Computing

A series of articles and information about computers in general.

Block wordpress xmlrpc requests

By in Server, Wordpress Tags: , ,

cropped-technology-cable-electricity-energy-electronic-device-electrical-supply-104676-pxhere.com_.jpg

If you run a server with multiple sites on it, then you may have issues with WordPress installations. WordPress has a remote admin feature (which allows 3rd party connections to post new articles etc..).

While a greate feature in theory, in practice it is an avenue for attack by bot networks. You will see hundreds/thousands of connections a minute across a multi-domain hosting server (one of our servers has 40 sites on it – nearly all wordpress).

These requests take up resources, even if they do not compromise a site (though, with multiple sites – managed by people of differing technical skills, you may well get some compromised due to age and lack of updating) – to the point where a server cannot perform as well as expected, causing delays or requirements to upgrade hardware before you really should.

If you are running mod-security (if you aren’t perhaps consider it to protect your/your client sites) then you can add the following rule:

#Block requests to xmlrpc.php with no referring URL

SecRule REQUEST_METHOD "POST" "deny,status:401,id:5000900,chain,msg:'xmlrpc.php request blocked, no referer'"

SecRule &HTTP_REFERER "@eq 0" "chain"

SecRule REQUEST_URI "xmlrpc.php"

(adapted from a post on cpanel forums by ‘dalem’ (https://forums.cpanel.net/threads/xmlrpc-spam.646765/) )

Once you add this, any requests to xmlrpc, which do not originate from a link/trigger from a website (i.e. no referrer) will be blocked with a 401 (forbidden) message.

If you have a firewall or banning software (such as csf firewall or fail2ban) you can also get these to scan the log-file and ban repeated offenders on this rule.

When might this not be a good idea?

Basically, if you or any customers, use 3rd parties that utilise the xml-rpc functionality, you may not be able to deploy this rule. If you have a fixed IP you could always add in another part of the rule (another SecRule line) which excludes that IP address – but this may be hard to maintain.

How to recover from the latest javascript wordpress hack

By in Wordpress Tags: , , , ,

Hack

In the last two weeks a new hack has made the rounds.  This exploits a weakness in either the hosting or the security of a WordPress blog and adds code to every JavaScript file (.js).  The code can vary a bit but starts like this (with a unique identifier).

/*3395379449f353892757e0b699dd2159*/;window[“\x64\x6f”+”\x63\x75″+”\x6d\x65”

and ends like this (with the same unique identifier) the identifier varies per site.

[\”\x31\x32\”]].join(\”\”);”));/*3395379449f353892757e0b699dd2159*/

As this gets spread to all the js files it’s pretty tricky to get rid of.  To date the normal tools do not detect this (Sucuri), but I am sure with the next major update they will.

What causes this isn’t yet known, but most likely it’s due to out of date plugins which allow modification of files, once that is done the infection seeks out JavaScript files and adds on the code at the end of each.

 

Cleaning

Cleaning the files is not easy, in-situ it is almost impossible.  If you have access to a Linux-based computer or a Macbook (based on FreeBSD) these instructions can help you clean up your site.  You still should update the plugins and WordPress version to prevent re-infection.

 

Step 1 – backup

Download all your files, include everything, this will help make sure a complete eradication . Once downloaded compress into a zip file (keep a copy to work on, the zip is if you need to restore anything).

Step 2 – Clean

The easiest way to clean is to restore an old backup – if you have one upload it (overwrite existing files) and get hardening (see below).

If you don’t have a backup, or the backup was compromised as well then you can try using the sed command below (I don’t know of a windows equivalent) – FreeBSD (Mac OS) works slightly differently to Linux, I haven’t been able to test the Linux command, but I believe the version below the Mac one should work.

LC_ALL=C find /PATH_TO_YOUR_HACKED_FILES/ -type f -exec sed -i ” -E “s/(\/\*.{32}\*\/\;window\[.*\/\*.{32}\*\/)/ /” {} +

The LC_ALL means it will work on Mac’s with a non US locale.  The expression looks for the starting Window string, and goes back to the comment – it then goes to the end bit (32) with the comment and removes all the bits in-between.

