Sheepdog Loses Flock: A day in the life of WordPress Website Management.

Posted on December 9, 2019 by Jon Lybrook

I recently solved a persistent database error. As a manager of a lot of different kinds of websites, WordPress seems to be at the heart of the classic, open-source computing environment dilemma: Users have limitless flexibility to install plug-ins or build and modify code of their own. As a result, users have been conditioned to try to install plugins as a solution to every problem. This can cause software conflicts and memory errors.

Out of the box, WordPress security is responsible in their deployment of the core program. You have to intentionally do something to cause a vulnerability. Web security is one of the hats we wear, which involves a pro-active hardening of the webserver environment to protect against comment exploits. Typically we don’t rely on alot of plugins for security, but do it at the webserver and server levels, a couple step deeper than WordPress-based security allows. Plugins can be very helpful to solve or prevent alot of problems, it is true.

Hardening WordPress Security

So, why was one of our dedicated WordPress virtual hosts going offline intermittently in the middle of the night? This particular host only runs about 10 active WordPress sites, and this error in the logs was reporting the database going offline due to a memory error. Hm…

[client 67.213.118.245:55038] WordPress database error Out of memory (Needed 57148 bytes) for query SELECT wp_comments.* FROM wp_comments WHERE comment_ID IN (38571,38572,38574,38576,38577,38578,38579,38580,38583,38588,38590,38591,38593,38597,38598,38600,38601,38602,38603,38608,38609,38610,38612,38615,38617,38618,38620,38621,38623,38625,38627,38628,38630,38631,38633,38635,38636,38639,38640,38642,38643,38644,38645,38646,38647,38649,38652,38653,38658,38660,38661,38663,38667,38668,38669,38673,38677,38681,38682,38689,38690,38691,38692,38693,38696,38697,38698,38701,38703,38704,38705,38708,38709,38711,38712,38713,38714,38716,38717,38720,38721,38722,38723,38724,38726,38728,38729,38730,38733,38734,38736,38738,38741,38742,38743,38744,38745,38747,38749,38752,38754,38756,38757,38758,38761,38762,38763,38764,38766,38767,38768,38769,38770,38771,38772,38773,38774,38775,38777,38778,38779,38780,38783,38785,38786,38787,38788,38791,38794,38796,38797,38799,38802,38803,38805,38807,38808,38810,38812,38815,38818,38824,38826,38828,38829,38831,38833,38834,38836,38838,38841,38842,38843,38844,38845,38848,38849,38851,38852,38853,38855,38856,38857,38860,38861,38864,38865,38867,38868,38869,38872,38877,38878,38879,38880,38881,38882,38883,38885,38886,38889,38890,38891,38894,38896,38898,38900,38903,38905,38910,38911,38912,38913,38914,38915,38917,38918,38921,38922,38923,38924,38925,38926,38928,38929,38930,38931,38932,38933,38934,38935,38937,38938,38941,38942,38947,38949,38950,38951,38952,38953,38955,38957,38958,38960,38962,38963,38965,38966,38968,38970,38971,38972,38973,38974,38976,38977,38978,38980,38982,38983,38984,38986,38987,38992,38993,38994,38996,38997,38998,38999,39000,39001,39002,39003,39004,39007,39009,39011,39013,39017,39018,39020,39022,39023,39024,39026,39027,39028,39030,39031,39033,39037,39039,39040,39041,39042,39043,39044,39045,39046,39049,39050,39052,39055,39057,39058,39059,39061,39062,39063,39065,39066,39067,39069,39072,39076,39077,39079,39082,39084,39086,39087,39088,39093,39096,39097,39100,39105,39106,39107,39110,39111,39113,39114,39121,39122,39123,39124,39129,39130,39133,39136,39138,39139,39140,39143,39145,39150,39151,39154,39155,39156,39162,39166,39167,39170,39172,39175,39176,39181,39184,39185,39186,39190,39193,39195,39198,39199,39202,39208,39209,39211,39213,39217,39220,39223,39226,39228,39229,39232,39234,39238,39242,39244,39250,39251,39252,39254,39256,39265,39266,39267,39268,39269,39271,39273,39274,39278,39279,39281,39283,39285,39286,39287,39288,39290,39292,39294,39296,39297,39299,39300,39301,39302,39305,39306,39307,39309,39310,39312,39314,39315,39317,39318,39320,39321,39324,39326,39327,39328,39329,39330,39331,39332,39334,39336,39337,39339,39340,39341,39342,39343,39344,39345,39347,39348,39349,39350,39351,39352,39355,39356,39359,39360,39361,39362,39363,39364,39365,39366,39368,39369,39370,39371,39372,39374,39376,39377,39378,39379,39380,39381,39382,39383,39384,39385,39388,39389,39390,39391,39392,39393,39394,39395,39396,39397,39398,39399,39400,39401,39402,39403,39405,39407,39409,39410,39411,39412,39413,39414,39415,39416,39417,39419,39420,39422,39423,39424,39425,39426,39427,39428,39429,39430,39431,39433,39434,39435,39437,39438,39439,39441,39442,39443,39444,39445,39446,39447,39448,39449,39450,39451,39452,39453,39454,39457,39458,39459,39460,39461,39462,39463,39464,39465,39466,39469,39470,39471,39473,39475,39476,39477,39478,39479