Code, InfoSec and Server Stuff

Views are personal and not my employers.

Personal Development Blog

Coding for fun since 1996, Learn by doing and sharing.

Create your own server on UpCloud here

Follow me on Twitter: @FearbySoftware

View My Old Hobby /blog/

View All Posts.

a

How I upgraded from a standalone 1Password 6.x licence to 1Password (7+) cloud subscription on OSX

by

This is how I upgraded from my standalone 1Password 6.x family licence to a 1Password 7 cloud subscription on OSX. I am not reviewing 1Password here.

Advertisement:



This is NOT a paid endorsement, this is output from my legitimate quest from upgrading an old stand-alone family licence to a cloud subscription. I have been using 1Password for the past 5 years and have recommended it to everyone I know.

Always backup your data before updating (things can go wrong), good luck. At the time of writing 1Password 7 was not out of beta.

Why

I have a number of guides on moving away from CPanel, Setting up VM’s on UpCloud, AWS, Vultr or Digital Ocean and let’s say 1Password has helped me store everything from service invoices, SSH password service passwords etc. I did have a stroke last year (caused by the flu (a cough) and luckily all is OK ) and I now realise that having everything out of my brain and in a secure vault is a good idea (touch wood).

Reasons why I use 1Password – Password Manager.

  • It is a good idea to use a password manager.
  • It has allowed me to have a different password on every site I use.
  • I managed to stop using my old “same” password on every site I used since the 1990’s.
  • I am paranoid (check out https://howsecureismypassword.net/, https://haveibeenpwned.com/ and google “sites hacked” or “passwords exposed”).
  • It’s a good idea.

1Password 7 News

1Password 7 has been hitting my twitter timeline, should I upgrade? Here is the official upgrade guide.

Security Researcher Troy Hunt’s – https://haveibeenpwned.com/ is now a feature in 1Password 7

I wrote a PHP implementation to check a password exposure level with Troy Hunt’s pwned passwords API and know it’s a good idea.

Also, there are loads of great features in 1Password 7.

1 Password site showing 1Password 7

Anything that can help create secure passwords is a good idea.

1Password Twitter Support Shoutout

Before I begin I would like to acknowledge the patient 1Password support team on twitter. They answered well over 20 questions from me and handled my frustrations of there not being a clear standalone family licence, I suspected a plot to force people onto a cloud subscription at first.

In an ideal world upgrading, 1Password should be an easy process (1Password Twitter Support indicated)

NBN Support

Load’s of 1 Password activity on Twitter

Before I downloaded the latest 1Password 7 I fired heaps of questions at the twitter support. I hope 1Password give them a raise or bonus.

1Password Twitter DM's

I did spend way too long reading past the negative 1Password support posts on “where is the standalone licence”, “beta discounts are gone”, “why so expensive” and “how can I upgrade from 1password 6 and still use dropbox” etc.

1Password Forum Searches

I ended up logging a support ticket (looking for the unicorn beta tester discount/stand-alone licence, I think I was too late to join the beta program).

1Password Forum Support

I backed up my 1Password 6 data

Always take backups of your data before upgrading anything.

    • Open your existing 1Password 6
    • Click File, Export, All Items
    • Choose a File Name and press Save
    • Verify Data (open Finder)

    Backup Existing 1Password 6 Vaults

    I also backed up the 1Password file in Dropbox before upgrading. Simply drag it to your desktop.

    Advertisement:



    Backup Dropbox Vault

    I visited https://1password.com/extlink/signin/ and…

    1. Signed in (create an account if you don’t have one), I had one from a previous support ticket I logged.
    2. I chose “Individual” account type.
    3. Specified my Email Address
    4. Verified My Email

    1Password signin process

    Then I..

    1. Added my Name
    2. Skipped the Credit card option (to activate the trial)
    3. Generated a master key (this is combined with your password)
    4. Created a new password for a new password vault
    5. Logged in
    6. Saved my Emergency Recover PWF (with details)

    Account Details

    I did have a peek at the 1Password SSL certificate strength and other tools and they came up all good (I don’t want to use an insecure service).

