Posts RSS Comments RSS 58 Posts and 39 Comments till now

Archive for the 'Web Hosting' Category

Hacked Wordpress Recovery

Interesting to see this post from WP developer Donnacha, on removing various popular nasties from a wordpress install after it has been hacked or compromised.

At work we often see instances where it is not possible to simply return a user’s CMS install to a pre-hack backup and then upgrade (the safest course of action) because of

  1. Confusion over when the hack(s) / compromises first occured.
  2. Confusion over what legitimate content / changes have been made since.
  3. No obviously clean recent backup exists.

So we’re often left with a script / CMS install that needs to be cleaned up and upgraded. Where suspicious files have been uploaded, these are often easy to locate because of the sheer number of requests to these, for example from vulnerable PCs that have been tricked into trying to download a virus or trojan loader. Malicious javascript added to core or template files can be more difficult to spot in this manner as are disguised files referenced from the CMS’s database.

It would be helpful if the development / security investigation teams of most major CMS’s published these sorts of guides. Thanks Donnacha!

Easier updating with Wordpress

I’ve been pleased to see the inclusion of an update warning in recent versions of Wordpress when new versions are released. Coupled with the plugins page that now tells you when updates are available for your installed addons the system is becoming a lot easier for the non technical user to maintain, even if they ultimately have to seek help with the process. Working on a web host’s helpdesk, it’s obvious that half the problem with old script installs is that the site owner isn’t aware updates are required.

I’m looking forward to the day when Wordpress can also have the option to update itself (for example as Simple Machines Forum can do, by feeding it your FTP details), just to make it a little harder for users to ignore ;)

Microsoft Smart Network Data Services (snds)

If you run an email server, you may be interested to have a look at Microsoft’s Smart Network Data Services tool. Providing you can authenticate yourself as the administrator of the IP address in question you can view statistics on the volume and type of email sent to hotmail / live.com / msn. This includes goodies like

  • Whether email from your range has been hitting the “trap addresses” (dummy accounts setup by MS to catch spammers).
  • What percentage of your email is being complained about within the hotmail interface
  • An overall result from the spam filter in place.

Better than nothing…

Unfortunately, to limit it’s use to spammers the amount of data available is relatively small. The tool only provides you with one example email that has been “complained” about per day per IP.

The sort of email that is being marked by users may be something of a surprise. We have seen the following marked as junk by users within the hotmail interface.

  • Order confirmations
  • Emails containing login details
  •   Requested quotes for technical work (I guess the price wasn’t right…)

Perhaps to a cynic this isn’t a great surprise, it isn’t too much of a leap to define spam email as “anything I don’t want to receive”. However, it pushes the notion that some user re-education is definitely needed at hotmail and also gives the impression that some people are using mark as junk rather than the delete button.

If you operate a site or service where a lot of people will sign up with a hotmail or other free address, you might wish to reduce the number of emails you send. It is tempting to wonder if this is a sign of a change in user attitudes, it used to be the case that confirmation emails were welcomed because they could be kept as a record and were a clue that the automated form you had input data to had actually processed. However it now seems to be the case that as long as screen confirmation / tracking is provided to the user they are now finding the email notifications irrelevant? Are users trusting their web transactions much more than before? Are email newsletters now irrelevant in the age of rss feeds?

Forwarding spam is naughty (and if you use a catch all you’re going to blackhole hell)

The tool provides a spam filter result for the IP as well,  if you’re doing any catch all forwarding to hotmail addresses, you’ll likely end up with a red filter result (as a catch all on an established domain will catch oodles of spam). This is somewhat depressing as users are only forwarding this email, although from the point of view of an administrator forwarded spam is still wasted bandwidth and CPU time. There is no suggestion in the FAQ as to what weighting the filter and complaint rate have in deciding blackholing although keeping the complaint rate below 0.3% is quoted as a target to aim for.

What combination of complaint rate, spam filter results and duration leads to a block or even worse the blackholing of email doesn’t seem to be public information.  Anecdotal evidence (i.e from me to you, now) would seem to suggest that blackholing can be remedied by reducing the filter result (which is only common sense, if several catch alls are running up to 80-90% of your red filter figure might be spam) but I wouldn’t like to bet my salary on it.

Hotmail support seem to have difficulty with the concept of a shared hosting service where you are concerned with unblocking a server rather than a specific domain and their forms and replies are geared towards the latter. It would be helpful if there were a separate route to support through the snds interface given the authentication requirement to access data (although granted that doesn’t guarantee intelligent questions ;) ).

Mounting an FTP account on Linux

Learning to use the command line is one of the hardest things about moving to Linux, however once you’re used to it, doing things becomes second nature and you actually miss being able to use the terminal in those cases where you have FTP access but no shell account. For some things using a GUI is laborious, upgrading web apps is a major case in point.

One way of getting around this is the curlftpfs package. The software allows you to mount your FTP account and access it as you would any other part of your Linux File System.