,39484,39485,39487,39489,39490,39491,39492,39493,39494,39495,39497,39499,39500,39502,39503,39504,39506,39507,39508,39509,39511,39512,39515,39519,39521,39523,39524,39525,39527,39528,39529,39530,39531,39533,39534,39536,39538,39539,39540,39541,39542,39543,39545,39548,39549,39550,39551,39552,39554,39555,39560,39561,39562,39563,39566,39567,39568,39569,39571,39572,39573,39574,39576,39577,39578,39580,39582,39584,39586,39589,39590,39593,39595,39596,39601,39602,39605,39609,39612,39613,39615,39616,39619,39623,39628,39629,39632,39634,39637,39638,39641,39644,39647,39648,39651,39654,39656,39657,39658,39662,39665,39666,39667,39669,39670,39671,39673,39674,39678,39679,39680,39683,39684,39685,39686,39687,39688,39689,39692,39693,39696,39697,39698,39699,39700,39701,39702,39703,39705,39706,39707,39708,39712,39713,39714,39715,39716,39717,39718,39720,39721,39722,39723,39724,39725,39726,39727,39729,39730,39731,39733,39734,39735,39736,39738,39739,39740,39742,39744,39745,39746,39747,39748,39749,39750,39754,39755,39756,39757,39758,39759,39760,39761,39763,39764,39767,39768,39769,39771,39772,39773,39774,39775,39776,39777,39778,39780,39782,39783,39784,39785,39786,39787,39788,39789,39790,39791,39792,39795,39796,39797,39799,39801,39802,39803,39805,39808,39810,39812,39813,39817,39820,39823,39824,39826,39828,39829,39830,39831,39838,39839,39840,39841,39843,39845,39848,39849,39852,39853,39855,39856,39857,39858,39860,39862,39870,39875,39876,39881,39883,39888,39893,39894,39895,39897,39901,39902,39908,39910,39912,39913,39915,39923,39928,39931,39932,39935,39938,39944,39949,39953,39955,39959,39962,39963,39969,39974,39976,39980,39984,39985,39989,39990,39998,40000,40001,40004,40005,40006,40014,40015,40020,40027,40030,40031,40032,40033,40037,40040,40041,40043,40045,40052,40053,40054,40059,40061,40064,40066,40071,40073,40075,40077,40078,40085,40087,40091,40097,40098,40100,40101,40103,40110,40112,40114,40117,40119,40123,40125,40126,40128,40131,40133,40134,40137,40141,40142,40146,40148,40150,40151,40153,40154,40155,40157,40158,40162,40163,40166,40168,40173,40174,40175,40180,40181,40182,40183,40187,40188,40192,40194,40198,40200,40202,40205,40208,40212,40216,40217,40225,40229,40232,40236,40237,40239,40242,40245,40247,40253,40255,40258,40263,40264,40268,40270,40272,40275,40280,40282,40284,40289,40296,40297,40298,40301,40306,40311,40316,40322,40328,40333,40351,40352,40357,40358,40360,40361,40368,40371,40372,40373,40374,40376,40382,40383,40385,40386,40390,40391,40393,40395,40396,40398,40404,40405,40408,40409,40410,40419,40421,40424,40426,40427,40428,40436,40437,40442,40443,40446,40447,40448,40456,40458,40460,40462,40466,40470,40471,40477,40478,40481,40482,40484,40490,40491,40492,40494,40495,40498,40502,40505,40511,40512,40515,40520,40521,40522,40523,40525,40526,40527,40528,40531,40534,40535,40538,40540,40541,40542,40545,40546,40547,40548,40549,40551,40552,40555,40558,40559,40562,40563,40564,40568,40569,40570,40571,40572,40573,40574,40576,40577,40580,40581,40582,40583,40587,40588,40594,40597,40600,40601,40603,40609,40612,40613,40614,40617,40620,40624,40625,40626,40629,40635,40637,40639,40642,40644,40649,40650,40651,40652,40659,40662,40664,40665,40666,40670,40675,40676,40677,40680,40683,40688,40694,40695,40696,40700,40701,40708,40709,40710,40712,40713,40720,40722,40723,40726,40727,40728,40732,40734,40735,40740,40741,40742,40743,40745,40748,40749,40750,40755,40756,40757,40759,40763,40764,40766,40768,40770,40772,40774,40777,40779,40780,40784,40787,40788,40790,40791,40795,40799,40800,40801,40803,40804,40811,40812,40814,40815,40816,40820,40822,40828,40829,40830,40832,40838,40839,40840,40841,40843,40848,40853,40855,40858,40862,40864,40865,40866,40870,40872,40873,40876,40878,40881,40882,40885,40886,40893,40894,40896,40897,40899,40901,40902,40903,40909,40914,40916,40919,40920,40925,40932,40934,40935,40937,40942,40946,40948,40949,40955,40959,40961,40962,40964,40970,40971,40972,40977,40981,40982,40988,40991,40994,40997,41003,41004,41005,41011,41015,41017,41018,41022,41026,41030,41031,41035,41038,41039,41040,41042,41043,41046,41048,41049,41050,41051,41053,41054,41056,41058,41059,41060,41061,41062,41063,41064,41066,41067,41069,41070,41072,41074,41075,41076,41078,41079,41080,41082,41088,41089,41090,41091,41093,41094,41096,41099,41101,41102,41104,41105,41107,41109,41110,41112,41116,41119,41122,41123,41124,41125,41126,41132,41136,41138,41139,41140,41145,41146,41150,41151,41153,41154,41155,41159,41160,41161,41162,41163,41164,41169,41174,41175,41177,41179,41181,41182,41183,41186,41187,41194,41197,41199,41200,41202,41203,41204,41212,41213,41214,41215,41218,41221,41222,41224,41225,41228,41229,41232,41233,41236,41243,41244,41245,41246,41247,41251,41254,41256,41258,41259,41260,41261,41264,41266,41267,41269,41271,41272,41278,41282,41283,41286,41289,41