    You too can test SSL on sites with https://dev.ssllabs.com/ssltest/

    Check 1Password SSL

    The only concern I have is TLS 1.3 is not an option yet. I use it on my blog’s web server (guide here) also a few SSL labs identified weak cyphers are presented as available from the server (Is this an issue)?

    I also had a look at Google Chrome’s developer console to see if anything out of the ordinary was popping up? The console appears a little chatty? TLS 1.2 was in force securing the client/server communications so that’s nice.

    1Password Website Debug Output

    Now that I am logged into my cloud 1Password (trial) account I can…

    1. Add/View/Edit/Delete items in my vault.
    2. Download desktop/mobile apps.
    3. Import data to vaults.
    4. Turn on Two Factor authentication.
    5. Create/Edit/Delete a password vault (or set as default).
    6. Update billing details (if you wish to subscribe)
    7. Contact Support

    Get 1 Password Apps

    Now I can connect my new 1Password cloud account to my local 1Password 6 installation by.

    1. Open 1 Password (on my Mac)
    2. Open the Preferences and go to the Account tab
    3. Click on Scan the account details
    4. Move the scan window over a QR Code (Setup Code) in a logged in 1password.com screen (login detail like login server, master key and username are auto-entered).
    5. Enter my vault password.

    Loud Account

    Advertisement:



    Now I am prompted to import my local 1Password data into the cloud account from my local 1Password.

    Import Old Items

    When the import completed I was prompted to delete the local vault (I said yes because I backed it up).

    Remove Old Vault

    Tip: 1Password 6 on my Mac did not appear to delete the Dropbox data so I deleted this manually.

    After a few minutes, I noticed Dropbox was still syncing files?

    1Password is still using Dropbox

    Troubleshooting: I had to set my new cloud vault as the primary vault to save to and not the old vault that was syncing via Dropbox. I also deleted all links to Dropbox on iOS and Android devices.

    I did notice that 1Password was 6.8.9 (I thought 1password 7 was the latest?, I did try the update button). I ended up ticking “Include beta builds” and then 1Password 7.0 is a download option (maybe this will change in the next few days)?

    Opt Into Beta

    I opened 1Password 7 on my local desktop.

    1Password 7 instaled

    I had a quick look around in 1Password 7 for the https://haveibeenpwned.com/ feature. I opened an existing account I added to 1Password. It look’s nice.

    Vulnerable Passwords Feature

    Some nice alerts and features I noticed when viewing my data in 1 Password 7.

    Some 1 Password features noticed

    Aside: I had to opt into beta builds on Windows to get 1Password 7 too.

    Windows 1Password Instaled

    Summary

    When I set out and wanted a stand-alone licence but it appears I would need to pay for a licence on Windows and Mac and portable devices.

    I overlooked an earlier DM from 1Password (that provided the purchase links) so I decided to go with a subscription (I think I missed the BETA program too, no reply from the hockey app email when opting into beta on Windows).

    Standalone

    Buy standalone licences

    From what I could see standalone licences only work via Dropbox (or locally) and not via the 1Password cloud.

    However, the subscription does away with the requirement to buy multiple licences (all apps are free once you subscribe). I am not sure when 1Password 8 is coming out so I think it is wiser to go with a yearly subscription (that’s about 10.8c a day in Australian peso’s).

    Time to Subscribe

    I pulled the trigger and subscribed 🙂

    Subscribe

    Advertisement:



    One nice thing is the trial time is added on to the subscription length so if you have 30 days left in the trial it add’s on to the yearly subscription length (13 months), that’s nice.

    Subscribed

    Conclusion

    Happy = Yes (they are shooting fish in a barrel)

    Could have been easier to upgrade from 1 password = Yes

    I hope this guide helps someone.

