[mythtvnz] Open MythWeb access

[Sam Hadley-Jones]

Hads,

Could've been my box but I'm sure I secured it last week. Was it
samborambo.homelinux.net?

I browsed through my /var/log/auth.log and, to my horror, noticed a
successful ssh probe / brute force attack from some overseas IP. They
guessed the I have a mythtv user account and logged in for 3 seconds - I
had the password set to 'mythtv' and admin rights, doh!

Lesson learned - with seemingly no damage done. I wasn't to worried
about security while building the mythbox behind a firewall but I didn't
close all the loopholes before DMZing the box.

A good idea would be to stop ssh access for the mythtv user altogether.

My mythbox gets probed quite often - usually once or twice a week.
However, if you're going to try and hack someone else make sure your own
computer is secure. I had an attack a few weeks ago - someone trying
random passwords on the root account. Port scanning is a great tool; the
IP attacking me had left his mysql root user with no password on a
production webserver. He no longer has any databases... :)

Sam.