So the first question was, is this a cron job or plugin causing this problem, or a brute force attack? Or both? Given that these same debilitating errors were coming from many different ip ranges over the course of several weeks according to the logs, my guess was no. A Denial of Service attack?

First we needed to know which website the deadly query was being run against. For that I searched all the access logs for the IPs that triggered the query resulting in the database failure. To reiterate, we run many different kinds of WordPress sites, some with thousands of active customers and users. Surely the issue was from one of the most busy sites we run?

I was shocked to find the problem was coming from one of our least-busy WordPress websites — my own, somewhat inactive blog. The one you’re now reading!

Apparently I had set another one of my articles (about WordPress in fact) to allow for comments, as an experiment, and promptly forgot about it…for three years. Spammers had patiently flooded the comments for that article over the course of three years with over 111,000 comments. Eventually the size of the queries due to the number of comments overwhelmed the database, causing it to shut down with the out of memory error above, resulting in all the WordPress websites on that virtual host to be inaccessible until the database was restarted.

We have 24/7 monitoring in place to alert us whenever a system goes offline, so it was never offline for very long. It was annoying however, and preventable. Discovering the problem and the solution to these kinds of complex problems is what keeps us in business, but often the solution is quite simple. We locked down commenting on the article, deleted all the comments, upgraded the platform, plugins and removed any that weren’t in active use. Every customer on the virtual host should see an improvement in speed of their own websites as a result of the responsive work of our system administration team!

Posted in Managed Dedicated Server Hosting, Managed WordPress Hosting, open source, SPAM Prevention | Comments Off on Sheepdog Loses Flock: A day in the life of WordPress Website Management.

How do I Encrypt my Email?