This could potentially hit something legitimate, however as the code is being obscured I wouldn’t trust anything you can’t read!

Linux users

Other linux flavours need a slightly different sed command.  You can remove th LC_ALL = C and before the -E remove the ” (this is in because in FreeBSD you get backup copies otherwise which aren’t needed!

find /PATH_TO_YOUR_HACKED_FILES/ -type f -exec sed -i -E “s/(\/\*.{32}\*\/\;window\[.*\/\*.{32}\*\/)/ /” {} +

Step 3 – Upload & Hardening

Now upload your files, overwrite all that you have. You site is (for now) clean.  To harden I recommend the following steps:

  • Update your WordPress
  • Update your themes (a more common vector for attack than most people realise)
  • Update you plugins.

Finally install some security programs – these help prevent modifications, they also can warn you if someone logs into your blog and of other important changes.

I recommend Sucuri Security.  It has a free version with pro additions, the free is good for now, but if your site makes you money I recommend considering the paid version.

The key thing to do, once installed, is go through the setup – enable as many features as you feel safe, especially directory protection.

My site stopped working after hardening.

Don’t panic, it’s usually that one of the plugins needed more access and it’s now locked out.  Disable your plugins and then re-enable one-by-one.  Once you find the one that isn’t working you can put an exception rule in place.

Hopefully this gets your site up and running, it’s worth a quick check over to see if you have any un-recognised directories or files if anything else has been compromised.

Why is my Raspberry Pi slow? – Htop

By in Raspberry Pi Tags: , ,

After you’ve had your Raspberry Pi for a while, you’ve made it run a web server, media centre, Remote Desktop and more you might find it’s a bit sluggish. To find out more try out htop.

Traditionally in Linux you would use top, however this generally needs a bit more know-how to interpret the display, and it looks kind of plain.

 

An ideal replacement for top is ‘htop’ developed by Hisham Muhammad.  This is an ideal process viewer, with simple colour coding and a graphical output to show where resources might be used.  A sample screenshot from my Pi is below:

htop - a process viewer for the raspberry pi
htop – a process viewer for the raspberry pi

Installation of htop

sudo apt-get update

sudo apt-get install htop

Simple, it’s extremely easy to install and has no real overhead when running.

The output from htop

At the top the number 1,2,3,4 are the core status and the more they are in use the further the graph is to the right.

Mem/Swp is the utilisation of your Ram and Swap – Ram is usually filled up in Linux (used for caching)- your swap should not be used too  much, if it is your system will often be slowing down as it swaps memory from the disk (or SD) to Ram as required.

Running htop

Running it is easy – just login to the command line – ssh or local terminal and type

htop

And that’s it!  You can do more advanced things my using the F keys – F9 is a useful one for killing a process that is out of control.

You can resort using traditional top shortcuts – ctrl-M to sort by memory ctrl-P for processor usage etc..

Using F2 you can add more charts to the top section – both left and right sides! Don’t forget to save your new default settings.

 

If you use another flavour of linux it most likely has htop – try “yum install htop” on centos based systems.

Keeping your Raspberry PI install tidy after upgrades & changes

By in Raspberry Pi Tags: , ,

Whilst Linux in general is very good at being neat and tidy, devices such as the Raspberry PI, where resources can be much more limited than other computers can sometimes suffer – usually from lack of space (performance will be dealt with in another post).

If you’ve recently made changes – removed some packages, or manually updated some components you may find your disk-space getting a bit lower. One of the tools you can use is built into apt-get and allows it to scan and remove dependencies no longer required.

 

Simply run the following commands

sudo apt-get autoclean

#removes old archive files that might have been left behind (note you can use clean as well – however this can cause slowness as it removes all archive files and some may be needed again

sudo apt-get autoremove

#this removes any unused packages – often can be left behind if you remove a program which had optional dependencies, these are not always removed by the system – or other changes may have now marked them as unused.