    Find out more about 1Password at http://1password.com/

    Ask a question or recommend an article

    Your Name (required)

    Your Email (required)

    Your Question

    Revision History

    v1.3 Fixed typo in the title/url.

    v1.2 Added Links

    v1.1 Added Conclusion

    v1.0 Initial post

    Open a Windows 10 Boot Camp Installation on OSX in Parallels (like a VM)

    by

    This guide will show you how you can open a Windows 10 Boot Camp Installation on OSX in Parallels (like a VM).

    Advertisement:



    Installing Parallels on a Mac allows you to install Windows in A VM, this is handy but you may want to install Windows on a Mac drive with Boot camp (guide here)  for better performance.

    Can you load this VM-less Windows install in OSX rather than reboot it, the answer is YES (with Parallels v13).

    Setup your Windows Bootcamps (see my guide here).

    Create a new VM image in Parallels (Select Boot Camp)

    New Image

    Click Continue

    Use Windows Bootcamp

    Confirm the reaction warning.

    Before You Proceed

    Name the VM and choose a location

    Location

    Set desired memory etc.

    Choose your desired clipboard and disk access settings.

    Options

    Done, now Parallels will prepare your VM (Really Boot Camp)

    Created

    Preparing

    Creating VM

    Parallel tools will be automatically installed.

    Configuring

    Done, you will now be able to load your Apple Bootcamp partition as it is was a VM inside OSX (or boot it)

    Windows

    yes, the VM file is pointing to the Boot Camp partition.

    VM File

    I hope this guide helps someone.

    Ask a question or recommend an article

    Your Name (required)

    Your Email (required)

    Your Question

    Revision History

    v1.0 Initial post

    How to backup WordPress on a host that has CPanel

    by

    This is a simple guide that demonstrates how you can log in to a host that offers the CPanel tools to backup all of your website files (and databases). Backing up your website should be done often and especially before you migrate to any another website host. I used to change hosts every few years (they don’t own your site, you do).

    Advertisement:



    I have a number of guides on moving away from CPanel, setting up VM’s on UpCloud, AWS, Vultr or Digital Ocean along with installing and managing WordPress from the command line copying files to a server via command line editing remote files locally etc but how do you manage a website with CPanel?

    You can normal login to CPanel tools on a shared host by loading www.yourdomainnam.com/cpanel (failing that login to your domain hosts web GUI and find your CPanel interface there).

    Step 1: Login to your Host

    Login to your web host

    Login to Host

    Step 2: Find your CPanel Interface

    Hosts are a bit different but in this case, I just click my domain to find the CPanel link.

    Domain

    I found it, I clicked the CPanel login.

    Cpanel link

    Step 3: CPanel Applications

    CPanel does offer good tools to manage your websites like web-based File Manager and Database tool called phpMyAdmin.

    CPanel Options

    Aside: CPanel/Hosts Downsides

    The thing I don’t like about hosts that offer CPanel is they usually limit delivery of your website to extract more money. Nothing worse than receiving Resource Limit Is Reached errors.

    cpenal_usage_exceeded

    Also shared hosts usually lag way behind in newer software versions like PHP and MySQL (this is a security concern).

    TIP: You can scan your site for vulnerabilities using Qualsys Freescan, Zap or Kali Linux.

    Here is a security scan of a shared host (with CPanel) that I was using in 1999. Note the high vulnerabilities and old version of Linux.

    Static Website

    Also, a shared host will often overcharge you (e.g $150 a year) for a poorly configured SSL certificate.

    This was an SSL cert I paid $150 a year for (evaluated with SSL Labs SSL Test) on a shared host with CPanel.

    Aside: Self Managed Upsides

    After I moved my domain to a self-managed virtual machine I migrated WordPress, set up a free SSL certificate, sped up my site with a CDN, setup Cloudflare, setup better TLS security etc

    When you manage your own server you can install a free SSL certificate in under 1 minute.

    Below is my SSL certificate. A strong SSL certificate will increase search engine traffic

    SSL Cert

    Aside: Compare Shared host speed v Self Managed

    FYI: https://gtmetrix.com/ is a great site for measuring the speed of a website (shared of self-managed). I found great speed improvements after moving away from a host offering CPanel, tweaking the server and setting up cloudflare. A self-managed server will allow you to tweak anything you want.

