-
Using Fail2ban on wordpress wp-login.php and xmlrpc.php
A fair few customer of ours use wordpress and occasionally notice that there are people hammering on a few URLs This can cause high load, slow websites and a number of issues, espoecuially when you have more than a single IP hammering away at that. The solution is simple, and it involves using fail2ban. Here…
-
How to get an A pass SSL rating for your SSL website
Everyone wants security, and its ideal that your SSL certificates are also secure. With this in mind, websites like SSLLabs have a testing tool that is used to grade the SSL certificate installed on your server. Often people get a low ranking when its fairly easy to get an A. I could make this post…
-
Monitor sites for exploits
We dislike dealing with exploited websites. A common cause is “the long forgotten outdated install from a web developer who left years ago. hoping works forever”. Public facing services need to be kept updated in order to remain secure, so script-kiddies can’t use your server for abuse, like selling dodgy medicinal products. One would always…
-
Keeping WordPress secure
According to Wikipedia, “WordPress is the most popular blogging system in use on the Web, at more than 60 million websites.” It’s also the most commonly installed blogging system on our customers’ servers, and we use it to run the blog you’re reading right now. One factor that has contributed to WordPress ‘s popularity is…
-
Debian Squeeze (6) ends support – time to upgrade
February 29th, 2016 marks the end of LTS Support for Debian Squeeze, which is still used by many of our customers. This means that updates for known security issues will no longer be produced and over time, a server running this version will become vulnerable to being exploited. Squeeze was released in 2011 and was…
-
Restoring an Exploited WordPress files
I previously had a 10 step process to replace all the files in a wordpress, this got rid of most file based exploits. Since then i have written a shell script that pretty much incorperates that wget http://blog.rimuhosting.com/files/restorewordpress.sh chmod +x restorewordpress.sh ./restorewordpress.sh /full/path/to/documentroot Note: This does not do custom themes or plugins (only ones from…
-
Letting 3rd parties update credit card details
Some of our customers pay for their servers using a 3rd party’s credit card (their boss’, partner’s or a generous friend’s). Every now and then those details need to get updated (new CC expiry dates, or a replacement card). You can now let 3rd parties set their credit card details on our site without…
-
Brute force SSH protection
We have implemented some brute force SSH attack protection on VMs. Your servers should start to receive fewer connections from bots trying to bruteforce crack passwords on your server user accounts. Behind the scenes we have setup honey trap servers. Botnets with no good reason to connect to these servers attempt to connect to the…
-
deghost ridding the world of the ghost vulnerability one host at a time
As part of our mission to wipe the ‘ghost’ vulnerability (CVE-2015-0235) from our customers servers we have created ‘deghost’. Deghost is a cross-distro script to determine the vulnerability of a libc library on a server and then patch that where possible. https://github.com/pbkwee/distrorejuve In most cases this is as simple as apt-get install libc6 or yum…
-
Replace webmin self-signed certificate to avoid sec_error_invalid_key error
Recent browser versions (e.g. Firefox 33) refuse to work with older Webmin installs. They give a sec_error_invalid_key error, offer a ‘Try again’ button, but do not offer an option to add an exception. Firefox 33 no longer supports certificates with private keys smaller than 1024 bits. You can replace your webmin certificate with a new…