The output of this will looking similar to this:

Claiming back some disk-space using apt-get autoremove
Claiming back some disk-space using apt-get autoremove

This gained me 300MB this time, but I’ve previously gained back 1.2Gigabytes.

Wi-Fi for Raspberry Pi – Edimax Nano USB

By in Raspberry Pi Tags: ,

The Raspberry Pi computer comes without Wi-Fi initially, but it’s true freedom is reached when you connect it wirelessly.  There are a number of options for this, but I’d recommend using the Edimax Nano USB, it’s easy to setup your Raspberry Pi to work with this – just follow this guide.

More

Disk space usage Raspberry Pi

By in Raspberry Pi Tags: , ,

You’ve had your Raspberry Pi working away, first as a media center – then a web server with a database and you’ve been tinkering with lots of other features, so what is taking up your space?

Luckily the Raspberry Pi, when running Raspian has a good command-line tool already installed.

Just type the  following into an SSH terminal.

More

Speeding up Zencart, resize images

By in Photo Mods, PHP, Zencart Tags: , , , ,

When optimising your zencart install there is a very powerful plugin available. This is Image Handler, it comes in four (to date) variants. Version 4 is for Zencart 1.5.x, whereas version 3 is for the 1.3.x versions (still the most common around to date).

What does it do?

basically it resizes images on the first load so smaller ones are then used when required, images generated are then stored in a cache so your system doesn’t have to redo them.

The advantages of this is loading time, for example a test image was 14Kb, the resized version was 5.7Kb, so you can imagine when you are loading 12 images the saving and speed-up is quite substantial.

Your full size images are still available, and are used for the larger image view clickable on the view listing page.

To give you an idea – the implementation of this plugin – has reduced the load times of the store I worked on by at least 50% on the main page, more on results pages where 12+ images might be loaded. In addition the bandwidth consumption has dropped around 25% (despite an increase in engagement of visitors).
CPU doesn’t seem to be high, the first creation takes less than a second (so on day one page load times did increase slightly – however by day two they had reduced and have continued to fall as more of the images are created).

If you want to see it in action visit Delicate Dreams (Sterling Silver Jewellery) and check the attributes of the images (and the sizes).

One other addition with this plugin is that you can have a hover – this gives a zoomed in view of the item – particularly useful for jewellery or ornate items.

Designed for mobile?

By in Computing, ipad, Iphone Tags: , , ,

Regular visitors to this blog (which posts less regularly than you deserve) will have noticed I change designs regularly.
Normally I choose a design that intrigues me, or that might allow me to experiment with something new. However this doesn’t always help you, the real “customer” of this blog.
After reviewing the visitor stats I have settled on this as the new look, and I don’t plan on changing it for a while.
The main advantage of this new look is mobile or rather smartphones and their related devices. It look pretty good on both a normal browser and a mobile sized screen, with easy to focus on areas for the good old (new) double tap to zoom.
Why not a truly mobile theme? These turn a site into rectangles that expand as you interact ( see wiki on your phone). Basically I hate them… Part of the point of a website is to show people things creatively, the standard ways of making a site suitable for smartphones seems to be to strip everything away.
Nowadays with relatively generous bandwidth limits and 4G networks around the corner the Internet should be used as it was intended.
Exceptions… Yes only one though – online payments – a nightmare on a normal site it’s extremely painful on a mobile device. If we want people to interact outside of an “app” store we really need to sort that, so far amazon seems to be the only online retailer where repeated purchases are a breeze. Luckily for me I don’t need to take payments , unless you think I deserve money for this sporadic essay writing.

Talking about mobiles and other devices, after a couple of weeks of using an iPad, many mobile sites think I need a washed out dull experience, however the iPad is not a phone, it has a better resolution than many laptops, and even high-end screens.
This means you really want an iPad to see your site as you originally wanted it to be seen – so don’t hide it…. the only thing that really does not work on the iPad are sliders, and that is now on a minority of sites – there are ways to get them to work and when they work – it works fine. The iPad is arguably what mobiles will end up being.