    GTMetrix results:

    Shared Host Speed

    I like how self-managed servers allow you to scale the server’s resources yourself, move servers or add storage etc.

    Aside: SSL Certificate

    If you have an SSL cert you should test it often as vulnerabilities pop up from time to time.

    FYI: All sites will soon require an SSL certificate to be sent traffic from search engines (no SSL = lower traffic).

    SSL Test my site: https://dev.ssllabs.com/ssltest/analyze.html?d=fearby.com&s=104.27.154.69

    Now enough with the self-managed serve asides and back to how to backup your website with CPanel tools.

    Step 4: Backup your web files in CPanel

    Use the File Explorer app in CPanel

    File Manager

    Highlight all files that you want to backup (highlight everything but not past backup files).

    backup-cpanel-006

    View the files to compress summary

    Compress Summary

    Click Compress Files(s) and view the backup progress

    Backup Progress

    You can now download the backup zip file in your browser (click the file and click Download).

    Downaload ZIp

    Download Progress.

    Download File

    Step 5: Backup your database in CPanel

    Now we need to backup any MySQL database(s) that may be used by WordPress

    Open the phpMyAdmin app in CPanel.

    phpMyAdmin

    FYI: Alternatively, you can use a free tool called Adminer to backup and restore our database.

    Click your WordPress database (on the left). You can identify your current WordPress database by opening the wp-config.php file.

    Database Options

    The first step is to perform an online cold backup of the WordPress database.

    1. Click the database you want to backup (on the left)
    2. Click the Options tab
    3. Under the Copy To frame enter a new database name to copy the database too
    4. Click Go

    Online Backup

    Now you have an online cold spare that you can use just in case the original database corrupts itself. You can rename the database or configure WordPress to point to this new database if need be.

    backup-cpanel-013

    Now let’s download a copy of the database (Repeat for multiple databases).

    1. Click the database you want to backup
    2. Click the Export tab
    3. Click Go

    backup-cpanel-014

    You should now have a backup of your website in a zip file and an export of your database in a .sql text file, SQL files can be re-imported to databases later.

    TIP: Backup often.

    Export Done

    I hope this guide helps someone.

    Ask a question or recommend an article

    Your Name (required)

    Your Email (required)

    Your Question

    Revision History

    v1.0 Initial post

    Enabling TLS 1.3 SSL on a NGINX Website (Ubuntu 16.04 server) that is using Cloudflare

    by

    This guide will show you how to enable the latest Transport Layer Security (TLS) 1.3 protocol with it’s predecessor Secure Sockets Layer (SSL) with NGINX and OpenSSL for better website security on an Ubuntu 16.04 server

    Advertisement:



    I have a number of guides on moving hasting away form CPanel, Setting up VM’s on AWS, Vultr or Digital Ocean along with installing and managing WordPress from the command line. Making sure your server is up to date and running the latest SSL software is important. I have updated Open SSL before and blogged about this here.  Do backup your server before changing settings and if you use  Cloudflare (if you don’t do it now) enable Development Mode (and disable caching until changes are made).

    TLS 1.3 is the latest SSL security protocol that can be used between clients and servers to encrypt connections on the web.

    TLS 1.3 uptake is only 60% according to https://caniuse.com/#search=TLS%201.3

    TLS 1.3

    Read why TLS 1.3 is important and news on TLS 1.3 can be found here: https://www.openssl.org/blog/blog/2018/02/08/tlsv1.3/

    The Good and Bad

    Done be like this commercial site with very poor security (tested with SSL labs and asafaweb)

    Bad SSL

    Here is what the top 1 million sites do

     

    Installing Open SSL on Ubuntu

    Connect to your Ubuntu 16.04 server via SSH (I connected to my Vultr server)

    Check what version of OpenSSL you have? My OpenSSL is out of date.

    Tip: What Ciphers does your Open SSL Support?

