Transition Technology: Ticket Query

#834: Slovenian State info missing again

sam — Thu, 26 Feb 2015 10:41:47 GMT

Hi Paul

The change that you made in this ticket: https://trac.transitionnetwork.org/trac/ticket/802

Seems to have been lost. I am no longer able to edit https://www.transitionnetwork.org/node/37435/edit

As the state/province information is missing.

Could you re-do the change please?

Thanks

Sam

#836: "Date is invalid" on film content type

sam — Thu, 05 Mar 2015 14:30:22 GMT

Hi Paul

Don't spend more than half an hour on this, if it takes longer I'll just remove the date field instead.

If I edit: https://www.transitionnetwork.org/node/35510/edit

Or add https://www.transitionnetwork.org/node/add/films

A film, the website it returns a "Year is invalid." error.

In the settings it's set to 'Y' https://www.transitionnetwork.org/admin/content/node-type/films/fields/field_film_year

I'm entering a four digit date, eg 2010

Any ideas?

Thanks

Sam

#853: Parrot access please

sam — Tue, 19 May 2015 17:07:13 GMT

Hi Chris

Ade & I were going to have a play around with making a proof of concept Wordpress microsite on Parrot.

Could you add me as a SSH user using the SSH keys associated with my sam@… account so I can follow the instructions here: https://trac.transitionnetwork.org/trac/wiki/ParrotServer#AddingaNewWordPressSite

Or if you'd rather not do that, just spin up a site titled 'conference15' with a user 'conference15' and my TN email as the admin email.

Thanks

Sam

#856: Blocked IP?

sam — Tue, 02 Jun 2015 13:12:52 GMT

Hi Chris

I was trying to SSH into the site and got my password wrong a couple of times.

Shortly afterwards the site appeared to be unavailable from this location.

It seems fine in pingdom/proxy servers.

My guess is something like fail2ban or similar has added this IP to a blacklist?

I wouldn't be too bothered except it's Ade's address and I think he probably wants access..

Could you check the logs if there is a blacklist and remove 146.198.11.57

Thanks

Sam

#857: Tiny MCE weirdness

sam — Tue, 02 Jun 2015 15:24:33 GMT

Hi Paul,

Myself & Rob have both run into an intermittent issue where when editing a panel page the WYSYWG editor (Tiny MCE) sometimes appears, sometimes doesn't.

When it doesn't appear you are left with the plain text html editor.

There seems to be no obvious pattern to it. So might be a tricky one to debug.

I see the version of Tiny MCE we are using is quite old, so I was thinking perhaps we should just try upgrading it on a dev server and see if that fixes it?

If this seems reasonable could you stick the latest Tiny MCE on your dev server so we could test it out there? Or if you have any other ideas for getting to the bottom of it..

Thanks

Sam

#859: Subscription emails broken

sam — Tue, 16 Jun 2015 13:08:44 GMT

Hi just got this mail

"For some reason I realized I wasn't hearing from Rob. You might want to check your system because mine hasn't changed as far as I know."

Had a look in my inbox & the last mail from Drupal subscription system was on 27th of May.

I may be the guilty party, as I did go in to edit the message around this time.

I'll investigate via the Drupal admin interface, but has anything else happened/ been done that could have stopped the mails?

#870: MediaWiki 1.23.10

chris — Mon, 24 Aug 2015 12:18:48 GMT

The announcement contains:

Bug Fixes in 1.23.10

(bug 67644) Make AutoLoaderTest handle namespaces
(T91653) Minimal PSR-3 debug logger to support backports from 1.25+.
(T102562) Fix InstantCommons parameters to handle the new HTTPS-only policy of Wikimedia Commons.

#874: Please check & then install Georss if no problems

sam — Tue, 29 Sep 2015 13:31:02 GMT

Hi Paul

We'd like to play around with generating Georss from our current site.

Could you have a glance at the code /test https://www.drupal.org/project/georss

If it seems like it's going to be unproblematic then please install it on the live site.

Thanks

Sam

#893: BOA Cron Jobs

chris — Thu, 24 Dec 2015 11:39:51 GMT

All the BOA cron jobs were stopped on ticket:846#comment:88. This ticket is for looking at them all and deciding which, if any, are needed.

