I thought EZproxy would query a directory service while authenticating the user, but it does not store users' information on its own.  However, hackers trying to break into a database is very common.  The most common tactics is SQL injection.  The secure practices are well known.  I list as many of them as I can remember below; hope you are not bored.
1. set database user privileges to the least, and if possible, make them task specific.
2. when accepting user inputs, enforce the data constrains at both application and database levels.
3. use image captcha to prevent auto-filling.
4. configure the web server to deny any IP that has failed many requests within a very short period of time.
5. configure the web server to deny any cross-site scripting.

You really can do nothing about those rogues, because they are rogues, and the nature of the web is open to everybody.  But once you do all the things in the list above, you should be ok, considering it's just a library's website.  The real hackers would have a much bigger target to attack.

Kelly Zhu


-----Original Message-----
From: Code for Libraries [mailto:[log in to unmask]] On Behalf Of Joshua Welker
Sent: 2014年11月19日 14:53
To: [log in to unmask]
Subject: [CODE4LIB] Balancing security and privacy with EZproxy

   Balancing security and privacy with EZproxy

In recent months, we have been contacted several times by one of our vendors about our databases being accessed by rogue Chinese IP addresses.
With the massive proliferation of online security breaches and password dumps, attackers are gaining access to student accounts and using them to access subscription resources through EZproxy. The vendor catches this happening and alerts us sometimes, but probably more often than not we have no idea. When we do find out, we force the students to change their passwords.

We currently log IP addresses in EZproxy and can see when one of these rogue IP addresses is accessing a resource. However, we do not log user IDs in EZproxy, so we can’t tell which student account was compromised. Logging the user IDs would be a quick fix, but it has major privacy implications for our patrons, as we would have a record of every document they access.
Have any other institutions encountered this problem? Are any best practices established for how to deal with these security breaches?

I apologize for cross-posting.

Josh Welker
Information Technology Librarian
James C. Kirkpatrick Library
University of Central Missouri
Warrensburg, MO 64093
JCKL 2260
660.543.8022
**Bronze+Blue=Green** The University of Central Oklahoma is Bronze, Blue, and Green! Please print this e-mail only if absolutely necessary!

**CONFIDENTIALITY** -This e-mail (including any attachments) may contain confidential, proprietary and privileged information. Any unauthorized disclosure or use of this information is prohibited.