Category Archives: Web Hosting

Shared Hosting Vs VPS Hosting?

Systems Administration, Web Hosting

While Shared hosting ($8.95 per month) can be great, affordable solution for starting web site or blog, a VPS (Virtual Private Server: $19.95 per month) offers significant advantages for web site owners who place a premium on speed, security and scalability.

A few advantages of VPS’s over Shared Hosting account:

  • Guaranteed Speeds.  A Shared Hosting account must share the CPU’s and Memory (RAM) of its server with up to 150 other web sites (other hosting companies will pack up to 300 sites on a shared server.)   This is not the case with a VPS.  A VPS receives guaranteed CPU and RAM so other web sites will not slow it down.
  • Enhanced Security.  On a shared server we have to loosen our security measures since we are protecting up to 150 other web sites. With a VPS we are able to tighten security measures because we are only protecting one web site.  Its the difference between protecting one person verse protecting a group of people.  Its a whole lot harder to protect the group.
  • Instant Scalability.  With a VPS we can immediately increase the amount of visitors that it can handle to accommodate a sudden an increase in traffic.  For example, when your site is linked from a popular site like CNN.com.   Instant scalability is not possible with Shared Hosting as the site would actually taken offline in the event of a large spike in traffic so that it doesn’t slow down the other 150 sites on the same server.
  • Unlimited site hosting.  With a Shared Hosting account you can host one web site.  With a VPS account you can host as many as you like without increasing your monthly cost.
  • More tools for your developer.  Since a VPS is your own server your developer has access to everything on the server, which makes them happier and more productive.  On Shared Hosting, since its a shared server, this is not possible.

 

Hope this helps!

~ Oban

Target Hack Phishing email scores a 9.00!

Systems Administration, Web Development, Web Hosting

I’m super impressed with this Phishing email.  Its the best I’ve seen and if it weren’t for just a couple of easy-to-fix mistakes it would have scored a perfect 10.00!

Here’s the back story:  Target was hacked early last month.  That was big news that most people are aware of.  My wife and I were even sent new credit cards as a result.  But what you might not have heard of was the impressive level of phishing emails that are being sent out now targeting (heh, get it?) these customers.  So read along and I’ll dissect this particularly good one using our Olympic, Sochi-style scoring.  First, a screen shot of the original email:

 

Continue reading Target Hack Phishing email scores a 9.00! →

This blog has seven days to get hacked

Programming, Systems Administration, Web Hosting

I’m speaking at Wordcamp Albuquerque 2013 a week from today.  My session is called Hacked!  How they hack it and how you clean it where I’ll dissect a real-life WordPress hack and show everyone how I suavely and bravely root out the hacker, sleuthily determine how he got into the site, and then kick him out and slam the door behind him.

However, there’s a problem.  I figured there would certainly be a WordPress hack on one of our hosted customer sites between when I signed up for the talk a few months ago and now.  I’ve waited and waited, and shockingly, all of our customers have listened to us and have been keeping up with their WordPress updates.   So we haven’t had a single WordPress hack to clean up.

So I need this blog to get hacked.  The sooner the better.

Oh, and to speed this thing along and I’ve reverted this blog’s WordPress code back to WordPress 3.0.  This blog currently has more vulnerabilities than a president asking congress to approve a bombing on a mideast country.

I’ll update this blog and our twitter account with daily updates on my situation.  Stay tuned.   This could get interesting.  Or embarrassing.

How many visits can a virtual server handle?

Datacenters, Systems Administration, Web Hosting

 

There are a lot of variables that go into how many hits and visits a virtual server can handle; from how efficient the site’s code is, to how beefy the host server is, to how over-sold the host server is (among other things.)   Regardless, I still thought you might be interested in seeing some real numbers from a popular web site that we host on a virtual server:

Month Total Visitors Visitors per Day Unique Visitors Unique Ratio Pages Hits BW
April 2013 285,598 9,519.9 183,722 64% 3,521,151 31,729,312 1,149.2G

 

In April, on a 4GB RAM virtual server, this site served pages to 285,000 visitors and had 31.7 million hits.

Breaking this down further we might assume that a similarly coded web application could handle about 70,000 visitors on a 1GB RAM ($39.95 per month) virtual server and about 35,000 visitors on a 512MB RAM ($19.95 per month) Brownrice virtual server.

 

What security tools do we use?

Datacenters, Systems Administration, Web Hosting
Clamav
Clamav

 

What tools does Brownrice use to alert us to a compromised hosted web site or server?  Let me show you:

OSSEC: A great open source tool that constantly monitors server log files and file systems in real-time. OSSEC’s log monitoring helps with an important part of PCI Compliance, it can be configured to automatically block bad guys from doing bad things, and its a fantastic tool for post-mortem hack analysis.  We have OSSEC installed on all of our hosting servers, virtual servers, and managed customer servers.  It reports back to a mother-ship server so we can keep an eye on things from a central location.

Continue reading What security tools do we use? →

Remember rootkits?

Systems Administration, Web Hosting

Five years ago we were constantly fighting off hackers who would hack an insecure web site then try and install a rootkit so that they could own the server. Now? Nothing. They don’t even try and attack the server. We have all sorts of rootkit detection software on our servers (rkhunter, OSSEC, etc.) and I’m starting to wonder why we bother when a hacker has everything they need when they’ve compromise a web site.

WordPress hack post-mortem

Systems Administration, Web Hosting

Yesterday morning we had a client who’s got a site on a virtual server email to say:

Hi Oban –

I just had a business colleague say that he went to my site, got a malware warning, and his entire hard drive was wiped out instantly.
Hard drive instantly wiped out instantly?!?  Pa-leeease!
Nonetheless, this is a WordPress site so Dave looked through the code and didn’t see anything immediately out of line.  We both visited the customer’s site and neither of our hard drives were instantly wiped out (we are craaazy risk takers!)   I also looked at what Google’s Safe Browsing site currently thought of our network – which was that everyone was clean a whistle.
Dave emailed the client to say that this sounded like a false alarm but to keep us posted.   I decided to run the site through Sucuri.net’s free site scan and bingo! a javascript exploit was found.

Hacker extraction – New personal best: 10 minutes!

Programming, Systems Administration, Web Hosting

Last night, just before turning off the lights and harassing my wife, I received a text message from our server monitoring software saying that the mail queue on one of our shared web servers had suddenly spiked.  Lots of emails being pumped out of a shared web server is almost always the sign of something bad.

10:25pm

Logged into machine and examined one of the emails in the mail queue.  Because we roll our own PHP its compiled with a patch that inserts the full path to the script that sent the email. Years ago, when we didn’t have this patch installed, determining which site and/or script sent an email could have taken hours – or be nearly impossible to figure out.   Here’s what the mail header looked like (note: the actual web site address has been modified to protect the client):

Continue reading Hacker extraction – New personal best: 10 minutes! →