    Time to update Open SSL

    OpenSSL 1.1.1 beta is available and supports TLS 1.3  but it is n BETA form.  OpenSSL code is available here.

    I did the following to download and build the latest version of OpenSSL.

    I tried to check the open SSL version but had an error?

    A quick GitHub ticket revealed I needed to set a path variable.

    Open SSL now reports it’s version.

    What version NGINX do you have (1.13 supports TLS 1.3) read here

    Backup your NGINX

    Do backup your server files and take a snapshot if need be.  I am not responsible;e for a broken server,

    Edit NGINX Configuration

    Update NGINX configuration: /etc/nginx/sites-available/default

    tip: Review other NGINX hardening settings here.  Also remove TLSv1.0

    I tested my NGINX config loaded them and restarted NGINX

    Check the status of NGINX

    If you have configured Cloudflare then log in and enable TLS support.

    Cloudflare TLS Settings

    Enable TLS 1.3 in Chrome by visiting chrome://flags/#tls13-variant This should be automatic in later versions of Chrome and other browsers.

    Enable TLS in Chrome

    Verify TLS

    I used the developer tools in Chrome to confirm the page was verified in TLS 1.3.

    Verify TLS

     

    Updated to 1.1.1-pre6-dev

    Don’t forget to test your SSL strength with https://dev.ssllabs.com/ssltest/

    SSL Test 2018

    I hope this guide helps someone.

    Ask a question or recommend an article

    Your Name (required)

    Your Email (required)

    Your Question

    Revision History

    v1.3 added bad ssl cert.

    v1.2 ssl test v1.1 updated to 1.1.1-pre6-dev

    v1.0 Initial post

    How to purchase your own domain name and set up a web server from $5 a month

    by

    This guide will show technically minded people how you can purchase your own domain name, set up a web server on Vultr with an online store using WordPress/WooCommerce from $5 a month. Warning this post is technical (if you have never used SSH, Ubuntu, Linux Command Line, hate risk or are not patient then this is NOT the guide you are after).

    Advertisement:


    Draft Post (released early to share)

    I personally recommend (not a paid endorsement) the free WooCommerce plugin for the free WordPress.org CMS on the free Ubuntu Operating system with the free NGINX web server and the free MYSQL database engine and free SSL certificates from Lets Encrypt.

    Sorry for using the word free a lot but I like free things.  One of the benefits of a using a self-managed server is you get the option to install free software and configure the server how you want and secure it how you want. Truth be told managed ho (e.g CPanel, etc) are in the business of making money via monthly feed, expensive SSL certificates, taxing your transactions or pushing you to higher priced tiers.

    Legend:

    • Self Managed Server = A server that you create, you configure patch and support (all the reward and risk is owned by you and costs are low).
    • Hosted Server = A server you have partial control of and the hosts manage the server and support (You hand away all risk and most of the control and pay for support/features).

    I moved to a self-managed server after I was paying $25/m for a poorly performing website and $150/y for a poor quality  SSL certificate and a slice of a server that seemed to always say “Usage Limit Exceeded”. Why pay for an insecure website that my visitors could not view because the usage limit was exceeded.

    Bad CPanel SSL Certificate

    fyi: Fearby.com costs me $10 a month for a server and $5/m for CDN abilities.

    CPanel hosts are an option when you don’t want to self-manage a service and take on the hassle but be prepared for server limitations (The image below was taken on an older CPanel based hosts before I moved to a self-managed Vultr server)

    cpenal_usage_exceeded

    I recently discovered a well known and established website hosting service (that I used to use) and a friend is still using is insecure. My friend’s site has a static website on it but the server underneath was very old and insecure. Having a secure web server should be at the top of your list with any self-managed or hosted website (this will help search engine optimization and prevent risks to your website visitors).

    Static Website

    Sites like Virus Total, SSL Labs and Alexa Site Info , Qualys are good ways to review a site’s credibility.

    fyi: The awesome https://seositecheckup.com/ is awesome for evaluating our sites SEO score.

    Before we set up a server with WordPress on your own server let’s quickly look at the alternative commercial ready to go website builders.

