24-Dec-2011 4am IST: All pending issues except the Plesk Control Panel login have been fixed. To resolve this issue, the server has to be put in maintenance mode. To minimize the downtime, we have asked the Plesk Parallels team to proceed with it during the day time today (Saturday early morning in Asia – Saturday midnight in Europe – Friday late night in North America). This is to minimize the inconvenience for users on the server who have not been affected by this issue. During this time, there will be interruptions due to reboot of the server. Please stand by for further updates on this.

23-Dec-2011 1pm IST: The backup of all sites on the server is now completed. We are escalating this ticket now to the Plesk Parallels team so that they can investigate and fix.

23-Dec-2011 5.30am IST: The Data Center team has asked us to decide if to go to Plesk Parallels team to investigate this issue or to restore the server.

We prefer going to Plesk Parallels team as they have almost always been able to fix the issue. Though there is a possibility that the Plesk team might also advise us to do a restore, trying them before restoring gives us a chance to get the server up and running without a restore. So we have decided to use that route. Before doing that, we are starting a backup process to backup the latest data on the server, so that in case of a major issue, we can restore to this latest version of the backup.

23-Dec-2011 3am IST: The DC team has decided to upgrade to the latest version of Plesk to see if this fixes the issue.

23-Dec-2011 1am IST: The DC team is still investigating the issue.

22-Dec-2011 11pm IST: Data Center team is still investigating the issue. They are trying to check if Plesk was moved to use MSSQL server as the database, as it appears it automatically switched to it (we do not change the default installation of Plesk on the server.)

Issue: On 22-Dec-2011 at 6pm IST, we realized that some the key services (such as Plesk Control Panel, Email services) were automatically switched off and we could not start the services even as an administrator on the server. While most of the clients on the server are unaffected, six clients have reported either loss of email access or issue with logging into the control panel. After attempting to fix it manually, we escalated it to the Data Center to investigate at around 9pm IST.

We will continue to update the status of this issue here on this post, until the issue is resolved.

It is one of the saddest days for us at Auro Infotech as he was not only our first employee, but one of the best we could have ever. He was extremely committed and hard working, and on a personal level a very humble person.

Jai, it was a honour knowing you and sincerely pray your soul rests in peace.

We offer our sincere condolences to his family and are taking steps to give them whatever support we can at this time

As you all know, we have been providing Microsoft SQL Server with our Windows Servers for many years now. As a part of the continuous upgrade strategy, we are upgrading our SQL Server database from 2005 to 2008 this month.

Since MS SQL Server 2008 is backward compatible with MS SQL Server 2005 version, we expect this migration to be seamless. As always, we will make sure you are well aware of the upgrade process that impacts your sites, if you use SQL Server database. We will contact you before the upgrade and also let you know about the progress as we proceed. We expect this migration to be completed before the end of the month.

Please feel free to email us or call us if you have any questions on the same.

As we started using it, we realized the Manage Links feature was fully broken and we could no longer add or edit or delete any links. We gave the benefit of doubt to the WordPress team, as such minor issues do happen.

Then as we started adding new blogs, and then when we tried adding new images, it gave a serious error that file types were not recognized or something like that.

Now I know for a fact that this version has not been thoroughly tested and has bugs which is not worth using right away. So if a patch is released within a day or so, we will apply it or roll back to the previous version on our blog networks.

If you are planning to upgrade to v3.2, I strongly recommend waiting for a few days before doing so.

It is quite clear that the RBI wants all payments made to Indian Business Accounts via Paypal should be brought into banks in India, before they can be spent for export related expenses.

This is quite an interesting move as it will surely tighten the tracking of the flow of money – which has been quite difficult all these days.

After the confusion last year, we stopped using Paypal, but I guess it be worth giving it another chance to see if things have improved.

As part of our commitment to provide a high level of customer
service, we would like to give you a 30-day advance notice on
changes to our user agreement for India.

With effect from 1 March 2011, you are required to comply with
the requirements set out in the notification of the Reserve Bank
of India governing the processing and settlement of export-related
receipts facilitated by online payment gateways (“RBI Guidelines”).

