We just replaced one of our Juniper SRX series firewalls with one of these little pfSense boxes and wouldn’t you know one of our own snort rules blocked us. Here’s how we got back in:

Gain access to the pfSense shell. We could have walked over to the box but that involved standing up, placing one foot infront of the other and repeating again and again. Bah, who needs all that.

We SSHd to another machine, and from that machine we SSHd to a machine behind our firewall, and from that we SSHd to the LAN IP associated with our firewall. We logged in, chose option 8 (Local Shell), and did the following:

pfctl -t snort2c -T show

This will show you all the IPs that have been blocked by triggering a snort rule

Then run this to remove you IP

pfctl -t snort2c -T delete xxx.xxx.xxx.xxx

You should add your own IPs to the whitelist to prevent this from happening again.

Here’s a working solution:

location ~ \.(jpg|jpeg|bmp|jif|bmp|gif|png)$ {
                root   /path/to/public_html/;
                valid_referers server_names none blocked;
                if ($invalid_referer) {
                return 403;
                }
            }

Some sites will need to allow some other sites to link to their images. If this is the case you can use the following rewrites – just modify and add domains as required

location ~ \.(jpg|jpeg|bmp|jif|bmp|gif|png)$ {
                root   /path/to/public_html/;
                valid_referers server_names none blocked www.theothersite.com *.theothersite.com;
                if ($invalid_referer) {
                return 403;
                }
            }

The VPS-Spark Package has received an additional 25 Gigabytes of bandwidth as well as an additional 128 Megabytes of RAM.

The VPS-Blaze Package has received an additional 25 Gigabytes of bandwidth as well as an additional 256 Megabytes of RAM.

The VPS-Inferno Package has received an additional 50 Gigabytes of bandwidth as well as an additional 256 Megabyte of RAM.

We hope you all enjoy the benefits of these additional resources.

http://wordpress.org/development/2009/10/wordpress-2-8-5-hardening-release/

server {
            listen   80;
            server_name  my.uncorrupted.net;
            rewrite ^/(.*) https://my.uncorrupted.net/$1 permanent;
       }

server {
            listen   443;
            server_name my.uncorrupted.net;
            access_log /xxx/xxx/xxx/logs/access.log;
            error_log /xxx/xxx/xxx/logs/error.log;
	    	ssl on;
	    	ssl_certificate /xxx/xxx/xxx/.ssl/cert.pem;
	    	ssl_certificate_key /xxx/xxx/xxx/.ssl/key.pem;

            location /  {
                        root   /xxx/xxx/xxx/public_html/;
                        index  index.html index.php;
		    }

			location = /announcements {
        				rewrite ^  /announcements.php  last;
    		}

    		location /announcements/ {
        				rewrite  ^/announcements/([0-9]+)/[A-Za-z0-9_-]+\.html$ /announcements.php?id=$1 last;
    		}

    		location = /downloads {
        				rewrite ^  /downloads.php  last;
    		}

    		location /downloads/ {
        				rewrite ^/downloads/([0-9]+)/([^/]*)$ /downloads.php?action=displaycat&catid=$1 last;
    		}
			location = /knowledgebase {
       					rewrite ^  /knowledgebase.php  last;
    		}
			location /knowledgebase/ {
        				rewrite  ^/knowledgebase/([0-9]+)/[A-Za-z0-9_-]+\.html$ /knowledgebase.php?action=displayarticle&id=$1 last;
        				rewrite  ^/knowledgebase/([0-9]+)/([^/]*)$ /knowledgebase.php?action=displaycat&catid=$1 last;
    		}

            # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
            location ~ \.php$ {
            			fastcgi_pass 127.0.0.1:9000;
            			fastcgi_index index.php;
            			include /usr/local/nginx/conf/fastcgi_params;
            			fastcgi_param SCRIPT_FILENAME /xxx/xxx/xxx/public_html/$fastcgi_script_name;
            }
}

Gest of luck – if you run into any issues write us a comment and we’ll see if we can help you work it out.

Have you heard?!

Here at Uncorrupted Hosting, when you use the coupon code – 5DollarsOff – you will receive the following perks:

* $5.00 off coupon ($5.00 off each month, for a year!)
* 30 day money back guarantee
* We’ll migrate you for…FREE…with no down time!

More is always better, right? So, once you’re signed up – wait a while. Then share your experience on your own blog, post a link back to Uncorrupted Hosting, and receive a FREE month of High Performance Hosting!

We look forward to serving you and hope to exceed your expectations!

This promotion is for new customers only.  We’ll be doing a separate promotion for existing customers soon!

We’ve always been about High Performance Hosting here at Uncorrupted, but we never pushed that as our niche… with the new design, we’re doing just that. Over the last few months we’ve gone through a complete metamorphosis – we’ve changed everything from our vision to our hardware, from our design to our network. We hope you’ll stay tuned for more information about or expanded (more economical) product line, our new hardware, and the crazy coupons/giveaways we’re about to release.

I really like XenServer 5 from Citrix, but I think I’m going to look at some other options. XenServer is now free, but it comes without the High Availability features and adding them would cost us about $2,300 – which is way over our budget. I would also like a web based interface so I can access and manage things from anywhere, and I’d like to sell VPSs – and customers definately need an interface to reload the OS, force a reboot, and get to a console in case of emergencies.

