Lets first come to the question, why are we using Softlayer Nameservers. To be honest, the root reason is to easily achieve two fault tolerant nameservers at almost no cost. Mellowhost.com is hosted on a dedicated server with Liquidweb. All of our shared servers are using Softlayer. The distinction is done to make sure our helpdesk is always up even if the Softlayer shared servers are facing any sort of error or undergoing a maintenance. I have been monitoring softlayer nameservers for last 3 years (softlayer NS were our secondary NS before while using Liquidweb NS as primary), it is the least down monitor in my pingdom list. One of the reason, why these NSs are fault tolerant, is they are hosted in two different DNS servers under Softlayer’s management. Even if we had set a private NS in the Liquidweb, it would still be a single point of failure until we setup another server just for DNS. Softlayer NS would still respond if the Liquidweb server goes down for some reason. We had plan to setup a backup MX on this purpose which we do not have yet. Although, it should be up within October as far it is planned.

Moreover, Softlayer DNS management is not a publicly available free DNS server like afraid.org or some other. It is only available to the users who own servers with Softlayer. That automatically answers the other question of the questionnaire about owning servers.

We used to offer Master resellers, but we have already stopped offering this to our clients. I almost hate the words these days like “Master” or “Alpha” or whatever web hosting companies are using everyday to gain more and more customers. These packages grow extensively to be honest from my years of experience and the result becomes more spam from the higher level of granularity. We eventually have one of our own master reseller panel integrated with WHMCS under (mellowhost.com/master/). This application is an absolute inhouse developed and fully functional master reseller script that we have never sold to anyone. We may start offering master resellers in future, although, the chance is pretty low.

We do not offer VPS hosting because to be honest, we do not have that amount of man power yet to empower a VPS Hosting service. A service should be offered in full form otherwise, there is no reason of offer a half broken service. We do have Semi Dedicated Shared services given when a client overuse his shared resources. These servers are shared among least users and use high end CPU, Memory & IO.

Every question is valuable, and the answer should be given, its important for Democracy Happy Hosting!

I was looking at the varnish and it seems the varnish was designed just as I was expecting to solve the problem with an on memory caching. I tried “Memcache” before, but to achieve the maximum of Memcache, it is essential to design the script for Memcache. Expecting which is pretty unusual in a shared hosting server.

I finally tried Varnish with one of our heaviest server with a TTL set for php scripts at 60 seconds. It was returning approximately 20% hit rate which is pretty low to be honest. Although, in different times the hit rate increases to 40%. I was concerned about the cache miss penalty although, it doesn’t seem to be hurting a lot to the server in contrast with the hit rate. The biggest benefit I can see using Varnish in this server is the stable load average. The load average remains very stable for a long time. I am still in the process of assessing whether this small software can really improve the performance of shared servers or not which would lead the hoster to consider this as a viable solution and I am quite optimistic after seeing the experience till far.

Kudos to Kamp for developing such a nice software.  Happy Hosting!

We currently have 3 backup servers. Most of our agents are using R1Soft CDP 3 Enterprise Edition, although, two of the agents are still using CDP 2. Some of our servers have 10 days retention and some with 14 days. Here is a stat I was able to retrieve from my CDP panel about the Disk Safe usage:

• Beret: 334.6GB
• Hemonto: 1090.6GB
• Mellow1: 631.1GB
• Natasha: 454GB
• Stack1: 70.1GB
• Khanika: 436GB
• Kinchit: 345.7GB

Total: 3362.1GB

We have nearly 300GB of rsync backup for some of our pretty old servers which I didn’t count here. Just for a note, all the backups use QuickZ compression if CDP 3 or Gzip Compression if CDP 2. That means these values are shown after compression of original data.

Your data is secure with us. We do take regular backups, no matter what size it is. Although, it is recommended for everyone to keep backups of their databases at least once a week. It is always better to have an extra contingency plan when the question comes to data security.

Happy Hosting!

Happy Hosting!

http://mellowhost.com/downloads/wp-supercache.tar.gz

Wp-supercache is a property of its original author. More details about this plugin is available here:

http://wordpress.org/extend/plugins/wp-super-cache/

WE have started using CDP 3 Enterprise Edition for our backup since June. Nearly 75% of our servers are now using CDP 3 and 25% are using CDP 2. Since we have deployed CDP 3, we were seeing some interesting file system issues. It looks like the CDP 3 mount the file system each time it starts the hot copying the snapshot. After a couple of backups we were seeing more orphan inodes being deleted from the hemonto server each time CDP 3 was trying to backup. It raised a little alarm. I was expecting some sort of file system corruption, although before going into rescuelayer and start fscking the system, I planned to check the RAID status. All of the drives were reporting optimal and there wasn’t any ticket from Softlayer regarding the RAID maintenance (Usually the raid alerts are sent to SL technicians automatically). I planned to go deeper and checked the logs of the controller. It was reporting nearly 37K errors for our 3rd drive, 20K error for our first drive and 1K error four our second drive. These numbers are usually pretty low in a system where Drives are in perfect condition and the RAID controller is operating correctly. I have seen situation where the Adaptec RAID can automatically heal these errors and they go unattended many times. I kept monitoring the number of errors for nearly an hour and could identify 2 of the drives were surely went wrong.