     

    Alternative (paid) DIY Website Builders

    The following leading commercial sites will allow you to build a site online.

    In my opinion, five things matter with setting up site online website.

    • Setup Costs, Monthly Cost and Commissions (what are the hidden charges)
    • Security (having a food SSL Certificate is key to having a good organic traffic from search engines)
    • Site Speed (Having a slow site will impact search engine optimization and drive visitors away)
    • Accessibility (if your site is not WCAG accessible it will not rank high on search engines).
    • Control (will you be able to do everything you want too, nothing worse than going so far and being limited)

    Ok, let’s see how much it will cost to set up a simple business site on the sites above.

     

    Wix 

    Setup: Goto https://www.wix.com/, Login to Wix, click Create Site, click Business, Click Choose a Template, Edit the page, Click Save, Click “Connect your own customized domain“, Click “Connect a domain you already own“.

    I was redirected to a Wix plan pricing page where I need to choose a plan to continue. From what I researched you cant control HTML on Wix so can’t add a MailChimp newsletter signup form so you would have to go with the $24.5/m option to enable Email Campaigns.

    Wix Plans Chooser

    I could not see information about included SSL certificates, SEO or other chargers.  SSL is free after you pay right?

    The Wix editor appears OK (it may take a bit of learning though).

    Wix Editoer

    I clicked publish and the site was live

    Wix site published

    A quick check of the SSL, Accessibility and SEO and no obvious deal breakers here apart from the price and platform lock-in.

    Wix Checkup

    I performed a security check on the site with https://freescan.qualys.com (passed)

    Conclusion: I hear Wix templates are hard to change so choose your template wisely, A large collection of apps are available that you can add to the site.

    Although Wix was nice and it does include a full-featured look at the engine it is not for me ($24/m USD is too expensive).

     

    Squarespace 

    Squarespace basic websites cost $16/$25 a month or $34/52 for online stores: https://www.squarespace.com/pricing/

    SquareSpace Pricing

    Setup a Squarespace website: Goto https://www.squarespace.com/, Click Start a Free Trial, Choose a Template, Create an Account (a quick read of the terms of service and privacy policy, #scary), SpareSpace sites are pre-published?

    Square Space Build

    Loading the webpage on a non-logged-in (with SquareSpace login) browser displays a trial warning.  Trial pages are essentially restricted (unlike Wix).

    Login Challenge

    The mobile view does not match the template?  I guess the chosen template is more of a vibe and not a template.

    Mobile view

    Setting up a Squarespace website may take some time. Squarespace does have some nifty advance options in a slide-out menu though.

    Squarespace Settings

    Because the public view of the page is restricted I cannot scan it with WCAG accessibility tools. Scanning the site performance speeds with gtmetrix also fails.

    Performance Rejected

    Squarespace is well known to be difficult to set up a website when compared to other drag and drop editors (but Squarespace sites do look nice).

    I am not paying $54/m for a website so let’s move on.

     

    Shopify

    Shopify Setup: Goto https://shopify.com and click Create, Sign up and enter your store name. Complete the wizard. 

    Shopify

    Choose a Shopify Plan

    Shopify Plan

    Scalping transactions, no thanks. let’s move on.

     

    Weebly

    Weebly Setup: Goto https://www.weebly.com/au and click Get Started under Create Store. Enter your account details and click Create Your Site, enter the name of the store, Click I’m just trying Weebly, click the type of product you will be selling.

    Weebly Site Setup

    Weebly Setup

    Theme Selection

    Theme Select

    Choose a Domain

    Domain Select

    Publish the site

    Publish

    Clicking publish appears to be a dead end.

    Verify Weebly

    “Please contact Weebly Support to verify your account”, No Thanks, let’s move on.

    One candidate remains and that is WordPress hosted (wordpress.com not wordpress.org).

     

    WordPress.com

    WordPress.com offer hosted plans for WordPress in the cloud.

    Setup a WordPress site, the only one that removes WordPress branding and allows third-party plugins to be installed it the Business plans for $33 a month.

