Security protection

[JulieJolie]

I heard about Password Sentry and Pennywize which supposely kicks asses but we are in a dilema. Is one better than the other? Does both can work together?...

[DannyCox]

Julie, doesn't your hosting company offer password protection? Most hosting companies that have protection software running don't charge you for overages caused by the failure of their software. I know that we don't.

I'm not up to speed on either software you mentioned, as we use our own proprietary software on our servers. But I believe that to install "Password Sentry" you need root access on your server. It is an actual Apache module, and needs root install (I may be wrong). Not many hosting companies will give that sort of access to anyone.

Pennywize is the easier of the two to have set-up, but much more expensive as you are paying a monthly fee versus a one-time charge.

You don't want to run both together.

Check with your hosting company, and on their policies of running this type of protection.

[Billy]

I know the wife uses Pennywize and it seems to be doing a great job !

[JulieJolie]

Originally posted by DannyCox@Nov 27 2003, 10:40 AM
Julie, doesn't your hosting company offer password protection? Most hosting companies that have protection software running don't charge you for overages caused by the failure of their software. I know that we don't.

I'm not up to speed on either software you mentioned, as we use our own proprietary software on our servers. But I believe that to install "Password Sentry" you need root access on your server. It is an actual Apache module, and needs root install (I may be wrong). Not many hosting companies will give that sort of access to anyone.

Pennywize is the easier of the two to have set-up, but much more expensive as you are paying a monthly fee versus a one-time charge.

You don't want to run both together.

Check with your hosting company, and on their policies of running this type of protection.

I know my host does have one but more security is never too much... but since you tell me that about password sentry, I guess we better go with pennywize.

[Hell Puppy]

We've used pennywize for years and years. Works great, so I haven't really looked at anything else.

[Kacy]

Hey Julie

Its definately better to go with something that installed as a module on the server itself. Running other programs such as Pennywise use cgi which takes up system resources on a busy shared server. Also trying to multiple programs at one time cause some to not function at all.

If your host is already running Password Sentry, which I think they are, then I would NOT recommend you add Pennywise. I think you are going to run into more issues than you already have. We don't even allow virtual clients to run Pennywise as it causes our system that we, also like Danny, guarantee to work. There should be no reason your host can't get this under control for you.

[Hell Puppy]

Good point, with Pennywize you really should be on your own server so you've got a handle on resources.

With that said, I've pushed 20 gigs of transfer per day thru it on a 1.6 Ghz box with a half gig of ram with no problems.

[MandyBlake]

I have Password Sentry and love it.
The guy was super helpful.

[Kacy]

Originally posted by Hell Puppy@Nov 27 2003, 09:15 PM
Good point, with Pennywize you really should be on your own server so you've got a handle on resources.

With that said, I've pushed 20 gigs of transfer per day thru it on a 1.6 Ghz box with a half gig of ram with no problems.

Perfect You should have no issues using Pennywise on that set up. Its only when you get into running multiple instances of it that is a problem.

[Porsche Lynn]

Does anyone have any knowledge of a cgi script called password nazi?

[georgia]

Originally posted by Porsche Lynn@Dec 7 2003, 01:26 PM
Does anyone have any knowledge of a cgi script called password nazi?

Hi Porsche Lynn,

I personally would not use password nazi.

The only thing that works and works good are server modules compiled into apache. Cgi protection and other bought scripts are almost worthless.

A lot of people use password sentry, pennywise and other comparable scripts. If you care about your members and take your business seriously, I would suggest you invest in a module.

There are a ton out there. The most widely used one is Iprotect.

I am not sure who you are hosted with, but they should provide this for you. There is absolutely no reason for you to spend extra money.

If you host doesn't have good enough protection, you might want to consider finding another host. You might even save a ton of money.

If you need some more information, I can point you in the right direction. We have pretty much used every type of protection out there and no whats good and not so good.

