I know I should be in bed, but I just made a change to my MediaWiki install which is very important. See, it’s my understanding that Google doesn’t like it very much if you are displaying AdSense ads on non-content pages.

Since MediaWiki has lots of these which I regularly use, I don’t want to upset Google by inadvertently serving myself a bunch of ads which are on these non-content pages.

The solution? Easy. Just don’t show ads on pages for users who are logged in. Since I’m using MediaWiki as a CMS, I’m the only person who will ever be logged in. So, to solve my problem, I wrapped the includes for the ad files in this:

<?php if($this->data['loggedin']!=1) { ?>
...
<?php } ?>

I know this is really basic, but I imagine others may want to know about it, so I’m documenting it here.

Yay. All websites which I am going to continue to host and for whom the owners have contacted me have been moved to the new server.

Additionally, plans are in place to move all email over.

If things go as I’m hoping they will, I’ll have the server powered down this weekend. It’s too bad that I’m going to be wasting half a month of hosting fees with Waveform, but such is life, I guess.

I guess it’ll be back to my more ‘normal’ projects soon. :D

Things are progressing well with the server move. Except for email.

I’m having big problems with DreamHost’s email. I set up users and things just seem to never finish getting set up.

I’m not sure what’s going on yet… Hopefully tomorrow there will be someone who can explain to be what’s wrong and what is being done to fix it.

< sigh >

This is why I ran my own server before. Because if something was fucked up, it was my fault and I could only blame myself if things weren’t working right.

Option ‘B’ out of this whole thing is to drop ~$1400 on a new server and shuffle everything over to it. But then I’d have the same headaches as before.

1) I just received this IM:

[18:46] 170422095: Ready to buy iframe traffic. We pay
80-500US_dollars for 1000 installs.
- We pay with: wm, fethard, egold, WU, wire, paypal
- We pay every week
- Online statistics
- Friendly support service
- Recommendations of well-known AWMs
- We have been buying traffic for more than four years

Phil | ICQ# 362066 | AOL ScreenName: rfmciframe

I’m not accustomed to seeing such offers.

2) The following domains should have their web presence working:

http://www.bunjamin.net
http://www.kencavanaugh.com
http://briansphotos.nuxx.net
http://tydeus.nuxx.net
http://www.nythia.com
http://www.sayyestolibraries.org
http://www.trasenstine.com

I’ll probably get to a few more of them tonight. Email will take a bit more time, too. Things are done differently at the new place, and I need to take all users’ needs into account.

Except for the beer, that’s basically what I’ve been looking at for the last two days straight. Now I’m taking a bit of a break.

At the end of today I have:

· Restored all of nuxx.net, sans email. (That requires more thinking.)
· Set up vhosts for all domains which will be moved.
· Set up DNS for all domains which will be moved.
· Wholly moved nythia.com.

And… I just ran out of interest in writing any more. Ah well. :)

Anyway, things with this change are going good. Thanks everyone for being so understanding, and thanks for getting a hold of me so we can get the transfers to happen.

Well, nuxx.net is mostly back. I say mostly because there’s still some things which I have’t re-uploaded, but… They aren’t quite needed.

As far as the other sites go, I’m changing around how I had things segmented. As part of this I’m first moving (and setting up) the sites which host just photo galleries. That is, these domains first:

abrazos.net
briansphotos.nuxx.net
gallery.tehlunix.org
jasonandstacie.com
kencavanaugh.com
pics.joythemonster.com
trasenstine.com
tydeus.nuxx.net

Except for Tydeus’ photo gallery which is being upgraded to G2 they all should look pretty much just as they did when the server rebooted during the attack.

The other sites are going to be a good bit more work, especially because of the email setup. Those will get done as I can do them, likely over the next few days. Remember, mail is still working. You can check mail by visiting http://204.11.33.41/mail to get to things via SquirrelMail, or just put in 204.11.33.41 or rez.nuxx.net in your mail client as the host to check. Email was never touched in this attack and it works just as it has.

Also, if I host stuff for you, you need to change the nameserver entries at your registrar. The new nameservers for my hosting are ns1.dreamhost.com, ns2.dreamhost.com, and ns3.dreamhost.com. DO NOT change your host to these until you’ve talked to me. Things should be timed well so that there aren’t any issues.

Finally, if I host stuff for you and we haven’t talked about what I need from you in order to move things, you’ll probably want to get a hold of me ASAP. Instant messengers are probably best, but phone will also work. Just… Yeah. Get a hold of me.

Oh, and if you’d like to see what all the hacked pages were replaced with, take a look here: http://204.11.33.41/hacked.html. That’s a copy of the file which replaced the content of most of the websites with the images mirrored locally. There doesn’t appear to be anything malicious in the images nor the code itself, so it’s safe to view.

Anyway, that’s enough of my rambling. Hopefully by now a bunch of the photo galleries have finished syncing and I can get to work setting those eight galleries up.

Okay, since people probably want to know, here’s what’s going on with rez.nuxx.net:

· All hosted websites are down. Sorry, no ETA on this. I have to move them all over by hand.
· Email should be working just fine. If some of you would do me the favor of replying to this post as a test, that’d be great.
· Things are being moved to a new server / hosting system at Dreamhost. This means usernames and/or passwords and/or ways of setting up things might change. This will probably be good and bad. I’ll let you know.
· I’m moving my stuff first, then other people’s, in no particular order. The biggest hurdle I’m waiting for right now is the copying of my rather large photo gallery. Once this is over and working again I’ll get to work on other people’s stuffs.
· Don’t expect everything to be done before the weekend is up. This is a lot of work.

I apologize if I’m sounding like an asshole about any of this, but I’m a bit stressed right now and I’m trying not to. Also, I expect a bit of fallout from a few people regarding this, and I’m not looking forward to having to deal with that.

Well, I’m pretty certain I know how the attack was done.

It appears to have been a phpBB exploit targeted at crisishour.com launched from 213.219.122.11.

Within the course of ~30 minutes that IP hit every single vhost I’ve got, and on crisishour.com it actively went and ‘did things’ in phpBB. Looks like via whatever hole in phpBB it deleted the contents of every vhost it could find and tossed an index.html or index.php in the root, as appropriate. I believe it also may have parsed the config files for Apache, because it seems like a pretty intelligent script. It also deleted all files and directories that www:www had access to in those subdirectories.

Fortunately things in the database and Gallery data directory are intact. I just need to move all of that over to Dreamhost one site at a time. This will take a while.

For what it’s worth, that IP is zone-h.org, which appears to be a shady ‘security’ site and the IP is owned by people in Estonia.

So, lessons learned?

1) Separate privileges based on site.
2) Don’t host domains for people who won’t keep their shit reasonably up to date and won’t stay in touch with me.
3) Don’t run phpBB until it’s been secure for a while.

Click for log info…