It allows you to be the one in control, and not the company that sold you the box. It has been developed almost entirely by volunteer developers seeking to make their systems and networks more secure, and help others to do so as well. The self interest factor, which I have discussed before, goes a long way in the computer world. That is, if the same people who maintain a system are also the ones using it, there is an inherent self interest to make sure the system works properly. This is not so much the case with proprietary software. They just sell the stuff... (Remember how none of the Philip Morris executives smoked cigarettes?) My $20 p.o.s. now has more functionality than some routers selling for over $150!

One of the challenges in developing alternative firmware for embedded systems like routers is the lack of sufficient ROM or flash to work with. My TP-Link only has 4 MBs of flash, and 32 mbs of RAM. I have about 160 kbs of ROM left after installing OpenWRT, with the graphical interface Luci. Initially I ran into some trouble after first flashing it because I did not have a GUI to work with, as there was not enough space left to install Luci. I suppose I was just feeling lazy, because I still had a perfectly good Linux shell to work with. But rather than doing it correctly and building the firmware myself, I found a working build packaged by someone else, with the GUI (Luci) and all of functionality the stock firmware provided (and more!). After uploading the firmware, I was able to connect the router to my main access point and use it as a client bridge, with no further configuration needed. But this build came from a questionable website,  was downloaded over an insecure HTTP connection, and was also somewhat outdated. Soon enough, trusty NMAP was warning me that fishy things might be happening again. So this time I found a build on Openwrt's https secured forums, with the md5sum available, and I flashed that. But after performing a factory reset, I lost the 'out of the box' WPA2 client bridge functionality!

This time, I had to learn how to configure it myself, using the bare bones ASH shell over ssh. And God damn, am I happy. It was stupid easy to configure the router as a bridge once I found a tutorial and just did it. It was honestly easier and more effective to do so using the shell, rather than the Luci GUI. Of course, having prior knowledge of how Linux works was very helpful. Perhaps even necessary, because if I had not switched to Linux on my PC two years ago, than chances are I never would have even heard of OpenWRT. Yeah, Unix based systems do that... they encourage you to use your brain and figure out how computer systems in general work.

OpenWRT runs on a variety of devices. To find out if yours is supported, consult the Table of Hardware. With abundant predictions that this year will be a bad year for computer security, why risk running shitty sub-par, outdated, and never updated firmware on any of your internet connected devices?

Reswap Revision

A while ago I wrote about turning off swap if you have enough RAM, for performance reasons. I realized that the original script I posted did not work very well. So, here is a simplified, effective way to empty your swap, thus gaining some system performance (because RAM is so much faster than hard disks).


    #!/bin/bash
    ##Reswap-- place in your $path as reswap
    ##to quickly empty your swap and gain some performance.
    ##
    set -e
    echo "Killing swap."
    swapoff -a
    echo "Success. Reenabling..."
    swapon -a
    echo "Done"
    exit

Finally! Connecting to a UDP OpenVPN Server on Android Over AT&T's Mobile Network!

The last month of my life I have spent countless hours trying to get this to work... no matter what I did I simply could not connect to my OpenVPN server unless I was on wifi, and even then I would often have problems. Now, I am trying not to get too excited just yet, because I had this working a few days ago and then all of the sudden it stopped working. I reflashed a backup I had made after I got it working the first time around, and it worked again for a minute or so, then stopped. I was so frustrated that I honestly missed out on a lot of life over the last few days, because I have been so preoccupied with researching ways to get this to work.

To be even more honest, I am not even sure exactly why it is working now, because I have tweaked so many settings to get it to work. However, with that said, the latest settings I have tweaked are:

- I installed the OpenVPN binary directly to my phone's /system partition. This is apparently an updated version of the binary, that knows how to handle certain error messages that the OpenVPN for Android app does not know what to do with. It also requires a rooted phone, of course, because we need to write to the read-only /system partition. Even then, I had to use a customized build because since updating to 4.4.4 (custom Arearom10), when the system is mounted as read-write (through ADB or the terminal emulator), the binary would still not install because the write access is limited to the user who requested it. Since each application on an Android system is running as it's own user, in it's own sandbox, the OpenVPN binary-installer available on the Play Store does not work.

- I was using UDP port 443 for my VPN, and have been for quite a while. This is because it (used to be anyway...) that this port was always open, no matter what network I was connected to. Things have changed, and now, for whatever reason, I could not even get a TCP connection to authenticate over port 443! (wtf?)

- So I changed the port of my server to a random port with no official usage, and then it connected via a TCP connection! Yay... sort of. TCP is slow. So then I switched the server back to UDP, and... it still worked!

- I also had to specify a TCP MTU payload of 1500 in the config file (which is generally the default anyway, so I don't know why that needed to be specified, but it does!)