Mike



Last edited by georgia at Dec 7 2003, 02:14 PM

[gonzo]

Originally posted by Porsche Lynn@Dec 7 2003, 04:26 PM
Does anyone have any knowledge of a cgi script called password nazi?

Kacy can probably offer some good guidance as well.

[Kacy]

I would just have to agree with Mike that, the best protection is something configured into the server build.

This is something I personally feel your host should be handling for you, whether you are on a small virtual account or you have a managed server. If you have a unmanged dedicated server somewhere then I can understand why you would ask this questions and need some recommedations, but for the most your host should be handling this for you. Are they not?

[Porsche Lynn]

Actually they do have server side portection, but I am not sure that it is as powerful as it should be.
We had passwords traded on the boards last wek.
i went in an deleted them personally before the server had blocked them and quiete a few 100 or more people had been in already, although I know it does work because there are 3 blocked passwords in the logs. It looks for multiple Ips trying to get in so I suppose if they come one by one over a period of time the blocking does not see them?

What do you guys consider password theft in terms of amount of mg or g of stuff going out theough a password per day?

[georgia]

If your host is using password sentry for protection, I would find a new host. Password sentry uses mod_rewrite to run through scripts. It is not a server module. It's a cheap way of providing protection. Since it uses mod_rewrite every time someone enters your members area, every single files and image has to run through that script. Can you image the server load on that?

With that being said it can't protect your site the way it should be protected.

Also, by using mod_rewrite you are limiting the amount of people that can enter your members area. Depending on the amount of members you have, I am sure you get an email every once in awhile saying they can't get into your members area. The answer for that is mod_rewrite.

The only real way to protect a site is to use a server installed module, not an installed script.

Keep in mind, you will still get password traded. There is no way around that. You can just limit the amount of people that get in.

I am curious, how do you know 100 people came in? What type of logs are you using that is telling you this.

As far as amount of gigs used. It's hard to tell. Member areas normally do not make up alot of bandwidth. You should be serving more bandwidth on your free tour.

We have our protection set to 5. If a password gets traded, no more than 5 people will come through. After 5 we send them to 403 pages which generates a good amount of traffic. I know the hosting company you are with takes all your error traffic which isn't right in my mind. Your losing out on alot of traffic that you could do something with.

Hope this helps a little.

Mike

[Porsche Lynn]

Thanks for all the help you guys rock, I saw the attempted entires through the logs so I am not sure if that is a corret figure.
Like I sadid somewhere else I am very new to this whole game and poor little me needs as much help as I can squeeze out of the webmaster mistress world (lets not forget the girls)

So many of you have been doing this for so long and no so much stuff, I have seltought myself and still feel like a very small fish in a big pond.

I supoose when looking for hosting asking about protection is a big part of the equation something that i never really realised until some weeks ago. We have not lost much just irks me that people are so mean.............

[Porsche Lynn]

I know that they use the leaving traffic, they say that is because of the protection plan and it makes them a little money back.
I suppose you are right, it really is ours but I am not really ure what to do with it anyway.
i have been trrying to configure exit console today and am not having much luck with that either, cgi and perl seem to defeat me time to go back to the books?

[sarettah]

Originally posted by Porsche Lynn@Dec 12 2003, 07:12 PM
I know that they use the leaving traffic, they say that is because of the protection plan and it makes them a little money back.
I suppose you are right, it really is ours but I am not really ure what to do with it anyway.
i have been trrying to configure exit console today and am not having much luck with that either, cgi and perl seem to defeat me time to go back to the books?

Hi Porsche....

Unless I am confused, you should not have to mess with cgi at your exit console....

What are you trying to accomplish ?

Generally speaking (and I am sure others will correct me if I am wrong) an exit console is a popup, sometimes a bit fancier, such as a poup with a couple of popunders launching at load time....

As far as your 404/403/40? traffic goes, if your host is taking it, they are stealing from you pure and simple.... There is definitely money to be made from surfers snooping around your site, or trying to break passwords....