I opened a ticket in Softlayer support asking them for a Chassis swap at first to see if the issue is related to RAID controller and replace one of the drive which was creating most the error. Just for a note, this server is using RAID 5 and it has nearly 1.2TB of user data. Due to the nature of RAID 5, if 2 drives fail, it would be impossible to recover the data from the drives. RAID 5 can recover the data of single drive fail. Before going for a chassis swap, we had run a different version of offsite backup with CDP 2 instead of CDP 3 just to make sure, we are free from any sort of data loss in future. It took nearly 18 hours to complete the server to secure the data with CDP 2 in an offsite server at a data rate of dedicated 100Mbps. As soon as we had completed taking a fresh copy of the backup, we went to Rescue Kernel and ran a file system check. Most of the partition came clean, although one of the partition was returning error. We had completed forcefully running and fixing all logical errors of the file system before going for a chassis swap. There wasn’t a lot of data loss due to the error. There were couple of inodes referring orphan and was fixed by the fsck.ext3

After completing the fsck, I had sent the server for a chassis swap. It took nearly 1.30 hours to complete the chassis swap. After the chassis swap, the server came back online. I immediately took a look at the RAID log and was able to capture that it was reporting nearly 100 errors for each of the drives just after the OS was booted on new chassis. I was quite sure, under this circumstance, we have to go for restoring the backup from the backup server as all the drives might fail instead of rebuild. Although the server build engineer “Robert” from Softlayer (He was the shift leader at that time, it was sunday) took the server down back again to replace the drive, but couldn’t bring back the server (As expected). Finally after nearly 3 hours, he was able to discover that, one of the drive was absolutely failed. He was able to get back the server in usable state with the other two drives after his investigation was complete and replacing the RAID controller with a higher model number. Softlayer employees ran a fsck on the system before starting, just to make sure, the file system is out of any further error before rebuild.

Once the fsck was done, it went to replace one drive by one. We ran all the rebuild from BIOS instead of running the OS. I was a little skeptical about the condition of those drives and feeling safe to run it from BIOS. We were checking the status of each rebuild using IPMI. It took nearly 3 hours for each rebuild and nearly 40 minutes in the middle to replace a drive after each rebuild. After we completed replacing all 3 drives and rebuilding the whole array 3 times, Softlayer employees brought back the server online.

Right now, Hemonto server is running with all new hardwares. Fortunately, there wasn’t any data loss. Even if it did, probably we had to wait long, but as we had two version of data backed up, we were surely able to recover the data using one of the CDP version. We had to run couple of cpanel fix script to fix a couple of permission errors. /tmp partition came with uncorrectable error after the system was online. We immediately went to Rescue Kernel and recovered the superblock information with mk2fs and ran a fsck. It brought back the /tmp partition in action again.

After something above 48 hours when the assessment on the new drives and hardwares were completed, I went to sleep. It was hard, when you have employees, but you respect your client’s data the most, you can’t sleep well without making sure they are secured. I should thank all the Softlayer employees worked with me and my colleagues to patch this hardware disaster. We had nearly  4 CSA tech working for the job due to the shift interchange. There were 4 SBT (Server Build Technician) working to replace the chassis and drives each time a rebuild was performed. Hardware issues are not uncommon but such issues are rare when you have your RAID controller along with your all hard drives are failing.

This is just another story explains RAID is never made for backup. So, keep your backup offsite to be safe!

We are currently using 3 different budget providers namely, limestonenetworks, honelive & dediserv.eu. They are pretty cheap and I am amazed with their network and hardware performance. Limestonenetwork is probably a little priced than the others, but it definitely has the best uptime till far. Since last 3 months, Softlayer network uptime has been draining. They are continously running network maintenances and I just hope that would solve the poor performance as earliest possible. I have seen 100% uptime with Softlayer for long, that is probably why, I still have the confidence on them.