#909: What's involved in enabling longer Piwik reports?

sam — Thu, 10 Mar 2016 15:47:27 GMT

Hi Chris

I seem to remember you were able to make Piwik run reports longer than a couple of months by adding some RAM? Is this a virtual thing you can do remotely? Or do you have to physically visit the box to make this happen?

I'd like to run longer reports to do a bit of analysis, but not if it's going to cost loads to make it happen.

Thanks

Sam

#855: Piwik plugins

sam — Tue, 26 May 2015 12:10:13 GMT

Hi Chris

I spotted Piwik has some plugins to extend it's usefulness.

I'm quite interested in playing with some of them, particularly the clickheat one:

https://stats.transitionnetwork.org/index.php?module=CorePluginsAdmin&action=userBrowsePlugins&idSite=1&period=range&date=previous30&activated=#

Is it OK for me to install it to try? Or do you think the whole thing would grind to a halt?

Thanks

Sam

#868: Is conference15.tn.org backed up in a convenient manner?

sam — Tue, 28 Jul 2015 13:05:25 GMT

Hi Chris

I was just wondering if the conference site is backed up in such a way that it would be easy to restore?

I could set up a database backup onto some free file hosting if not?

Thanks

Sam

#587: Puffin MySQL Tuning

chris — Thu, 05 Sep 2013 12:54:47 GMT

This ticket is to track the tuning we do to MySQL on PuffinServer.

See also previous comments on this issue:

#701: Emails & Telephone calls

paul — Tue, 18 Mar 2014 09:38:24 GMT

#763: Server Backups

chris — Mon, 21 Jul 2014 17:09:21 GMT

Two weeks ago annesley asked:

what off-site data storage, file backup and quick setup do we have?

I answered:

The 3 virtual servers have their file system mounted off a BSD/NFS/ZFS file server and the whole file system is backed up and stored onto another BSD/ZFS server in the same data centre. We did have backups also being copied to a server in Manchester but this is currently off-line as the Manchester server needs a disk swapping and rebuilding as a BSD/ZFS server.

A problem with this is that it's only me and Alan that have access to these backups, so I'd like to suggest I set up a new account for backups on our backup server and sort out cron jobs to rsync data to this account and document how people can access these backups.

The result would be that everybody would have SFTP access to 60 days worth of snapshots of backups from all three servers whenever needed without any need for my or Alan's intervention.

I expect this would take abount an hour to set up and another hour to document and help people understand it.

There would be no additional cost to the TN because backup space is already paid for.

#814: Higher that usual loads on PuffinServer since early September

chris — Wed, 03 Dec 2014 17:12:35 GMT

The following load graph from PuffinServer shows that the load increased substantially in early September 2014, does anyone know why?

When I found I went to Drupal 7.33 and all I got was a slow site I thought that perhaps a Drupal 7 site on the server could be the cause but 7.33 came out on 7th November 2014.

Anyone have any ideas?

#821: Projects forms being hammered by Spam

ed — Wed, 07 Jan 2015 09:53:33 GMT

Projects forms being hammered by spammers. I got 24 in the last 45 minutes.

What to do?

Lock off to a certain type of user?

Adding Sam as owner to follow this up

#824: Analysis of the 2014 maintenance ticket time

chris — Wed, 07 Jan 2015 15:48:14 GMT

Ed has ask that I spend up to 2 hours on an analysis of the 2014 maintenance ticket time for our meeting tomorrow in Bristol.

#847: Upgrade Servers to Debian Jessie

chris — Mon, 27 Apr 2015 09:30:11 GMT

The latest version of Debian, Jessie, 8.0, came out over the weekend, we should consider upgrading the three servers, PuffinServer, PenguinServer and ParrotServer and what issues would arrise when we do.

See the documentation on Upgrades from Debian 7 (wheezy) and Issues to be aware of for jessie, specifically:

#851: Bot attacks on Transition Culture

chris — Sun, 10 May 2015 11:12:12 GMT

Yesterday there was a load spike on ParrotServer caused by a bot doing thousands of POSTs to xmlrpc.php.