In order to comply with the RBI Guidelines, our user agreement in
India will be amended for the following services as follows:

1. Any balance in and all future payments into your PayPal account
may not be used to buy goods or services and must be transferred
to your bank account in India within 7 days from the receipt of
confirmation from the buyer in respect of the goods or services; and

2. Export-related payments for goods and services into your PayPal
account may not exceed US$500 per transaction.

We seek your understanding as we continue to employ our best efforts
to comply with the RBI Guidelines in a timely manner.

We regret any inconvenience caused to you and hope the advance notice
will enable you to plan your future use of our services accordingly.
For further information, click here

https://email0.paypal.com/servlet/cc6?iitHiQTBCTQWVHKupgxHmjhpgMhlLJoQJhuV2VTV20G62fGv28w9GVRRRBRATRSVa61ab9VCdaWWRTCT7YRAYUW0VGf6be862GEw05VvwvV86fy6bEvb9VCSASVwzgzgG0b9VUDWDTVXLX

If you have any questions, please contact PayPal customer support by
logging into your PayPal account and clicking on “contact us” at the
bottom of the page. We sincerely thank you for your patience and
continued support.

Sincerely,

The PayPal Team

As a part of this, we are disabling 777 access to any website. To accomplish this, we are migrating our servers to SuPHP to secure our PHP and apache configurations. This move will make sure files cannot be written by everyone and will prevent the issue caused by the 777 permissions that were previously allowed on all files.

We are implementing this change in our shared servers on 30-Oct-2010.
suPHP is a tool for executing PHP scripts with the permissions of their owners. With this we have following advantages in shared hosting environment

No folders or files can have 777 permission and it cannot be owned by user “nobody”. This is one of the greatest advantage where we can secure the files and folders in the site as none can do anything other than the site owners.

This change will go in at midnight on 29-Oct-2010 and as of 30-Oct-2010 we will not allow any 777 access on any of our servers.

Site Owner should make following in their site
1. Make sure no 777 permission files or folders/directories present in the site. The recommendation is to change it to 755 for folders and 644 for files.
2. .htaccess file should not contain any php_value. Please move those values under php.ini file instead.

Please feel free to contact us if you need any help with this.

Resellers please pass this is to the respective site owners.

1. Copyright violation notifications against sites
2. Phishing attacks originating from sites
3. Spam mails originating from sites
4. Malicious content such as spyware, worms, etc originating from sites
5. Other types of abuse notifications about the sites

The process to notify these complaints is defined below:

1. Please send an email to support@auroinfotech.com with the following information:
a. Name of the site
b. Exact Link where violation occured (This is mandatory for reporting copyright violations, phishing attacks or malicious content notification)
c. Short Description of the issue and the action expected to be taken
d. Name and email id of the team to whom response should be sent

2. We will forward the notification to our clients and we always insist our clients to provide a response within 24 hours on the action taken.

3. If the client provides a response within 24 hours, we will pass it to you. If we do not get a response within 24 hours from our clients, we will take necessary action as per your request and update you.

4. Upon receiving written legal notification postal letter under Indian laws, we will provide the name and address of the clients whose servers are managed by us.

Please note that we manage the servers and the sites on it. We are not responsible for the content that resides on these sites, but as a professional policy, we will follow up on such complaints against sites hosted on servers managed by us.

On a related note, we will write separate blog posts about each of the types of complaints listed above, and the steps that can be taken by our clients to protect their sites from such violations.

Please feel free to contact us if you have any questions about this.

Since we use Blackberry heavily at Auro Infotech, we are quite comfortable with the setup of Blackberry to be used with email accounts on Auro Infotech hosted domains. This post gives details of the steps involved in setting up the same.

Lets assume your domain name is called yourdomain.com and your user name is username. Please make a note of the following details regarding this:

Domain Name: yourdomain.com

SMTP Server Name: mail.yourdomain.com

POP3 Server Name: mail.yourdomain.com

user name: username@yourdomain.com

email id: username@yourdomain.com

To configure your email account with a blackberry device, choose the option to ‘Integrate with Personal Email Account’. (This has to be done for any setup which is not going to use a Exchange server and since our hosting accounts do not use a Exchange server, we have to use this option).