    WordPress Plans

    Setup Basics

    Wordpress

    Choose a WordPress theme.

    Choose Theme

    Assign a Domain

    WordPress Domain

    In order to buy a domain, you need to log in (top right) with an account

    My working WordPress account (is no longer working), it was in my password manager.

    wordpresscomerror

    I seem to be stuck in a signup loop

    Wordpress

    Time to move on. Time to set up my own server on Vultr and setup WordPress and  WooCommerce,

    But, before we do, let’s ensure our name is secure online.

    Search for your Name/Brand

    Do search for your website (or thing) in search engines to see if your name is already taken, don’t buy a domain that is owned or has IP or trademark presence. It is a  good idea to use sites like https://namechk.com/ to see if your site or social media is already taken.

    https://namechk.com/

    namechk.com will allow you to search for name availability online.  The name “mything” is not fully available online.

    https://namechk.com/ 2

    You will want to see all green squares (name available) below before buying a domain name. This looks better.

    Namechk ok

    I would recommend you create your social media accounts before or right after buying your domain. Sites like Twitter will insist on short usernames names so get your social media sites first.

     

    Trademark and Brand Search

    Also, perform a trademark and IP search.

    Australian Trademark Search: https://search.ipaustralia.gov.au/trademarks/search/quick

    United States Trademark Database: https://www.uspto.gov/trademarks-application-process/search-trademark-database

    Global brand Search: http://www.wipo.int/branddb/en/

    etc

    Self Managed Warning

    I tend to go the “self-managed server route” and install the free WordPress CMS because:

    There are many reasons why you would not want to “self-manage” your own server

    • Technical Requirements (and time to support).
    • Higher Risk.
    • Applying Updates and Patches.
    • etc.

    Being technically minded and choosing a “self-managed web servers” can take away time from the fun stuff like SEO, Site Design, customer needs, branding etc.

    Self Managed Costs

    For $5 a month you can buy a server with enough memory to install WordPress (cheaper if you don’t need WordPress)

    Vultr is great. Vultr does have ready to go servers that you can deploy that have WordPress all set up.

    wordpress-template

    The Vultr template above does use the Centos OS (read my guide setting up Centos on a different service provider here) but I prefer to manually setup a server with Ubuntu 16.04 OS on Vultr.

    Wih a $5 server you can do what you want with it.  I have blogged before about setting up your own Server. e.g Installing Centos and Ubuntu server on Digital Ocean.  Digital Ocean does not have data centres in Australia and this kills scalability. AWS is good but 4x the price of Vultr. I have blogged about setting up and AWS server here (and upgrading an AWS instance). I tried to check out Alibaba Cloud but the verification process was broken so I decided to check our Vultr.

    Manual Setup of Vultr on an Ubuntu 16.04 server

    • Deploy a Vultr Server – Guide here  ($2.5/m to New Jersey or Florida or $5/m to Sydney,  I would recommend you opt in for the auto backup for $0.50c/m and $1/m respectively).
    • Setup NGINX.
    • Setup PHP and PHP-FPM (see guide above), consider adding PHP child workers.
    • Setup and secure MySQL (see guide above), create a database for WordPress to use.
    • Instal Adminder MySQL GUI (guide here).
    • Setup a free Lets Encrypt SSL certificate (guide here).
    • Install WordPress (and Jetpack plugin).
    • Install WordPress CLI.
    • Instal the WooCommerce Storefront WordPress Theme.
    • Install WooCommerce Plugin.
    • Secure Ubuntu.
    • Also consider linking your domain to Cloudflare to boost performance, scanning your site with Qualys Freescan and OWASP ZAP).
    • Consider setting up a WordPress image compressor and CDN plugin. like EWWW.io

    Manual WooCommerce Plugin Setup

    Once you setup Woocommerce you can setup the store defaults. Goto the WordPress dashboard and click WooCommerce Settings

    Woo Commerce Settings

    Settings – General

    General

    • Set Address, City and State and Postcode
    • Set allowed countries to sell in (e.g Australia)
    • Set allowed countries to ship items to (e.g Australia)
    • Set Enable Taxes
    • Set Currency
    • etc

    Settings – Products

    Products

    • Set Weight
    • Set Dimensions
    • Enable Product Reviews
    • Enable Star Ratings on Reviews
    • etc

    Settings – Shipping

    Shipping

    • Enable Shipping Calculator
    • Add Shipping Classes
    • Shipping Zones
    • etc.