I would be sending them directly to popup hell in a manner that forces them to click a join link to get out.... In addition, I would have those join links on a different page than your normal join pages, that way, you can continue to pop them if they don't join at that point...

If they are snooping the sight, at that point , in my mind, all is fair...

Force them to join or reboot....

But then again, thats just me........

[Porsche Lynn]

Thanks for the advice, this is the kinda stuff that I need help with lots of help. maybe we could chat at internext?

[Kacy]

Porshce Lynn

If you need help setting up the pop ups, let me know. I am happy to send you in the right direction for some tutorials, etc.

I think you can change like your 404 error pages, but your host does not allow your 403 or 401 to changed I believe. I could be wrong and hopefully I am, but you might want to check for sure. Those are the ones are that really need to be able to changed for your benefit.

[Porsche Lynn]

Thanks Kacy, I do need help with this stuff, i hate pop ups but I do see there relevance especially as someone is leaving, ic an send them to one of my other site at least. i have a few affilaite programe that we refer to but not many, keeping them at my sites works best.
We will be meeting with amateur hosting at the show, actually I will be signing for them daily in the afternoon. so if you are there please call by and say hi.

[gonzo]

Originally posted by Porsche Lynn@Dec 12 2003, 07:12 PM
I know that they use the leaving traffic, they say that is because of the protection plan and it makes them a little money back.
I suppose you are right, it really is ours but I am not really ure what to do with it anyway.
i have been trrying to configure exit console today and am not having much luck with that either, cgi and perl seem to defeat me time to go back to the books?

All traffic is good traffic. Except for CJ traffic..."CJ's suck ass"- The Shemp.

Im sure we can all give you a few tips on what to use it for. Just dont throw it away.

[gonzo]

Originally posted by Porsche Lynn@Dec 16 2003, 08:39 PM
Thanks Kacy, I do need help with this stuff, i hate pop ups but I do see there relevance especially as someone is leaving, ic an send them to one of my other site at least. i have a few affilaite programe that we refer to but not many, keeping them at my sites works best.
We will be meeting with amateur hosting at the show, actually I will be signing for them daily in the afternoon. so if you are there please call by and say hi.

I think a lot of us would agree that the face of the industry is changing and that includes the look and feel of a site for any niche.

I just starting working a fetish related program andthey are backing off from the industrialized slick look and going over to the old school look because it validates that the stuff is for real.

One this is for sure...your traffic is probably a lot of search engine based. And being who you are means that those surfers are there to see you.
My advice would be to use that traffic to see more about you and what you are doing or to cross pollinate other sites for say Nina's or Cristy's.

Hope you are planning to come to our little gathering while we are out there.

Billy have you decided where and when yet? My ballroom idea got squashed. We will table that until spring and use Danny Cox and Far L's magnificant contacts to work out something spectacular.

In the meantime its the spotlight dance for you. Break out my favorite suit!

[Porsche Lynn]

Hey Gonzo I have a non alchol related idea for a meet!
Why don't we rent American Shooter and go shoot maching guns, if we bring a few girls we could alos get some content.
Must to rememebr is that guns and alchol do no mix.
We can always go drink after
Let me know

[gonzo]

Originally posted by Porsche Lynn@Dec 17 2003, 11:20 AM
Hey Gonzo I have a non alchol related idea for a meet!
Why don't we rent American Shooter and go shoot maching guns, if we bring a few girls we could alos get some content.
Must to rememebr is that guns and alchol do no mix.
We can always go drink after
Let me know

I down with that...whats everyone else think?
Sounds like a good idea for a shoot. That is in Vegas I assume?

For you that dont know....Prosche has a slight affinity for guns and has a site based around babes and gun. I cant remember the URL off the top of my head.

[Porsche Lynn]

Maybe we should start this tread somewhere else but where.
Yes in Vegas, American Shooter has all the gund we need

the url is
http://www.machinegunbabes.com
not a very exciting site right now and something I really want to work on,

Gonzo
Lets start a thread, let me know where.