Posted on April 3, 2016 by Jon Lybrook

A more astute question is why encrypt email at all?  In this day and age of FBI cracking iPhones and other government agencies bullying large data and global/mobile  communication providers such as Apple, Google and Microsoft, to name just a few. These cloud companies, and thousands like them, that rolled over for years providing meta data from phone records of private citizens and businesses until Libertarian supporter Edward Snowden broke the news to the world in 2013 that the CIA had been collecting, storing and disseminating these personal phone records pretty much at will. No one except for librarians, to whom we owe a debt of gratitude, seemed to have any understanding of data privacy until the Snowden scandal broke.

Jon-Lybrook-Cloudscape_no_1-web

The reason to continue to encrypt your email and data is because security is a process, not an end-game destination — though not having conventional security in place can mean end-game for your business reputation.  Securing your data privately, knowing all copies are contained, and not trusting the ambiguity of “the cloud” when you ask your provider where your data is really kept? Email encryption is not all it takes to ensure basic web and email security.

Staying out of any service with a storage solution simply described as “in the cloud” is difficult now. So much emphasis on public and private data clouds such as AWS, E2C, Google Drive, iCloud, etc, is becoming the only alternative. Just as Edward Snowden was one of tens of thousands of contractors with access to National Security data, what’s to ensure that one of the thousands of system admins at any of these cloud providers isn’t doing the same thing with your customer lists and competitive intelligence. How much can your really afford to trust “the cloud” anymore? Most of these huge providers have very little control or oversight of their system administrators who are usually instructed to do “whatever it takes” to keep the boss upstairs and clueless where he belongs, and the government snoops fat, happy with access to all your data, and out of his thinning hair.

android_fail

So here’s the good news: The options for securing your email are greater than ever. I still like this thread from the venerable “Ask Leo” website, which still provides the clearest example of one’s options to secure traditional email properly:

http://ask-leo.com/how_do_i_send_encrypted_email.html

As the article indicates, setting up proper security on the client side on multiple computers is often necessary to ensure everything is remaining encrypted between a sender and recipient. This can be alot to expect, especially if the person you are trying to exchange messages and documents with is not computer savvy.  Social workers and therapists are able to keep secure communications private when emailing with family members and clients with a web-based, point-to-point encryption solution. While many good secure messaging solutions exist, only WordSecure Messaging offers a server-based solution not in the cloud. It is also able to be fitted with your logo and personal login for you and your customers.

Mobile based secure texting is always hard to trust since we all know what happens on mobile devices — you take a screen grab of whatever is of interest, and back on the internet it goes!  The FBI, one of the worst agencies at computer science, was still able to crack the iPhone in under a few months, since the San Bernadino shootings in 2015. If the FBI can crack the most popular and encrypted phone on the planet so quickly, it is clear all mobile devices are a liability to security. Yet , you have to communicate, so, this is why server-based technologies are what we focus on in our business, and have since 2002. You can update most of the vital email security at once and not wait for users to update their systems to take advantage of security patches and enhancements.

Remember that whatever device or program you use to communicate with someone, ensure that it is appropriate for the kind of information being sent. Protected Health Information (PHI), for example, is any kind of electronic or written information pertaining to a person’s health, conditions, diseases, and medications. Even communicating that someone has an appointment with an oncologist could be considered a breach of PHI, which is punishable in civil and criminal prosecution of both companies and individuals!  This means employees could get sued personally for knowingly sharing PHI with unauthorized entities. Health information as well as financial data, passwords, and other types of Personally Identifying Information (PII) are best kept protected, encrypted and out of the cloud, whenever possible.

Jon Lybrook

“Keep where you keep your data protected and encrypted!” — Jon Lybrook – Tera Bear Consulting

 

 

 

Posted in Application Hosting, Secure Server Email | Comments Off on How do I Encrypt my Email?

FreeBSD vs. Linux

Posted on March 16, 2016 by Jon Lybrook

linux-bsd-644x250

On the surface, the GNU/Linux project and FreeBSD are both considered “open source” software which implies “free” to use.  In fact there is a lesser-known clause in the Gnu GPL that might be of interest to entrepreneurs and developers:

“Linux is available under the GNU General Public License (GPL), which is designed to eliminate closed source software. In particular, any derivative work of a product released under the GPL must also be supplied with source code if requested. By contrast, the BSD license is less restrictive: binary-only distributions are allowed. This is particularly attractive for embedded applications.”

This technically means if you use any GPL code, you may be asked to give up your own source code to your own work that integrates a GPL project, if requested.  This provides a clear legal, business reason for choosing FreeBSD over a generic flavor of Linux.