Small screens are only here for a short while, 5 years ago no one really thought larger screens than the maximum 320 * 240 arenas that used to be used would be improved to the resolution and size of a modern phone. With glasses like google’s Augmented Reality project possibly becoming available, the screen real-estate will expand to those devices. Flexible displays are also getting closer, so soon we will be able to expand displays larger than default sizes, already you can send your smart phone screen to a tv or other devices – this may become the default way of viewing data, an the smaller screen used only when truly mobile (which is not when most phones are now used!).

Anyway that’s my rant and opinion made public – read it and ignore at your peril.

Password protecting a directory with .htaccess and wordpress

By in Computing, Cpanel, Server, Wordpress Tags: , , ,

I’ve come across this problem a number of times, of course each time I think “this will be fixed next time”.  Unfortunately it’s not the case.  What’s the problem then?

You have a directory that you want to password protect, lets call it “secrets”.  It resides in /home/mysite/public_html/secrets/ on the server.  Now fortunately you are using a hosting control panel like cpanel and you’ve password protected directories before (if not then have a hunt on this site or on google!).

Before you activate the protection you can view the contents fine, so you activate protection – driven by a .htaccess file… and then rather than being asked for your username and password, you get a 404 or a 403 message from wordpress “Sorry the page you are looking for cannot be found”.

Intrepid system administrators hunt through error logs, and sure enough the access log is recording a 404… however the error log is recording something different.

Permission denied: /home/mysite/public_html/secret/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable

This error message has had a number of solutions in the past, including the infamous “reinstall frontpage extensions”, except these are long gone – not supported and never will be again, please don’t go installing them just to get past this problem! – It will end in tears.

Instead you just need to add a couple of lines to the wordpress .htaccess file in the root of your site (e.g. /home/mysite/public_html/.htacess). Go to the file and just before the main WordPress part

#BEGIN wordpress – add the following

ErrorDocument 401 /%{REQUEST_URI}/errors.html
ErrorDocument 403 /%{REQUEST_URI}/errors.html

This should set the site to working, now why does this work?

Simply put wordpress is often run with a pretty url mode (permalinks) where the addresses for posts are made to look more pretty.  When you request your secret directory the server tries to access it, looks at the .htaccess file and promptly tries to do a redirect, this invariably ends up at a page wordpress cannot access – this doesn’t happen without the .htaccess as wordpress allows access to existing real files, but the htaccess security says the file doesn’t exist until the password is entered and so it intercepted.

It’s all a bit confusing, however adding these lines essentially means wordpress can get out of the way when those errors occur, 401 and 403 are authorisation required or failure codes, so wordpress will ignore and the htaccess can safely challenge your.

 

Hopefully this will help if you come across this problem.

How to put wordpress into maintenance mode.

By in Wordpress Tags: ,

Sometimes you might need to put wordpress into maintenance mode – this replaces your site with a basic message saying that the site is temporarily unavailable.

Why might you want to do this?

  • To correct a mistake in a template (so put it in maintenance while you restore from your ever handy backup).
  • While doing manual updating (for instance the automatic updating failed or a plugin is not available for automatic updating).

In order to do this simply put a file in the root of your wordpress install and name it .maintenance .  The file MUST be preceded by the “.” similar to a .htaccess file.

Normally this file has code in it to indicate how long the site will be under maintenance, and if the timestamp passes then the file is de-activated and the site is available – for instance to make the site be unavailable until now (Feb 17th 22:28 2011) do the following:

<?php $upgrading = 1297981662; ?>

However if you want the site to stay in maintenance mode as long as needed then the timestamp just needs to be kept changing so the following will do the job:

<?php $upgrading = time(); ?>

And that’s it – simple as that you can put wordpress into maintenance mode without a lot of hassle.

1 2