Somebody hacked into the ACRE web site and disabled it.
Could have had something to do with that Thunder Bird virus
or what ever it was I had a few days ago. Could have been
spy ware.

Web site providers or "host" use multi user OS's like Linux and Unix.
That means many people can log in but have limited access to the
host hard disk. Usually they have access to just their own
directories or folders in Windows speak.

Usually the web site host uses software that disables the hacker's input
if he is unsuccessful in logging in after x number of tries.
This is pretty effective. Keeps the hacker from simply writing a program
that merely scrolls through a long list of words to try.

I think they got into my computer first and found
the pass word to my web site. I did not have an effective
pass word to get in to my computer. I used something obvious and simple.
Don't use names or dictionary words in you pass words. Use a nonsensical
mix of upper and lower case letters as well as numbers. The longer the better.

You send data to your web site by a program called
ftp. That requires another pass word. FTP will save that pass word on
your hard drive so a clever hacker can get it from your hard drive.
There are web site editors such as Front Page that probably
have FTP built in. The hackers know where these pass words are stored
on your hard drive.

I made it easy for them as I saved the web site pass words in a plain text file
stored on my hard disk so I could find them when I needed them. Big mistake.
I learned my lesson. Save your passwords on a USB stick and unplug
it when you are not using it. Or just write it on paper.

Don't let your FTP program save your pass words.
Manually type them in each time you use FTP or your web site
maintenance software.


Paul Lamar

Hi Paul,

I use an application called Secure Data Manager to store my password.
Since I have over 50 password for one thing or another, writing them on
paper is hard to keep track of also.  I only need to remember one user
name and password for the SDM file.  The password file is on the hard
disk, but encrypted.      http://freshmeat.net/projects/sdm

I set my web site up so that no one including me can ftp or ssh to it
as root.  To put something on the web site, I ftp it to a separate
non-root account, then ssh to that account.  After getting to the non
root account, I can su to root and move the files I uploaded to the
proper location.  This means I need two separate passwords to update
the web site.  The problem is, I no longer remember what I did to set
it up this way, so would have to mess around for 1/2 day to undo it.
You also need a dedicated server to have all the permissions needed to
make it work.

Be secure,
Bob W.