For more specifics on the differences between GNU/Linux and FreeBSD, check out the following links:

https://www.freebsd.org/doc/en/articles/explaining-bsd/comparing-bsd-and-linux.html

https://www.reddit.com/r/sysadmin/comments/3odphp/why_do_you_love_freebsd/

Posted in PHP Web Development | Comments Off on FreeBSD vs. Linux

Updating pkg FreeBSD 10.1

Posted on April 13, 2015 by Jon Lybrook

So, if you’re installing or upgrading to the current FreeBSD OS 10.1-RELEASE branch, you’ve probably heard…

The new preferred way to install open source packages is with the new package management tool, simply named ‘pkg’.  From the man page:

pkg provides an interface for manipulating packages: registering, adding, removing and upgrading packages.

Once you’ve got an account on a new FreeBSD system version 10.0 or later you’ll be able to ‘man pkg’ and see all the nifty options.  It was available before, but not necessarily installed by default as with version 10.0 and later (depending on which FreeBSD Branch you’re following:  Current (bleedy-edge development), Stable (kind of tested) or Release (mostly tested)) To me, the name Stable sounds like it’s production-worthy.  Not the case.  For the best tested and essentially, most reliable version of the OS out to date, conventional wisdom advises installing the Engineering Release Branch of FreeBSD).

To see which branch you’re running issue the command:

 uname -a

and you should see output something to the equivalent of:

10.1-RELEASE-p9 FreeBSD 10.1-RELEASE-p9 #0: Tue Apr  7 01:07:33 UTC 2015     root@amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC  i386

One of the key differences in moving from FreeBSD 9 to FreeBSD 10 is the new command and syntax to install and deinstall programs.  It is simple from a user’s perspective.  For example, from your shell of choice doing:

pkg install perl5-5.18

Will install Perl version 5.18.  Similarly:

pkg delete perl5-5.18

…will delete it!  To see all versions of Perl you have available to install do:

pkg search perl

Upgrading a package is just as easy:

pkg upgrade perl

should do the trick.

To update ALL packages that can be updated:

pkg upgrade

If installing via ‘pkg’ doesn’t work for some reason and it bombs, you can resort to installing via the ports directories using ‘make’, e.g.

cd /usr/ports/lang/perl5.18
make config
make clean install

Don’t worry about pkg losing track of whether you used it or the method above to get less-versatile packages installed.  pkg tracks your installations, deinstallations and dependencies faithfully, whether you are employing the pkg command or using the more traditional ‘make’ method shown above.

Finally, there’s a recommended standard everyone at the FreeBSD project seems to agree on.  Before pkg FreeBSD was something of a quagmire of mixed messages as far as ports and package management.

The addition of increasingly reliable ports management systems like pkg is one of the many reasons Tera Bear Consulting relies heavily on the FreeBSD UNIX operating system with confidence.  It’s proven the test of time for us in the critical areas of reliability, scalability, and rock-solid, online security.

Powered by FreeBSD

Upgrading to FreeBSD 10.1 is a snap with the pkg package manger!

Posted in Application Hosting, FreeBSD, FreeBSD System Administration, Managed Dedicated Server Hosting, open source, Perl Development | Tagged , , , | Comments Off on Updating pkg FreeBSD 10.1

Package Update Purgatory on FreeBSD

Posted on December 31, 2013 by Jon Lybrook

Typically upgrades to a FreeBSD UNIX system are a breeze.  Packages are automatically checked for security updates that are emailed, letting you know they are available.  Occasionally things get messy however. and work-arounds must be employed.

There are a number of different package managers, and once you find one you like, you really want to stick with it.  At Tera Bear Consulting we use portmaster.

Recently I had an issue with an update to subversion where it wouldn’t get upgraded using our friend portmaster, however.  I tried, but it wouldn’t budge giving me the error:

>make: cannot open Makefile.

Yuck.  I tried uninstalling and installing the latest version with still no luck.  I tried what was suggested in /usr/ports/UPDATING which sometimes is key, but not in this case.  The package upgrade went smoothly on other systems so I knew there was nothing wrong with the update.  It had to be this system.  normally I use cd to the ports directory where the package lives and do make deinstall.  However, since the port had been deprecated it wouldn’t remove itself.  What finally worked in this case was:

 pkg_info | grep subversion

>subversion-x.x.x    Version control system

Where x.x.x is the version currently installed. pkg_info confirmed it was still installed and which version. To remove it, I did:

 pkg_delete subversion-x.x.x

With that gone I was still unable to install from the ports tree getting the same error about the Makefile above.  So I used the package installer:

 pkg_add -r subversion

This installed an earlier version of subversion than desired, but from here I was able to do:

portmaster subversion

which upgraded the system without a hitch.  No version is required when using portmaster.  It knows.  Now to verify:

pkg_info | grep subversion
>subversion-y.y.y    Version control system

Viola.  We’re up to date, and consistent.