#871: Brute Force Attacks Against WordPress Sites

chris — Mon, 21 Sep 2015 13:41:26 GMT

Today there have been 53,932 attempts to login to the TTT web site on ParrotServer all from the same IP address:

grep POST /home/ttt/logs/access.log | grep wp-login.php | grep 217.174.240.254 | wc -l
53932

I noticed this due the higher than usual load it was generating.

Would it be OK to spend an hour or two installing the WP fail2ban plugin on all the sites on the server?

Some more background on this issue:

https://docs.webarch.net/wiki/WordPress#Brute_Force_Attacks

#873: New Wordpress site please

sam — Tue, 22 Sep 2015 12:25:12 GMT

Hi Chris

I couldn't ssh into parrot for some reason, I think you said you created me a 'sam' user on there but I can't get in.

So could you set up a new Wordpress site on there.

wpdev.tn.org or similar, it's only going to be for testing some stuff so URL doesn't really matter.

Thanks

Sam

#875: Free HTTPS certificates from Let's Encrypt

chris — Mon, 05 Oct 2015 10:48:11 GMT

From mid November 2015 Let's Encrypt should be live, providing free SSL/TLS certificates. Currently the TN pays for a Gandi wild card cert, costing £130.50 a year, in addition most the WordPress sites on ParrotServer don't have certs due to the cost, see ticket:540.

The Let's Encrypt code is designed to be set up to run automatically -- certs are only valid for 90 days and the automatic renewal process runs when the cert is 60 days old.

We should consider if we want to use Let's Encrypt and what things would need to be put in place to use it, the wild card cert is due to expire on 22/01/16.

PuffinServer -- are we still going to be running PuffinServer in January 2016? Is there any chance that we might be able to consider the suggestions in ticket:754#comment:61? I'm not sure if I want to spend time trying to get Let's Encrypt working with a old version of BOA, up to date versions of BOA might support it out of the box.
PenguinServer -- this site hosts a lot of sites, see the listing, automating Let's Encrypt would probably be a hour or two of work, it might makes sense to upgrade it to Debian Jessie at the same time.
ParrotServer -- I suggest we rebuild this server from scratch, this would enable it to have the latest version of the Webarch Secure Hosting scripts and this include support for fail2ban for WordPress and phpMyAdmin, thus solving ticket:871 and includes automatic provisioning of Let's Encrypt certs for sites.

What do people think?

#879: MediaWiki 1.23.11

chris — Fri, 16 Oct 2015 08:42:45 GMT

Email on the announcements list:

Tomorrow we will be issuing a security release to all supported
branches of MediaWiki.
The new releases will be:
1.25.3
1.24.4
1.23.11
Fixes will be available in these respective release branches, the
unreleased 1.26.x branch, and master. Tarballs will be available
for the above mentioned point releases as well.
This security release will encompass core only, no bundled extensions
are affected.

#881: Site on ParrotServer with a memory leak?

chris — Fri, 23 Oct 2015 11:19:04 GMT

It appears a site, or application, on ParrotServer might have a memory leak.

#892: MediWiki Security Release: 1.26.1, 1.25.4, 1.24.5 and 1.23.12

chris — Fri, 18 Dec 2015 10:46:18 GMT

Email to the announcements list:

I would like to announce the release of MediaWiki 1.26.1, 1.25.4, 1.24.5,
and
1.23.12.
These releases fix five security issues in core, in addition to other bug
fixes. Download links are given at the end of this email
== Security fixes ==
(T117899) SECURITY: $wgArticlePath can no longer be set to relative paths
that
do not begin with a slash. This enabled trivial XSS attacks. Configuration
values such as "http://my.wiki.com/wiki/$1" are fine, as are "/wiki/$1". A
value such as "$1" or "wiki/$1" is not and will now throw an error
(T119309) SECURITY: Use hash_compare() for edit token comparison
(T118032) SECURITY: Don't allow cURL to interpret POST parameters starting
with
'@' as file uploads
(T115522) SECURITY: Passwords generated by User::randomPassword() can no
longer
be shorter than $wgMinimalPasswordLength
(T97897) SECURITY: Improve IP parsing and trimming. Previous behavior could
result in improper blocks being issued
(T109724) SECURITY: Special:MyPage, Special:MyTalk, Special:MyContributions
and
related pages no longer use HTTP redirects and are now redirected by
MediaWiki
== Note about EOL of 1.24.x ==
Please note that 1.24.5 marks the end of support for the 1.24.x series of
releases. Technically this ended a few weeks ago with the release of 1.26.0
but
we dropped one final release of 1.24.x here to give it a nicer send off for
those who have not yet upgraded.
== Release notes ==
Full release notes for 1.26.1:
<https://www.mediawiki.org/wiki/Release_notes/1.26>
Full release notes for 1.25.4:
<https://www.mediawiki.org/wiki/Release_notes/1.25>
Full release notes for 1.24.5:
<https://www.mediawiki.org/wiki/Release_notes/1.24>
Full release notes for 1.23.12:
<https://www.mediawiki.org/wiki/Release_notes/1.23>
For information about how to upgrade, see
<https://www.mediawiki.org/wiki/Manual:Upgrading>

