Articles
The Design Decisions Behind DenyHosts Default Deny ThresholdsDenyHosts was built around a simple operational problem: an internet-facing SSH service can receive a large number of automated login attempts before an…
Tracing Coordinated Intrusions with Scratchy Forensic AnalysisWhen a web server starts returning unusual traffic patterns, the first challenge is separating a genuine attack from the constant noise of the public internet.…
How I Optimized Scratchy for Gigabyte-Sized Apache LogsScratchy began as a focused Apache log analyzer: read access logs, extract useful fields, and turn raw request data into reports. That workflow worked well for…
Designing Scratchy to Detect and Highlight Anomalous Traffic SpikesApache access logs contain a detailed record of how a server is being used: client addresses, request paths, response codes, referrers, user agents,…
Auditing Server Access With Scratchy After a Security IncidentWhen a web server has been compromised or subjected to a suspected attack, its access logs can provide the first reliable account of what happened. They record…
How Scratchy Processes Log Files With Multiple Unclosed EntriesLog files are often treated as orderly streams of completed records, but real server output is less predictable. Processes can stop during a write, files can…
Adding country-level blocking to DenyHosts with GeoIP dataDenyHosts was designed to recognize repeated SSH login failures and respond by adding hostile addresses to a deny list. That model works well when the goal is…
The Architecture of Kodos: Separating Regex Logic From the UIKodos is a Python regular expression debugger designed to make pattern development more visible and less error-prone. Instead of treating a regex as an opaque…
Making DenyHosts Work Across Python 2 And Python 3DenyHosts began as a focused Python utility for protecting SSH services from repeated login attacks. Its job was straightforward: inspect authentication logs,…
Cleaning Up DenyHosts Without Breaking Its PurposeDenyHosts began with a focused objective: watch SSH authentication failures, identify abusive addresses, and prevent repeated attacks from consuming a server’s…