Skip to main content
A few random things that I have been dealing with

My Digitalocean droplet suffered recently a brute force ssh attack. Unfortunately I noticed it a couple of days after the attack had happened but luckily the act caused little harm except very high CPU usage from sshd process for a few days. I'm not sure how to really protect against such attacks (cheaply) but I decided to try out fail2ban. With fail2ban I could protect the server also against attacks towards nginx.

Installing it was simple enough and I saw it was working rather well. There were some 3K ssh login attempts per day and the iptables based port blocking reduced the amount to some hundreds. After a while though I noticed that the fail2ban stopped blocking unauthorized IPs. I took a look at fail2ban github and saw some issues with ssh regex filters (fail2ban works by monitoring logs and matching those against predefined regexes). I made some small adjustments but still no luck, it did not ban anything.

I turned on debug logs and saw lines where it said something like: IGNORE timestamp < another timestamp - findtime. I converted the timestamps to human readable format and checked those against auth.log. Those looked weird, the timestamps were way off. Then it hit me, i had recently changed the timezone of the server to the Finnish one. By quick googling around I found out that after the timestamp is updated, the syslog daemon needs to be restarted as well so the system log timestamps would match the system timezone. service rsyslog restart did the trick.


Another totally unrelated thing on the very same droplet was an issue with running a scala application as a systemd service. I ran a development version of the process simply with nohup previously but since the app was about to go to "production", i thought it would need something to keep it always up and running. I was somewhat familiar to upstart and it turned out that there were some good instructions which upstart keywords would match the systemd service files.

Writing the service file was a breeze, only a couple of lines. The problems started when I started the service. It was running fine for a couple of seconds, it printed out nicely the first few log lines to the standard output. However after the app was up (rest service was running) the service exited with success code 0. I tried modifying some of the basic configs like Type=simple and SuccessExitStatus=143 and even using sh -c to start the java process. After a while I was convinced that the problem was not in the service file but rather in the scala application startup. And indeed it was. After the rest service has started, I added a line StdIn.readLine() followed by a graceful stopping of the process. The idea is to hit enter to stop the application if it running on foreground. After I removed that line and the graceful shutdown, it was running fine as a systemd service. It seems systemd sends something to the process stdin when it is starting up / started.

tldr: Run service rsyslog restart after you have changed ubuntu timezone. Check std in reads on processes running as a systemd service.

Labels:

Comments

Post a Comment

Popular posts from this blog

I'm not a passionate developer

A family friend of mine is an airlane pilot. A dream job for most, right? As a child, I certainly thought so. Now that I can have grown-up talks with him, I have discovered a more accurate description of his profession. He says that the truth about the job is that it is boring. To me, that is not that surprising. Airplanes are cool and all, but when you are in the middle of the Atlantic sitting next to the colleague you have been talking to past five years, how stimulating can that be? When he says the job is boring, it is not a bad kind of boring. It is a very specific boring. The "boring" you would want as a passenger. Uneventful.  Yet, he loves his job. According to him, an experienced pilot is most pleased when each and every tiny thing in the flight plan - goes according to plan. Passengers in the cabin of an expert pilot sit in the comfort of not even noticing who is flying. As someone employed in a field where being boring is not exactly in high demand, this sounds pro...
Post a Comment
Read more

PydanticAI + evals + LiteLLM pipeline

I gave a tech talk at a Python meetup titled "Overengineering an LLM pipeline". It's based on my experiences of building production-grade stuff with LLMs I'm not sure how overengineered it actually turned out. Experimental would be a better term as it is using PydanticAI graphs library, which is in its very early stages as of writing this, although arguably already better than some of the pipeline libraries. Anyway, here is a link to it. It is a CLI poker app where you play one hand against an LLM. The LLM (theoretically) gets better with a self-correcting mechanism based on the evaluation score from another LLM. It uses the annotated past games as an additional context to potentially improve its decision-making. https://github.com/juho-y/archipylago-poker
Post a Comment
Read more

"You are a friendly breadwinner"

A recent blog post by Pete Koomen about how we still lack truly "AI-native" software got me thinking about the kinds of applications I’d like to see. As the blog post says, AI should handle the boring stuff and leave the interesting parts for me. I listed down a few tasks I've dealt with recently and wrote some system prompts for potential agentic AIs: Check that the GDPR subprocessor list is up to date. Also, ensure we have a signed data processing agreement in place with the necessary vendors. Write a summary of what you did and highlight any oddities or potentially outdated vendors. Review our product’s public-facing API. Ensure the domain objects are named consistently. Here's a link to our documentation describing the domain. Conduct a SOC 2 audit of our system and write a report with your findings. Send the report to Slack. Once you get approval, start implementing the necessary changes. These could include HR-related updates, changes to cloud infras...
Post a Comment
Read more