So why is a virtualized Uncorrupted a better thing? I can move the virtual servers over to a different physical machine if I need to replace hardware, add hardware, or patch XenServer… I can create backups and restore those backups quickly and easily (literally… 3 mouse clicks) in case of a hack or other emergency, and it’s just plain cool I can’t wait to see where this leads.

I typically keep one backup server racked in the datacenter in case of a hardware failure, or configuration issue that would require significant down time to resolve. I was made aware of an issue that was preventing some people from visiting clients websites and was unable to identify the problem. Firewalls were flushed, tests were performed, and I was able to get to the site from test servers in multiple different countries. I threw up a test site on the backup server and one of the folks who couldn’t load the website was able to get in, so I decided to move all the accounts onto this other server.

The migration started at about 3:00am – I started by restoring accounts that had private IP addresses and had them all back online in a matter of 20 minutes. I moved on to the shared IP clients and was unable to get a single one restored. I’m still not entirely sure what the problem was – but atfter about 6 hours of workin on the issue I decided there wasn’t anything I could do without heading down to the datacenter. I was tired, frusterated, and emotionally drained so rather than prolonging my agony, I called up a friend who also runs a hosting company and asked him if he would like some new clients. I was not prepared to leave everyone’s website offline for an extended period and I needed some rest. In the end, I believe I made the right decision… it was a difficult one to make because it basically meant the end of Uncorrupted (as I gave all the clients away), but it was very important for me to get everyone’s website back online.

So that’s what happened… stay tuned to hear where Uncorrupted is headed. It’s exciting.

Requirements:

• Terminal (SSH) access to your new and old web servers
• An SSH client (I recommend Putty)
• A text editor for modifying the dump.sql file we’re going to create (I recommend Aptana Stuido because it performs well when opening large (20+MB) text files)

During the migration process you’ll be copying/pasting paths a lot, so open up a new text document in Aptana and paste the following into it:

Old Server Info:
Path to public_html = /replace/with/real/path/
Wordpress DB Name = replace_Me
Wordpress DB User Name = replace_MeToo
Wordpress DB Password = NewSecretPassword

New Server Info:
Path to public_html = /home//domains/example.com/public_html/
Wordpress DB Name = replace_Me
Wordpress DB User Name = replace_MeToo
Wordpress DB Password = NewSecretPassword

Now open Putty and make a connection to your old server. Once you’re logged in, cd (change directory) into the public_html directory.
Type:

pwd

Paste the output into your text file. This is the path to public_html on the old server.

Log into your control panel and create a new database, copy the DB Name, User Name, & Password and paste it into your text document.

Back to Putty… you should still be inside your old hosts public_html directory. Type these commands:

cd ..
tar cvzf backup.tgz public_html
mv backup.tgz public_html

So, we moved up one directory and created a gzipped tar archive of your entire public_html folder. I choose to gzip the entire folder because if you’re in the directory and pass it the * operator it will skip hidden files (like .htaccess files), which we definitely want to leave in place. We also moved the backup file into your public_html folder so we can download it from the new server.

Open up another putty window and connect to your new server. cd into your public_html directory (@ Uncorrupted it is ~/domains/example.com/public_html/)
Let’s do some cleanup:

 rm -f index.html logo.jpg

Download and extract the backup file:

wget http://example.com/backup.tgz
tar zxvf backup.tgz
cd public_html
mv * ..

So, we downloaded the backup, extracted it, moved into the folder it created (public_html) and moved all the files out. We still need to move any relevant hidden files, so:

ls -la
mv .htaccess ..
mv
cd ..
rm -rf public_html

So now you’re back inside the real public_html directory on the new host. Grab the path and add it to your text file:

pwd

Lets tell WordPress which database to use and the username/password combo needed to open it:

nano wp-config.php

Find: define(‘DB_NAME’, ‘…’); Replace … with the DB Name in your text document
Find define(‘DB_USER’, ‘…’); Replace … with the User Name in your text document
Find define(‘DB_PASSWORD’, ‘…’); Replace … with the Password in your text document

Once you’re done editing the file, press + o to save the changes and + x to exit.

Let’s go back the the other Putty window (your old host) and dump the MySQL database – replace the DB info with the DB info from your text document.

cd public_html
mysqldump -u -p  > dump.txt

Download the text file to your computer and open it up with Aptana. We need to replace the path info throughout the database so click on Edit -> Find/Replace
In the find block, paste your old path to public_html and in the new block paste your new path to public_html. Make sure the Wrap Search check box is checked and click Replace All. Save the text document and upload it into your public_html directory on the new server.

Import the text file into your new MySQL DB:

mysql -u -p  < dump.txt

At this point, WordPress should be working. All of your posts, comments, media, etc should be working just as they were on your old host. You can test everything by editing the hosts file on your PC

Go to: C:\Windows\System32\drivers\etc and open up the hosts file with a text editor, go to the end of the file and type the IP address of your new server, press tab & type your domain name, save the document, close your web browser, and clean your DNS cache (click start, click run type ipconfig /flushdns & press enter). Next, open your browser and go to your site – everything should work. When you’re done testing, delete the lines you added to your hosts file and then save/close it.

At this point, all that’s left to do is change the DNS servers for your site and point them at the DNS servers provided by your new host. Some folks will continue to hit your old site and some will start hitting your new site. Within a couple days all your visitors will be hitting the new one. Keep in mind that it may be a while before you hit the new server too – that’s just the way DNS works. If you want to hit it instantly, check out my post about OpenDNS