We have nearly 2TB backup in our limestonenetwork backup server. The biggest backup server we are currently using is from Honelive. It seems a pretty nice company who owns their own hardwares. This box is located at New Jersey. I had been able to get a custom deal of 4TB storage at a dirty cheap rate. This server is honestly performing so well. I can remember my first day with a 2TB harddrive when Softlayer first released them. It was an absolute nightmare. I had to change that hard drive twice before being able to get a neat one (and many fsck). Eventually I had it removed a couple of months back as it was of no need. We had then shifted our other backup server to Honelive. I am not absolutely sure about the support of Honelive, as they don’t have a seperate helpdesk for support. They mostly answer to questions using emails. I haven’t raised any ticket although since I have bought the server. This is eventually a backup server, and I don’t mind slow response time for the price we are paying to Honelive. I expect a better hardware and network uptime rather than support performance for a backup server. We are mostly using LSN for Dallas based servers & HL for Seattle, Washington & partial Dallas based servers.

The last budget provider I have using is a European hosting company. It is a Poland based company called “dediserv.eu”. They seem to have colocated rackspace with EvoSwitch (Holland) & Equinix (Germany). They might not have absolute stunning network uptime like limestonenetwork but their service & price is pretty awesome. The only problem I had with them was recently about a fan issue. It did cause a good sum of downtime, but it was fixed after all at the end. I have been using EvoSwitch DC, but due to a recent issue they offered me a upgraded hardware at the same price in Equinix DC. I have never used German server before (Tried OVH, but not Equinix), till far it is doing pretty good. I am using this server for both backup purposes and some websites. It is cost effective and European

We still have a small UK based VPS for our VPN (Virtual Private Network) services. We use this network for security purposes of our internal tunnel. This VPS is purchased from ThrustVPS. They seem to have a lots of complaints but yet, their prices are unbeatable. I didn’t expect a perfect uptime when I had chosen that small box, but it is still doing pretty good job and I do not really have a lot of complaints against them considering they are a budget vps hosting provider.

Here are the links of the providers:

Limestonenetworks
Honelive
Dediserv.eu
ThrustVPS

For some reason due to the development of auto scripts installer like Softaculous and Fantastico, users tend to try each script and leave them unattended. This keeps leaving form exploits for the botnet attackers. A wordpress blog without akismet is potentially threatened to form spam attack. Most of the phpbb forums contains no protection at all on the initial installation. These let the auto bot spammers to post their links in unattended forums/blogs to gain backlinks from their perspective.

This is not eventually only harmful for the server in realtime but also threaten the reputation of the shared IP. I have been working to try to develop a protection server wide to stop these spammers, but every attempt seems inadequate.

In many cases, it is hard to control or check manually as resellers add users and the users add many addon domains. It grows almost everyday. It is advised for every user, not to keep unattended blog/forum/script. It is always better to add some “Captcha” in all sort of registration form. Nowadays, spammers have broken the Captchas as well. Some people have already started some solution called Random questions. But anyway, there should be something like verification in the registration and the comments shouldn’t be allowed without registration. You can also add the Akismet plugin which is available for almost all the blogs and forums. It drastically reduces the number of spam and acts pretty quickly.

Protecting form spam is not only good for the server, but also good for your sites reputation. If you are hosting an unattended blog script inside one of your main site, than it may receive a serious damage of reputation in SEO if the unattended blog is regularly spammed by malicious users. So, check now, if you have any unattended script inside a folder, you should probably double check and delete it if it is not essential or protect it from auto botnets.

Lets see why these web injections occur. There are couple of factors when someone can inject something in your blog pages. Two most common factors are javascript bugs and the bad permission bits. I have seen some people advise when someone complaints about the iframe injections, were done with hacked ftp password. I would probably say, if the person had the ftp password, why would he simply inject something instead of replacing? But, yes, it is not the same case all the time, but most of the time, those two factors play the vital role on web injections.

Now, one can say, he hasn’t done any change on the permission bit, he simply uploaded the theme and started using it. Eventually, that is what you are doing wrong. WordPress itself is a very secure system. People are not going to be able to inject codes using wordpress vulnerability. Rather, they are injecting codes/iframes using the vulnerability in your 3rd party theme or plugins. Most of the time, I have seen users nominating and selecting themes and plugins from publishers who are pretty amateur or have no well known presence on internet. These amateur developers are eventually leaving javascript bugs for you in their themes and plugins. Later on when you upload the files and allow the owner to write the files, those bugs get incorporated with the writing permission of suphp and injects craps. If the script which contains the bug is forced to use no write permission, then probably you are going to protect your wordpress blog from web injection along with those javascript bugs. I have always been suggesting users who are complaining this is a server issue, to make sure their scripts are not granted with write permission until it is essential for his script. You have to understand, if this is a server issue, then all the users pages in the server should be injected, it shouldn’t be just yours. Mellowhost maintains latest mod_security rules from gotroot (http://www.gotroot.com) although, new injections are developing every day, and simple mod_security can not really protect every sort of injections.