 

Posted in FreeBSD System Administration, portmaster, UNIX | Comments Off on Package Update Purgatory on FreeBSD

Fixing Problem with Postgrey 1.34_7 under FreeBSD 9.2

Posted on November 30, 2013 by Jon Lybrook

Most of the time FreeBSD documentation is complete and more than anyone could ask for.  With the release of Postgrey 1.34_7 this was not the case.  I’ve been running some form of greylisting on my mail servers for almost a decade now, and while fast and simple in what greylisting does, there is virtually no error handling built into it.  While commendable that the maintainers have opted to move the startup script into a more conventional framework, the manual changes required to get this program to run were mostly undocumented and led to hours of trial and error and searching the internet for a solution.  Hoping this post will help some sysadmin somewhere until the problem is addressed by the FreeBSD package maintainers.

20130525:
AFFECTS: users of mail/postgrey

The RC script for postgrey has been modified. If you use the  default value for postgrey_flags this does not affect you.

If you have postgrey listening on a Unix socket or set any optional  values, please read the comments in the RC scripts and check your settings in rc.conf prior to restarting postgrey.

 

I’ve been using the same procedure for several years and I use the default values, or so I thought.  No matter what I tried, postgrey would fail to start with various warnings but no direct clue as to what was wrong:

> service postgrey start
> Starting postgrey.
> Pid_file “/var/run/postgrey.pid” already exists.  Overwriting!

Checking the processes with ps -waux |grep postgrey made it clear nothing was running in spite of the message above.

Reading the comments in the new startup script in /usr/local/etc/rc.d/postgrey made it pretty clear what needed to happen:

# Add the following lines to /etc/rc.conf to enable postgrey:

# postgrey_enable (bool)        Set to ‘YES’ to enable
#                              Default: NO
# postgrey_dbdir (path)         Location of postgrey database files.
#                               Default: /var/db/postgrey
# postgrey_flags (extra args)   Additional command-line parameters.
#                               Default: –inet=10023

The value command_args in the postgrey startup script contained values which seemed redundant to what was already in postgrey_flags in /etc/rc.conf.  Indeed, adding these values to postgrey_flags /etc/rc.conf caused duplicate parameters to appear in the process.  The startup script would fail for want of params in the rc.conf, but adding them to rc.conf caused redundancies.

>ps -waux |grep postgrey

>postgrey  9278  0.5  0.3  22088  11204 ??  SsJ  12:05PM 0:00.02 /usr/local/sbin/postgrey –pidfile=/var/run/postgrey.pid –inet=127.0.0.1:10023 -d –x-greylist-header=X-Greylist: delayed %t seconds by postgrey-%v at %h; %d -d –pidfile= –dbdir=/var/db/postgrey.pid

The solution was to add all the parameters to rc.conf and comment them out of the startup script like so:

Add to /etc/rc.conf so postgrey will run:

postgrey_enable=”YES”
postgrey_greylist_header=${postgrey_greylist_header:-“X-Greylist: delayed %t seconds by postgrey-%v at %h\; %d”}
postgrey_pidfile=”/var/run/postgrey.pid”
postgrey_flags=”–pidfile=${postgrey_pidfile} –inet=127.0.0.1:10023 -d  –x-greylist-header=${postgrey_greylist_header}”

Comment out the following lines in /usr/local/etc/rc.d/postgrey to prevent redundancies:

#pidfile=/var/run/postgrey.pid
required_dirs=${postgrey_dbdir}
#command_args=”-d –pidfile=${pidfile} –dbdir=${postgrey_dbdir}”
stop_postcmd=”rm -f ${pidfile}”
run_rc_command “$1”

Bingo.  Finally a running postgrey process!

postgrey  9278  0.5  0.3  22088  11204 ??  SsJ  12:05PM 0:00.02 /usr/local/sbin/postgrey –pidfile=/var/run/postgrey.pid –inet=127.0.0.1:10023 -d –x-greylist-header=X-Greylist: delayed %t seconds by postgrey-%v at %h; %d -d –pidfile= –dbdir=/var/db/po

Posted in FreeBSD, Greylisting, Postfix, Postgrey, UNIX | Comments Off on Fixing Problem with Postgrey 1.34_7 under FreeBSD 9.2

Backups, Backups, Backups

Posted on November 29, 2013 by Jon Lybrook

One of my first jobs in the computer industry in the mid-90s was that of a Computer Operator. Now it sounds like a funny job title since, after all, who doesn’t operate a computer nowadays? It was, and still is, a specific role in a large production environment where mainframe computer systems and industrial-grade computers are still in use.