After installing the package, you may have to modprobe fuse and may have to add your user to the fuse group. The former was necessary on Suse 10.2 and the latter on Kubuntu Feisty. After that simply create the folder you wish to use as a mount point and issue the command.

curlftpfs -v ftp://user:pass@ftp.somewhere.net/ MountPoint/

Once everything is working you can do away with the -v which enables verbose output. This is great if you need to do work on a web app where there is no shell access.

Caution

It is easy to forget this is not shell access, commands like unzip, unrar etc will use the binary on your machine with the resulting backwards forwards data transfer. Use such commands at your peril if working on an unstable connection, with large files or if you don’t have a backup.

Whilst this can be used with the rails command (again not recommended), bear in mind that you’ll need to copy the contents of the vendor directory to the server manually, as this is normally symlinked when working on the shell.

References

http://gentoo-wiki.com/HOWTO_FTP_Mount

Nominet Registrar Information Day

I was lucky enough a week or two back to get a day away from the screen up in London to attend Nominet’s registrar information day. The event had a sensible start time of 9.30 for registration (presentations starting at 10.00) making travelling up the same day just about possible (i.e getting up at 5 is the very earliest I’ll entertain). I would have been there bang on time if not for a tube derailment (nothing to do with my deciding to travel I might add, gypsies curses not withstanding). Walking up a quiet Oxford street in some rare sun was really rather enjoyable.

The event itself is a strange hybrid, in some ways it would be appropriate as an Induction for new Registrars but there is also useful content in most of the segments on recent developments and a presentation on future technologies at the end and these are appropriate for anyone at a registrar who needs to keep up to date and indeed there were several attendees who had been before or were even regular to the event.

The attendees were a mixed bag or management, techies and administration staff, comprising those interested in being registrars only if they can fully automate the process to those working for small development and consultancy outfits still composing emails to register domains by hand. This made the fact that Jay Daley (whose rather scary blog on control freak techniques is well worth a read) managed to do an overview of some fairly technical subjects (DNS-Sec, Enum) before going home time without some of the less technical members of the audience beginning to foam at the mouth rather impressive.

In general the staff seemed to recognise that the organisation has an image amongst some of it’s registrars as old fashioned and bureaucratic and indeed the organisation has added a “Key Account Manager” position so that they can keep in touch with and get better feedback from the registrar community. One expects these sorts of days to be well choreographed but all of the staff I spoke to certainly gave me a more positive view of the organisation than I had had previously as well as being able to put emails addresses to faces, something which is always handy.

The staff were pretty honest, when queried on the precise rules behind a technical process involving merging account Nominet were happy to say “we’re still having fun playing with that”. Obviously it would be nice to have live systems fully documented but not being honest about why they aren’t documented yet would have been worse than confirming the details are still being set.

The concept of getting the technical team to blog along with their technical challenges as part of their objectives seems a good way to make their work more visible as well as documenting technical humps traversed (I’ve got no idea whether Nominet have an internal knowledgebase but it always surprises me how many places don’t for various reasons) and indeed publishing some of that knowledge is a pretty admirable goal for a team working at a high level. Customer facing technical teams in commercial organisations often can’t blog about recent challenges in case these reveal details about a particular incident they’d rather the customers didn’t know about for reasons of confidentiality or business prudence so it is good to see an organisation that has the opportunity take advantage of it.

Ultimately the day was worth attending and will probably be worth revisiting at a set interval or whenever there are interesting developments at the organisation that will affect the business.

Configuring Tracks on Servage

I’ve spent the last day trying to get support for a Tracks install on Servage that went from running a little bit slow to not running at all, here is what I found out. It also provides a little insight into how not to deal with customers problems with third party scripts.

Continue Reading »

Google Stats Tools

Because of the lack of any decent statistics tools at Servage.net (as mentioned in my review) - I’m going to be looking at the various statistics packages offered for free by third parties, the first of which will be Google’s Webmaster Tools and Analytics offerings. As the attentive will note, the tracking code is now enabled in this blog.

 

Clustered hosting does make offering traditional statistics packages difficult depending on the setup and there is indeed some logic to having a solution that is portable wherever you happen to currently be hosting your site. No statistics or poor statistics reporting reduces the likelihood of your site being a success or you being able to monetise it.

 

Google is the obvious one, but stats trackers certainly used to be two a penny - feel free to comment below if there are any you’d specifically like me to have a look at in addition.

 

Servage.net - New Anti-Spam System

Servage.net, my current host who I reviewed last week have just introduced a new anti-spam system. Whilst this is a welcome addition, there are a few issues to be aware of…

Continue Reading »

Tracking down vulnerable web apps on a hosting service

Looks like one of the worst things that can happen to a web app project has happened to wordpress - one of their releases was compromised by a “cracker”

http://wordpress.org/development/2007/03/upgrade-212/

I was in the “at risk” group of recent installs so have upgraded as soon as I saw the news post. The difficulty for server admins of tracking down vulnerable web apps installed on their service is worth a bit of further examination.

Continue Reading »

Servage.net Review

Servage.net are a company offering large amounts of shared hosting resources for a reasonable price - do they measure up?

Continue Reading »