5 Safety Steps for Routine Server Maintenance

If you manage a server environment, your web host is probably performing preventative-maintenance tasks for you, but it never hurts to double-check that your server is in tip-top shape. Here are five steps to keep your server up and running, no matter what the virtual world throws at it.

Check For Script Updates

One of the biggest security holes in servers are out-of-date scripts, especially if you're using popular scripts such as WordPress. Keep a list of all of the script installations on your servers, and ensure they have the latest security updates. Some scripts automatically update when one is available, but this typically requires open permissions on a folder or files on your server. If you want to keep your server optimally secure, avoid having open permissions, and update it manually.

Check Folder Permissions

Each file and folder on your web server has specific read-and-write privileges. Some files are read-only. Others require certain users for editing while others can be written and read to by anyone — keep permissions restrictive to thwart hackers. It adds time to your server usage, but it's worth the potential trouble of clearing out a hacker from your servers. Most scripts provide you with the exact permissions needed to run properly, so don't deviate from that if you need to open up permissions for it to work. To find web hosts that give you access to your file and folder permissions through a web-based file manager and host control panel, check sites such as WebHostingBlueBook.com.

Audit Your Databases

Improperly coded web forms that save data to a database create a huge security risk. Why? Because a web form doesn't have a restriction on the type of characters sent through the form. A hacker can send along commands that cause tables to get created or dropped from a database. As a result, your databases are accessible. Since many scripts are database-driven, a hacker can see sensitive data and other records. Check your contact and other text submission forms to ensure only alphanumeric characters can be submitted. As a follow-up, use PHPMyAdmin or another database manager to see whether any foreign tables are added or existing tables are altered.

Update Your Operating System

Similar to a desktop computer, server operating systems frequently release security and major feature updates. Prevent the operating system from being compromised on your server by applying the latest updates and confirming their stability. In many cases, even in unmanaged hosting, the host updates the operating system directly.

Change Your Passwords

Despite its inconvenience, changing your passwords regularly for your hosting account, email addresses through the account, and FTP log-in information is essential to stay safe. If you're using the same log-in and password information on your server and a website that's hacked, a hacker has a better change to attack your web host and gain access to your account.
Do you have any server maintenance tips to share? Tell us in the comments.

Read more »

Alternative To XScreenSaver in Xubuntu Linux

I've been using Bauer-Puntu Linux on my work computer for the last few weeks, and it's been working swimmingly. I've managed to get everything setup so that managing my company's Windows network is just as easy to do as it was with a Windows 7 workstation.

One of the things that's been bothering me, even though it's not really a big deal, is that when I lock my computer if I step away from my desk I have to unlock it with the ugly XScreenSaver login prompt.

It's functional, but it looks like crap. I decided to get rid of it and replace it with Gnome-Screensaver instead which uses the same login screen you see when you first boot up.

To install it just run the following from the terminal:

sudo apt-get install gnome-screensaver

To remove XScreenSaver run the following from the terminal:

sudo apt-get remove xscreensaver --purge

That's it, after that you will have a little more aesthetically pleasing lock screen in Xubuntu, or in my case Bauer-Puntu!

By the way, if you love Ubuntu you might want to get yourself some FREE Ubuntu Stickers!

Read more »

In Resonse To The Feds Hacking Firefox To Snoop on Tor Users, The Tor Project Says To Stop Using Windows and Javascript

We reported last Tuesday that some malicious code was found that exploits a vulnerability in Firefox, and is used to snoop on Tor users. All evidence says that the exploit was developed and deployed by U.S. government contractors for the NSA.

In response to the news the folks at the Tor Project have issued a warning to Tor users; STOP USING WINDOWS, AND STOP USING JAVASCRIPT!

From IT World:

The TOR Project is advising that people stop using Windows after the discovery of a startling vulnerability in Firefox that undermined the main advantages of the privacy-centered network.

The zero-day vulnerability allowed as-yet-unknown interlopers to use a malicious piece of JavaScript to collect crucial identifying information on computers visiting some websites using The Onion Router (TOR) network.

"Really, switching away from Windows is probably a good security move for many reasons," according to a security advisory posted Monday by The TOR Project.