As a Computer Operator for the Geological Society of America, I would have to know how to process and retrieve data from files and databases in a variety of media, including 9-track tape devices, the kind you see in 1950’s science fiction movies and old IBM documentaries depicting computers.

There I learned the three most important jobs of computer operations which are, in order of importance:

Backups, backups, and backups.

Like most things boring and mundane — exercise, doing yard work, and taking vitamins, to name a few — performing regular backups at least weekly, and as important, verifying the backups, can keep you out of trouble.  You don’t need to be a company as big as Google to see the necessity of this task.  Human error and data corruption happen all the time and while the time spent rebuilding a computer system is not trivial, it is fixable.  Your precious data such as photos, documents, and scans, on the other hand, may not be recoverable without good backups.  The best way to ensure that data is available in the event of a catastrophe is to have a whole copy of it.

One theory behind “Cloud Computing” is that multiple copies of your data exist in various locations at once and are continuously being updated.  While this sounds cool in theory, the reality is copying data like that is not only less secure, making more copies vulnerable to hackers, but there is strong likelihood your data will fall out of sync at some point. I wouldn’t rely on any single technology any more than I’d rely on any single individual or entity when it comes to backups.

There is the old chestnut story about the backup operator who was diligently making the same backup on the same backup tape week after week.  The data had been deleted by someone two weeks prior.  So, of course having a backup from one week ago didn’t help.

Ideally you will do a complete backup of your critical files at least once a week and rotate them out to one or more offsite locations every week. Having four different drives is not uncommon, as well has keeping an annual or semi-annual backup just to be safe.  External USB drives are ideal for this backup method. Once you establish a system test it periodically and always check the log files to ensure what you think happened actually did happen.

“Mission critical” computer systems are often built on a RAID system.  RAID stands for “Redundant Array of Inexpensive Disks” (depending on who you talk to).  This means your data and/or operating system is spanned across two or more disks so that if one hard disk fails, the others are able to continue to work to access the data.  This is a type of fault tolerance to ensure systems stay running and data remains available, but it is no substitute for having data backups.

We had at one point a web system that was running a RAID supporting both the OS and the data, but when one of the hard disks became corrupted it simply populated that corruption to the rest of the system.  Luckily the system was able to limp along while we rebuilt a new system from scratch and transferred the good data over to it from backups. The system was up and running at full capacity again in a matter of hours.

Like most teenagers supposedly don’t learn respect for the destructive power of an automobile until they impact something, so most computer users don’t respect the power of having backups on hand until there’s a problem and their data is lost.  They are too busy and important to be bothered. Magical thinking. Don’t be that guy.

Also, don’t rely on anyone else to have backups of your data.  Your IT person or webhost may promise they are backing up your data, but if something goes wrong and they didn’t do it, excuses will matter little.  You having access to your website and computer data at-the-ready is really the only solution.  As the aphorism goes, “If you want something done right, you’ve got to do it yourself!”.

And always remember the three most important things in computer operations:  Backups, backups, and backups.

Posted in backups, Google, Uncategorized | Comments Off on Backups, Backups, Backups

Google / Verizon Creates Email Problems on Android OS 4.3

Posted on September 24, 2013 by Jon Lybrook

Android Emali ProblemsA client visited me the other day at my request.  He had gotten a brand new Android phone from Verizon, running the latest OS 4.3, and could not connect to one of my company’s secure email servers using it.  I thought that was strange considering my wife had only recently gotten rid of her Android but had been able to connect for years. I wanted to see for myself what was going on.

The client had called Verizon tech support three times earlier in the week.  One person told him that only Gmail and AOL accounts could connect through the Android, but yet they banged their head against the wall with him nonetheless, trying in vain to get it to work as it should. Surely Gmail and AOL weren’t the only email services available on the Android?  I mean, it’s open-source software run by the “don’t be evil” guys… Right?

