-
Drupal Exploits – script to detect versions
We are currently seeing a high volume of Drupal exploits running a lot of arbitrary code, including crypto mining, attacking other servers and similar due to this exploit https://www.drupal.org/sa-core-2018-002 If you want to find out if you have any vulnerable Drupal installs quickly and easily i wrote a shell script for that . Just run…
-
32 to 64 bit distro crossgrades for Debian and Ubuntu
The demise of 32 bit distros is nigh! Some distros are dropping or reducing support for 32 bit versions. e.g. only providing 64 bit ISO downloads. Some software makers are no longer putting out 32 bit versions of their software. e.g. Since version 9 Oracle have only released a 64 bit version of Java. In…
-
Modernizing your ancient server distro
RimuHosting has now been providing VM servers for over 15 years. Back in the day the state of the art distros we setup for customers included 32-bit Debian 3- and Ubuntu 6-based servers. Things have moved on. By default all new orders are setup with 64-bit distros. And Debian is up to version 9, while…
-
Spectre and Meltdown article roundup
Our team is working on the best approach to secure our customers’ systems against the recently reported Spectre and Meltdown vulnerabilities. Our first step is to understand the problem and its mitigations. This post provides a roundup of discussions and work on the topic with a focus on mitigation for the Xen hypervisor. The vulnerabilities…
-
Virtualmin Changes binding from ip:80 to *:80 and breaks older configs … FIX
We have found some virtualmin installs will change the format of new virtualhosts from ip:80 to *:80 sometimes which breaks virtualhosts as the *:80 overrides the ip:80. This can result in websites showing another website content, and usually shows up right after you add a new domain in virtualmin.
-
Reboot-less Xen patching
Recently there have been two sets of Xen vulnerabilities. One being disclosed in September, the other earlier today. Historically we have had to organize host updates which required downtime to reboot VMs. For these last sets of vulnerabilities we have been able to use a recently introduced live patching feature in Xen to mitigate the…
-
Whitelist your own computer in fail2ban
Fail2ban is a great “dynamic” firewall for servers that is installed by default on many of our VPSs, and we can install it on your VPSs at your request. It protects against brute-force attacks, where an attacker is trying to guess a password or exploit certain classes of vulnerabilities on servers. One potential problem with…
-
Lets Encrypt with Virtualmin
Virtualmin now supports Let Encrypt, this means you can easily get multiple SSL certificates easily and free if needed. Here is how you can set that up. Step 1: Login to your virtualmin, select the domain from the drop down in the top left. Step 2: Click ‘Edit Virtual Server’ , under the ‘Enabled Features’…
-
ClamAV: mpool_malloc and disk space
ClamAV is an open source antivirus engine for detecting trojans, viruses, malware & other malicious threats. The most common use we see is to check emails for bad content. Some of our users have recently been seeing errors from “freshclam” processes that look like the below entry. These will occur quickly and will often cause…
-
Using Fail2ban on wordpress wp-login.php and xmlrpc.php
A fair few customer of ours use wordpress and occasionally notice that there are people hammering on a few URLs This can cause high load, slow websites and a number of issues, espoecuially when you have more than a single IP hammering away at that. The solution is simple, and it involves using fail2ban. Here…