Tagged - website

Properly Securing Your Website

Wednesday, January 21st, 2009

lock_down_computerOwn a website? Ever think about security? If not, well you’re asking for trouble.

These are the best things you can do to secure your website properly

  • Use random generated passwords 32-64 characters in length.
  • Research your particular software and/or plugins for vulnerabilities at all times by visiting milw0rm and packetstorm on a regular basis.
  • Optionally, you may want to install some kind of spam filter if possible on your software.

Own your server? You’ll probably want to do this as well, on top of the list above.

  • Do periodic software updates on your server, change the ports that certain services run on, such as FTP and SSH since these are common targets.
  • Disable root login.
  • Set ServerTokens to “Prod” in Apache.
  • Run software that automatically bans an IP after a certain amount of failed login attempts.
  • Again, for all passwords on the server use 32-64 char random generated passwords, including the host control panel if you have one.

Just searching around reveals to me that there are far too many insecure websites out there, that could easily enough become fairly secure by following at least some of these methods. You can never be too secure, there are new vulnerabilities found every day, and there is no shortage of malicious users out there ready to deface your website or gain root login to your server for the fun of it. There are many more tactics out there for security, but these are some of the better tactics that will deter most people. Be careful out there.

Thanks go out to nukeit.org

Why bother with shared hosting?

Friday, January 2nd, 2009

revolution

Diving in deeper now. I’ve found that there are some VERY cheap VPS options, JUST AS CHEAP AS SHARED HOSTING! Soon I will be moving the site to a VPS. I don’t even know WHY ANYONE would use Shared hosting. You can have a VPS with 500GB transfer for as little as $3.95/month. I’m sold. No more shared hosting! A cost of $3.95 I can afford. Check it out! I think anyone using shared hosting should STOP RIGHT NOW. If you can get a VPS that cheap, why even bother with shared.

Soon there will be no more slow loading glitches or down time on my site. This is the end. (Maybe I’m just a control freak, I want root access to my server :) )

This is my last post on hosting for awhile, I swear :)

Thanks for not telling me that you could get a VPS so cheap.. I’m going to guess my readers didn’t know, or aren’t paying attention to my site anymore because I’ve gone off in a tangent. Oh well. :)

I think I’m going to go with a VPS from RapidXen.net, I may have a need for some IRC abilities.

Everything is setup, and ready to go. Free hosting from me

Thursday, January 1st, 2009

My Journey

I bought the VPS for one month, thinking that it would be somewhat difficult to setup. I did not even know that you log into servers via SSH. I’m familiar with SSH, but I thought people used VNC’s or similar to do host management. I could have installed VNC, but GUI etc would just take up too much resources. Everything had to be done through the command prompt. By reading my last entries, you can also get a more full idea of what I had to go through.

I got root access to the server, connected via SSH and attempted to install EHCP. It didn’t go well. Someone must have had this box before me and mucked it up. For one, the server is running Ubuntu, and EHCP uses Apt-Get to install everything. Hmm… What happens when the sources.list file is missing? You guessed it, apt-get doesn’t work at all. Neither does apt-get update. After a lot of screwing around I found that I needed to get the sources.list file for Ubuntu 6.06. So, I surfed around the internet and found it. Another issue: how do you transfer files through ssh? Well, putty has a program called psftp. This is not difficult to use. Just cd into the correct directory, type put and drag the file into the command prompt. Easy. Now with that done, I could finally do apt-get update.

I attempted to re-run the ehcp script. Still, errors, all over the place. For some reason it was not asking me for my root MySQL password? I got fed up with ehcp, and attempted to install ISPConfig. That did not go smoothly either. I have a feeling that a lot of my problems were due to the box running 6.06, and someone before me screwing with settings that were not fixed before I got it. I never had such problems installing software on Ubuntu. I went back to ehcp, since that seemed like a little less to configure. I had fixed a quite a few issues manually, so I re-ran the EHCP script, and wallah, things worked.

The next thing I tried to do was play with my technologyinsanity.com domain by moving it over to the new host. That did not go well. It took forever for the DNS Server to update, and I got fed up and just switched it back.

I began searching for a cheap/free domain to use to continue my project. I ended up finding .co.cc domains. They’re free, you have full control over DNS. I was able to setup my own nameservers with it, very easily. How?  I set a Zone Record in the “A” group for one domain. I made the “name” ns1.domain, ns2.domain, and for “value” I put in my 2 IP addresses I have for my host. I was not allowed to then point this domain to the newly created nameservers, so I created another domain, technologyinsanity.co.cc, and pointed it to those 2 name servers. I then went in and edited a file for custom DNS on my ehcp control panel. I waited till the next day and ran “sync dns” and “sync domains” wallah, it worked.

I then installed phpBB on the domain “technologyinsanity.co.cc” and that was it. That’s all I’ve done with it. Quite simple, really. Nothing that was too complex, most of my issues came from the fact someone screwed up the installation of Ubuntu.

I was a little surprised at how easy it was to setup an unmanaged server with no control panel, and setting up name servers was really no big deal. Granted, I do have prior Linux and server knowledge, just never set one up before.

So…

If you sign up, you just point your domain to the name servers I’ve created with your domain, and setup the MySQL and php stuff and you’re good to go. I’ve already tested the mail server, FTP, etc it’s all good. The install scripts for some programs work fine through EHCP as well. Pretty much everything you see through EHCP works fine. If people sign up, I may keep the host active for the next month, just realize that it will be $5/month after the first month. It costs $35/mo for me to have this host.

Sign up details

Visit: technologyinsanity.co.cc for more details :) I’m only accepting 2 users to start out, because offering free hosting seems like it could be risky.

If no one signs up..

I will discontinue the host after this month, that’s all.

This is my last post about my VPS, I’ve dived into my INSANITY category again. :)