- Hmm... what else... I have tried so many different configurations that I cannot even remember them all. But the settings I just outlined above are currently working on AT&T's 3G mobile network, so if you are struggling to get this to work this is what I would suggest:

1) Change the port number to something random. If it does not work, try another port. You should find one that works eventually, given that you...
2) Also specify to "override" the MTU payload to 1500 in your client.conf file.
3) Install the OpenVPN binary to /system/xbin/openvpn (You can try the official installer from the Play Store, if that does not work use the APK file referenced above.
4) Also install the "OpenVPN Settings" app from the Play Store... not sure why this is needed, but it is working and I am so sick of fucking around with everything, that I will deal with having dual 'vpn connected' notifications for the time being...

That should be all. Let me know if this works for you, I hope this helps someone. I will also post a much more detailed guild once I figure out exactly what solved the issue. By the way, it works fine without any of these insane tweaks over Verizon's network... (again... wtf?)

Long live hackers. The world would suck without them. Thank you to the dude who wrote that tweaked binary installer! You saved my Christmas.

Update: Oh yeah... I almost forgot to remind you, in case you have not been paying attention or simply don't know... Easy-Rsa was updated a while ago, and if you are not using version 3 yet, than you really ought to upgrade it, and also please remember to use a separate machine as your Certificate Authority, as opposed to generating and signing all of your server & client keys on the same server (or worse, VPS...). This is very important (if you care about security), because whoever owns your VPS server can likely obtain a root shell any time that they want to, thus giving them access to all of your keys, which breaks the encryption of the entire network!

AreaRom10 is THE Ultimate ROM for the Moto E, PERIOD!

Yesterday I had to travel to Boston, and I woke up late. I had a train to catch at 3:05, although I thought it left at 2:49 for some reason, and I woke up at 2:30. I grabbed my briefcase and proceeded to sprint to the train station, as the phrase "catching a train" took on new meaning to me. I was in such a rush that I did not realize I left all my USB cables at home. That sucks, because with the rooted stock ROM, I have had problems with wifi tethering, and I needed a secure internet connection for my computer while on the train. (I don't trust public WiFi if I can help it!)

I spent most of the train ride trying to figure out why tethering has been such a pain to set up, and although I learned a lot about the way Android KitKat allows carriers to hijack DNS queries and makes it difficult to set up tethering, transparent proxy's, and many other things, I decided that I am totally sick of messing around with various settings and tweaking everything myself. So I decided to give installing a custom ROM another shot when I got home.

This time, I opted to go with AreaRom10 for the Moto E, from AndroidArea51. I've had good luck with these developers ROM's in the past, and it seems that every other ROM for this phone (including Cyanogenmod) that I have tried breaks mobile data functionality. That bug limits me to WiFi, which is simply unacceptable because there are many times when I need an internet connection on the road. The ROM is based on KitKat 4.4.4, yet features like App Ops still work flawlessly (see my previous posts for terminology explanations). I did not even have to mess around with the APN settings to connect to the mobile network (although I did have to adjust the MMS settings, I'll get to that later).

I am so happy that I made the decision to go back to AreaRom! After flashing Arearom10, I performed a factory reset through TWRP, as instructed by their website. I then rebooted the device. After the annoying boot-loader unlock warning disappeared (which I am replacing with something cooler right now), a pretty impressive looking boot animation appeared, resembling wispy smoke patterns in high definition (or something like that). It was immediately apparent to me that the Area51 developers spent a lot of time on this ROM, because everything from touch screen responsiveness, to the awesome theme was so much better than the stock ASOP.

I signed into my Google account, and all of my apps, contacts, and data were restored without any issues. The ROM runs smoother than the rooted stock with Xposed I was using, and most of the Motorola bloat was already removed, except for a few applications that may actually be useful at some point. Although a couple of dump apps like "Ebay" and "RocketPlayer" were included, this is not a problem, as I simply removed them via Titanium Backup. It also came pre-installed with the Xposed framwork and GravityBox, the ROM is totally deodexed, and everything just works!!! I installed XPrivacy, fine tuned the permissions, reset my encryption keys, and now I am back in business. I cannot believe how painless this ROM has been to set up, and I really wish that I had installed it weeks ago, as it would have saved me a lot of headache...

Transparent proxy functionality with Orbot is now completely working after installing a custom IPTables app, and besides the firewall rules, no further configuration was needed. Tethering works perfectly out of the box, and it seems that the ROM has even fixed the evil DNS hijacking that either Google or my carrier has implemented. The only things that I have not managed to get working yet is my LUKS partition, SSH port forwarding proxy, and I still cannot seem to connect to my OpenVPN server from my computer when tethering. I may need to create a TCP protocol VPN for this phone. I am assuming that AT&T blocks UDP streams or something, maybe in an effort to stop people from using Bittorent, because OpenVPN worked flawlessly when I was on Verizon's network. However, these are all minor issues that I will find workaround’s for in due time.

In conclusion, if you are a frustrated GSM Motorola E user, I would highly recommend that you unlock your boot-loader and install AreaRom right now. You will not be disappointed. I am actually quite shocked that AndroidArea51 does not get as much recognition as the other ROM's available on XDA (which are buggy, at least in my experience). These guys really know their sh*t, are devoted, and have literally saved my life on almost every Android device I've owned.

May the Source be with you! Thank you AndroidArea51!