The Secure POP3 settings, ports, server name, username, and password were all correct.  Yet the error message persisted:  “Error connecting”.  We tried manual  and auto-detect.  Invariably the android software tried to make up names of the mail server that didn’t exist, such as pop.myserver.com and the like.  I’d change the settings, and Android would put them back to the incorrect settings again while I chased my tail, just as my client had been doing for weeks.

I double-checked all the settings and even looked at the mail logs to see the device, in fact, wasn’t even connecting to the server.  We rebooted the phone.  These email problems on Android 4.3 persisted.  We Googled it.  Nothing was documented that I could find about Androids not being able to connect to standard POP3 mail servers.

Finally I decided to jump ship and have him install a 3rd Party mail client for Android called K-9.  In less than a minute he was connecting to the server, checking and sending mail.

What gives?  Could it be that Google and/or Verizon has made it so no servers other than the one’s they decree can use the default mail client on Android?  Sure seems that way.  It’s not enough that both have the lions share of their respective businesses worldwide.  Apparently they also need to sweeten their share even more by frustrating end-users and ultimately causing the majority of them who have no interest in troubleshooting these kinds of email problems to throw their hands up in the air and resort to only using Gmail.

More and more it appears Google and/or Verizon are blatantly turning to the sleazy side of the force, protecting their market share at the expense of end-users’ acquiring brain damage trying to make things work as they have in the past.  This is almost identical to how Microsoft behaved back in the 90s out of fear of the competing browser Netscape – breaking things so users relent and only use their product.

One shouldn’t have to bail on the default mail client of any OS just to get it to work.  Yet that was the solution in the case of Google Android.  Hoping this saves someone time.

A5DDNE34M8ZA

 

Posted in Google, Uncategorized | Comments Off on Google / Verizon Creates Email Problems on Android OS 4.3

Why does a Web Developer Stoop to Using WordPress?

Posted on February 4, 2013 by Jon Lybrook

As a web developer, whenever saddled with a project – whether it’s for my own company or someone else’s, the first thing I try to do before writing a line of code is to write down all the requirements and search  the web to see if a premade, open source solution is available.

Open Source is a catch-all phrase which refers to any software where the underlying code is explicitly given to the world at large and not copywritten by the author, with the stipulation that while it can be modified and used in any way (commercial or not), it may not be modified then claimed to be owned by someone else. While there are often specific limitations in some licensing agreements for computer code that is considered open source, that’s the general idea.

So why would a web developer stoop to using WordPress? The reason I use WordPress, in addition to customized content management systems we’ve written at Tera Bear Consulting, is the same reason I don’t write my own database software and rely on MySQL — why spend time reinventing the wheel?  Granted, there are sometimes very good reasons to write a custom application such as when the requirements are very specific, or when there is proprietary information at stake that needs to be protected.  Oftentimes the security of open source software is also superior to that produced by freelance developers, many of whom are not security-focused in their approach.

I once had someone I knew talk smugly about people who used the Apache webserver and how he didn’t need to since Python allowed him to write his own so quickly and easily.  I didn’t care to get into a discussion with him about the fact that the Apache project has been in development for nearly 20 years and has more useful addon modules than Microsoft has parking spaces in Redmond, Washington.  I don’t get into debates about tools. Everything was written with a purpose, whether it was to do something new or do something better than the other guy.

We released Pro Artist Websites around the same time that WordPress was first released in 2003 with the aim of it being one of the first, truly flexible, easy-to-use website management tools.  While now it is not as functional as WordPress when it has all its extra addons properly installed, it also doesn’t break every time the main application is updated, unlike alot of 3rd party tools many WordPress users have come to rely on.

Pro Artist Websites also doesn’t stall out while waiting for an AJAX component to complete a connection since we’re using mostly server-side dependencies and not relying on the client’s browser to do the heavy lifting.  Writing code to be as server-side dependent as possible is the old-school approach that we’ve tried to adhere to when the requirements of the project allow for it because it is generally a more stable approach.

The more flexibility and features a given web application provides, the easier it is for one developer’s carelessness to break the site for thousands of users.  It’s the same reason we choose FreeBSD Unix over Linux, and why I shun the Google Android in favor of the Apple iPhone, but I’ll save those topics for another blog post.

Until then, aloha and happy surfing.

Posted in CMS Software, Custom Content Management Systems, Managed WordPress Hosting, open source, Software as a Service (SaaS), Uncategorized, WordPress | Tagged , , | Comments Off on Why does a Web Developer Stoop to Using WordPress?