#894: Brute Force Attacks Against WordPress XMLRPC

chris — Thu, 07 Jan 2016 11:23:51 GMT

For a few months I have see a lot of requests going to WordPress /xmlrpc.php and wasn't sure why, now it is clear:

Instead of going against wp-login.php (which can be easily blocked or protected via .htaccess) or doing a single attempt against xmlrpc, attackers are leveraging the system.multicall method to attempt to guess hundreds of passwords within just one HTTP request.

https://blog.sucuri.net/2015/10/brute-force-amplification-attacks-against-wordpress-xmlrpc.html

I'd like to install Stop XML-RPC Attack on all the WordPress site we host, unless anyone has a good reason not to. This plugin simply whitelists the JetPack/Automattic's subnets and blocks all other access to /xmlrpc.php.

I started tracking the abuse a while ago and you can see it and manually address it on ParrotServer like this:

sudo -i
wp-xmlrpc-abuse
IP addresses accessing xmlrpc.php more than twice for the last 1000 lines of each access.log:
      2 46.148.XX.XX
    733 195.62.53.243
    177 195.62.53.243
      2 66.76.XX.XX
dig -x 195.62.53.243 +short
  53-243.static.spheral.ru.
ipdrop 195.62.53.243

But we need to be more pro-active in blocking access or we are going to probably see some compromised sites.

#897: Hosting information/requirements for 2016

chris — Tue, 19 Jan 2016 10:14:57 GMT

This is a ticket to track the time spent on an email thread with Ade.

#901: Enable SSH access to PuffinServer for Ade

chris — Wed, 03 Feb 2016 13:25:27 GMT

This is a ticket to track the time spent sorting out SSH access for Ade to PuffinServer.

#903: Large load spike on PuffinServer

chris — Mon, 08 Feb 2016 08:46:37 GMT

There was a large load spike this morning on PuffinServer, which appears to have been caused by 12k requests for pages (Nginx doesn't log requests for anything other than PHP generated pages) from one IP address, this IP address has been blocked and I'll post some details below.

#904: Issues to consider in the migration from Drupal to WordPress

chris — Fri, 19 Feb 2016 10:41:04 GMT

A few weeks ago Ade said he though it would be worth me opening a ticket to use to flag up some issues to be considered in the migration of the Transition Network site from Drupal 6 to WordPress.

#905: TN site down due to redis not running

chris — Thu, 25 Feb 2016 10:28:40 GMT

I'm working on this...

#907: TN Drupal database size

chris — Wed, 02 Mar 2016 10:20:10 GMT

6 weeks ago the datadase dump was 447M, see trac:ticket/896#comment:3 but now it is 1.8G:

ls -lah /var/backups/mysql/sqldump/transitionnetw_0.sql
-rw------- 1 root root 1.8G Mar  2 01:23 /var/backups/mysql/sqldump/transitionnetw_0.sql

Anyone have any idea what happened to cause this? Are we keeping too many log entries?

#860: More details on Server provision

annesley — Fri, 19 Jun 2015 10:29:09 GMT

we would like the following details on all servers provided by WebArchitects? (Penguin, Puffin and Parrot):

CPU type, speed, and characteristics Disk Space RAID type Traffic limits and characteristics Bandwidth limits and characteristics

Thanks!