Once you choose it, go to Settings – Email Setup and enter the details given above in the next set of steps.

btw, if you use Outlook or any other email client on your desktop, please note that setting up Blackberry device to link to your mail account does not cause any sync action with your email client on your desktop.

Any mail deletion on Outlook will delete the mail from the mail server but not the Blackberry device. Similarly any mail deletion on Blackberry client will delete the mail from the mail server, but not on the Blackberry device.  That will definitely be a limitation as both the Blackberry and Outlook use POP3 and SMTP to interact with the mail server.

We use this limitation to our advantage. When this happens, we always have a copy of mails on my Outlook, which remains locally forever. All blackberry mails are set to be deleted from the device after 30 days (If you want to save any mail longer than this, you have to open the message and ‘Save it’ and it will then get saved permanently in ‘Saved Messages’ on the blackberry).

Hope this helps.

This post explains the steps involved in the server hardening task carried out at Auro Infotech on all new servers.

New server checklist – General
1. Setting up hostname, add additional ip addresses
2. Setting up of name servers in case of availability of control panel else add it to dnsmadeeasy.
3. Setting highly complex mysql password.
4. Tweaking php.ini values like increasing upload_limit, memory_limit.
5. Tweaking mysql values like log-slow-queries.
6. Tweaking apache values.
7. Checking and installing MRTG graph.
8. Creating Packages for the Accounts.
9. Creating Accounts.
10. Creating a test site and making it work.
11. Adding Server to Monitis/Nagios for internal and external agents.
12. Adding backup if the site is set up.
13. Adding the server to the Systems sheet.
14. Anti Virus and Spam solutions.
15. DO NOT CREATE auroinfotech.com DOMAIN FOR ANY RESELLER ACCOUNTS. THIS IS CREATING ISSUES WITH EMAILS LATER.

Specific to LINUX servers
1. Limit root access using SUDO – This will make sure no one can login to the server directly with the root username. First we should create a user for login. We are using “aiadmin” as primary login on all our servers followed by root password.

2. setting up highly complexity aiadmin / root password

3. Checked password policy inside /etc/login.defs file

4. Configuring Iptables (Firewall).

5. Anti-Virus installation – ClamAV

6. Apache security
a) Make sure only root has read access to apache’s config and binaries
chown -R root:root /usr/local/apache

b) Don’t allow apache to follow symbolic links

This can again can be done using the Options directive inside a Directory tag. Set Options to either None or -FollowSymLinks

Options -FollowSymLinks

7. Remote Access and SSH Basic Settings
It is suggested to run ssh on an alternate port other than 22 .
If we want to deny users from accessing ssh , then we need to add allow and deny entry to that file.

8. Warning Banners
This will be created under /etc/motd file

9. Only allow root to access CRON

The following commands will
Establish root as the only user with permission to add cron jobs.

cd /etc/
/bin/rm -f cron.deny at.deny
echo root >cron.allow
echo root >at.allow
/bin/chown root:root cron.allow at.allow
/bin/chmod 400 cron.allow at.allow

10. Check for security on Key files
a) /etc/fstab: make sure the owner & group are set to root.root and the permissions are set to 0644 (-rw-r–r–)
b) verify that /etc/passwd, /etc/shadow & /etc/group are all owned by ‘root’
c) verify that permissions on /etc/passwd & /etc/group are rw-r–r– (644)
d) verify that permissions on /etc/shadow are r——– (400)

11. Disable any unneccessary sservices.

Windows servers
1. In windows 2003 server, We should run security configuration wizard and configure it accordingly. This will help in configuring all services and disable it if not needed.

2. Rename default administrator username to aiadmin

3. setting up high complexity password.

We have successfully upgraded our wordpressmu from 2.9.2 to 3.0.1

Here are the steps we followed for this upgradation

http://wpmu.org/how-to-upgrade-wpmu-2-9-2-to-wordpress-3-0-in-5-easy-steps/

We have also upgraded all our plugins and we are happy to say that we are in WordPress-3 club.

Have fun!!