The TOR Project's reasoning comes from the characteristics of the malicious JavaScript that exploited the zero-day vulnerability. The script was written to target Windows computers running Firefox 17 ESR (Extended Support Release), a version of the browser customized to view websites using TOR.

People using Linux and OS X were not affected, but that doesn't mean they couldn't be targeted in the future. "This wasn't the first Firefox vulnerability, nor will it be the last," The TOR Project warned.

If you haven't switched to Linux yet I recommend doing so now. If you didn't know, I have my own flavor of Linux called Bauer-Puntu Linux that has many anti-government encryption and security tools installed by default to protect your privacy.

Read more »

Dat ASCII!

I'm a huge fan of ASCII art. I love using it in my MOTD's on my Linux servers at the office. It sort of breaks up the monotany that way. Until now though, I've never seen ASCII art put into a gif!

What do you think? Let me know in the comments!

[Via Imgur]

Read more »

Are The Feds Actively Trying To Hack Tor?

One of the ways I recommend to get around the widely unpopular NSA's domestic Internet surveillance is to use Tor. I like it so much that I've installed the Tor Browser Bundle by default in Bauer-Puntu Linux so you can surf the Interwebs in peace without fear of government snooping, the way the internet was originally intended.

Well a new piece of malware has been discovered that takes advantage of a vulnerability in Firfox that will allow the FBI to track your online activity while using the Tor network.

From Wired:

Security researchers tonight are poring over a piece of malicious software that takes advantage of a Firefox security vulnerability to identify some users of the privacy-protecting Tor anonymity network.

The malware showed up Sunday morning on multiple websites hosted by the anonymous hosting company Freedom Hosting. That would normally be considered a blatantly criminal “drive-by” hack attack, but nobody’s calling in the FBI this time. The FBI is the prime suspect.

“It just sends identifying information to some IP in Reston, Virginia,” says reverse-engineer Vlad Tsyrklevich. “It’s pretty clear that it’s FBI or it’s some other law enforcement agency that’s U.S.-based.”

If Tsrklevich and other researchers are right, the code is likely the first sample captured in the wild of the FBI’s “computer and internet protocol address verifier,” or CIPAV, the law enforcement spyware first reported by WIRED in 2007.

Court documents and FBI files released under the FOIA have described the CIPAV as software the FBI can deliver through a browser exploit to gather information from the target’s machine and send it to an FBI server in Virginia. The FBI has been using the CIPAV since 2002 against hackers, online sexual predators, extortionists, and others, primarily to identify suspects who are disguising their location using proxy servers or anonymity services, like Tor.

It would appear that even Tor might not be safe these days. As far as we know though, PGP is still secure, so make sure to keep using PGP for email and IM encryption.

What do you think about this? Scary or what? Let us know your take in the comments.

Read more »

Windows Update Fails On A Windows 2008 R2 Server With Error 8024A006

I was trying to run updates on one of my companies internal servers the other day, but it kept failing with error # 8024A006. None of my other servers were having that issue, so i did some StartPaging around and found a fix.

• Open services.msc, right click on Windows Update and select Stop
• Browse to c:\windows\ and rename the SoftwareDistribution directory to SoftwareDistribution_OLD
• Open services.msc, righ click on Windows Update and select Start

After that I was able to check for updates without an issue.

[Via KOTD]

Read more »

Where The F*(K Can I Find 3Ware Drivers For XenServer?

The other night I was running a rolling upgrade of my XenServers from 5.6 SP2 to 6.2. Everything was going swimmingly until I got to the last server in my resource pool which happens to be using a 3Ware 9750-4i RAID controller card.

Well the upgrade for that one failed miserably, and I pretty much had to force remove that host from the resource pool and re-install using the XenServer 6.2 disk. The reason it failed was the 3Ware driver for 5.6 is not compatible for 6.2

Awesome right? So I went to the 3Ware site, and searched around for XenServer drivers. No luck. I couldn't remember where I got the 5.6 drivers, so I started Googling around, and after about an hour I landed on 3Ware's stupidly named support site called mycusthelp.info. (Way to do SEO LSI/3Ware!)

So anyway, if you are looking for 3Ware drivers for XenServer you can get them at the following link, by doing a search for XenServer (3Ware Drivers For XenServer)

Read more »