How can you protect your wordpress blog? Couple of things, one, try to make sure, scripts which don’t need write permission (Like configuration file/includes files) set with read & execute permit (555) only. You can do this using file manager or ftp with the “Change Permission” or “Chmod” option. If you see one your worpress blog is injected, then you would probably want to change your theme first to see if it gets injected again. If it does, then the issue should relate to some plugin which you have to verify one by one.

This seems a pretty clumsy process to verify and work with the above options. There are couple of more investigations and solutions you can apply. There is a “Raw Access Log” option in your cpanel. You can check your last 24 hours access logs of your site if you download that file. But this would only work if you are certain that the injection was does within last 24 hours and aware of how the requests are being handled by your wordpress. But the last part can be concluded assuming you are at least able to understand the unusual requests to your blog (for example running javascript commands through the url).

Alternatives? Yes, there are 4 pretty important wordpress security plugins you would probably want to use. Here are they:

1. WordPress Firewall Plugin: http://wordpress.org/extend/plugins/wordpress-firewall/

2. WordPress Antivirus Plugin: http://wordpress.org/extend/plugins/antivirus/

3. Secure WordPress Plugin: http://wordpress.org/extend/plugins/secure-wordpress/

4. Wp-Malwatch Plugin: http://wordpress.org/extend/plugins/wp-malwatch/

All of them are perfectly working and the easiest way for a shared hosting user to detect and protect their wordpress blog from web injections automatically. What they do, is protecting your files from being written or watching how they are being edited. They are doing the very similar thing I suggested above but in realtime. I would probably recommend the wordpress firewall plugin, as you can configure it to load first out of your all other plugin and help you to test if one of your plugin is vulnerable.

Now, my readers will definitely ask, why didn’t I just let them know about those plugins which would help their blogs from web injection in the easiest and fastest way, I would probably say, it was my intention to let you understand how this is happening and what are the basic steps you can perform to prevent this. Merely using the plugin may not solve the issue, rare but not impossible

Just a quick reminder, we at Mellowhost maintains the best protective security for your blog. But everything has a limitation. These sort of injections are a part of limitations. It is pretty hard to understand developer’s mind and apply a patch to protect his fault at the server level. This is why, it is advised to to take precautionary measures all within your range. You should have no worries about the server as long as you are hosted with Mellowhost

Happy reading.

Installation went smooth. It was pretty faster than Windows XP if I can remember (Last time, I installed windows was in 2007). After using Macbook for last one year, I was continuously losing my interest on windows. Mac OS X Leopard is fast, virus free and most importantly, it doesn’t crash so frequently like my windows did before. I wasn’t really expecting much from Windows 7 over Windows XP. But I have to say, I am pretty much amazed with the performance and design tactics. I find it way faster than XP and in some cases, it would beat my Mac. I was hearing about the hardware acceleration improvement on Internet Explorer 9 and waiting to try it. It really squeezes your net! I tested both IE 9 and FF 4 Beta 6 on my windows 7, and I can definitely feel IE is performing better than FF. Older IE had tremendous problem with the tab opening, but IE 9 has overcome the issue, it looks like. It is opening tabs faster than FF 4. Although, sites are loading fast, but the compatibility seems to be a problem with IE 9. It can not load lots of javascripts and css, so I assume, it has more to improve.

I specially like the design of Task manager in Windows 7. I was using Windows 2008 R2 in one of my windows VPS, and it is pretty similar to that one. Linux is having lots of tools to find the bottlenecks of a system from scratch. I have never seen windows feeling interest for it. There are lots of geeks who would feel to tweak their OS and find the best from it. Although, windows have always been casual to give such tools to end users. This time, I can see windows is feeling the need. They have a Resource Monitor service built in to allow users to track root level usage.

Quick preview system for the tasks seem pretty nice. I can remember in old XP, when I was using the IE 6 and having around 20-25 windows opened, and the task bar was filled with “…”.

They seem to be having lots of improvement in the process management. I tried running couple of injections on svchost and other services, it seems, the current structure simply discards them. Even though, those were working with the latest update of windows xp. I read an article on Windows Server 2008 around a year ago, regarding the process architecture of it, and if I can remember correctly, Windows is more on following the linux architecture day by day. Users permission on process management is becoming more important. I would definitely work with it in later time and post a detailed report for Mellowhost blog readers

I have spent 6 hours till now with windows 7 professional edition, and I have say, I am impressed. You do need a good configuration to run it, but it is nevertheless a waste anymore. Keep up the good work Microsoft.