    Settings – Checkout

    Settings checkout

    • Force Secure Checkup
    • Create a Terms and Conditions page (and set).
    • etc

    Settings – Account

    Accounts

    • Set Account Options
    • etc

    Settings – Emails

    Emails

    • Set Email Preferences
    • Set Email Header Image
    • Set Email Colour
    • Set Footer Text
    • etc

    Settings – API

    API

    • API can be disabled if you don’t need it.

    Optional Actions

    • Setup Yoast Plugin
    • Setup other plugins

     

    Instaling a Woo Commerce Child Theme

    Goto https://woocommerce.com/product-category/themes/storefront-child-theme-themes/ and choose a theme.

    Themes

    Purchase and Install the desired child theme (I uploaded it to my /wp-content/themes/ folder with forklift). I chose a free deli theme.

    Goto your WordPress then themes folder and activate your new child theme.

    Activate Theme

     

     

    Post Site Setup

    Just because your site is live does not mean you can rest.

    SEO Optimization

    Do use sites like https://seositecheckup.com/ and follow recommended actions to improve your SEO like updating meta tags.

    More Reading

    Attaching an email to your domain

    You can pay $5 a month and link a G Suite email to your domain.

    • Dedicated professional Google G Suite email account for $5 a month with 30GB storage (If you don’t want ot to buy a G Suite email and link it to your domain then you don’t need this).

    Once you have a G Suite account you can link other domains (and domain emails) to it. You can login to your G Suite emails via G Mail and send emails from apps or the command line.

    Why Vultr

    I use the server host Vultr as they have data centres all around the world and the support of great, Digital Ocean is good too but they don’t have data centres in my country (Australia). Vultr allows you to deploy all over the world upgrade servers, move servers, add storage and restore servers.

    Alternatively, you can buy a $2.5/m server and generate  a static website

    I use the Platforma Web HTML generator to build mobile and WCAG compliant websites.

    Buying a domain,  I buy my domains from https://www.namecheap.com/  it is a good idea to look for coupons first at https://www.namecheap.com/promos/coupons.aspx before buying a domain.

    Once you buy a domain you can point it to a Vultr server and upload your website.

    I hope this helps someone.

    Donate and make this blog better

    Ask a question or recommend an article

    Your Name (required)

    Your Email (required)

    Your Question

    Revision History

    v.1.2 WordPress WooCommerce

    v1.1 SEO

    v1.0 Initial Draft

    Setting up a website to use Cloudflare on a VM hosted on Vultr and Namecheap

    by

    This guide will show how you can set up a website to use Cloudflare on a VM hosted on Vultr and Namecheap

    Advertisement:



    I have a number of guides on moving hasting away form CPanel, Setting up VM’s on AWS, Vultr or Digital Ocean along with installing and managing WordPress from the command line. This post will show how to let Cloudflare handle the DNS for the domain.

    Snip from here “Cloudflare’s enterprise-class web application firewall (WAF) protects your Internet property from common vulnerabilities like SQL injection attacks, cross-site scripting, and cross-site forgery requests with no changes to your existing infrastructure.”

    Cloudflare Benefits (Free Plan)

    • DDoS Attack Protection (Huge network to absorb attacks DDoS attacks over 600Gbps are no problem for our 15 Tbps networks)
    • Global CDN
    • Shared SSL certificate (I disabled this and opted to use my own)
    • Access to audit logs
    • 3 page rules (maximum)

    View paid plan options here.

    Cloudflare CDN map

    Cloudflare CDN says it can load assets up to 2x faster, 60% less bandwidth from your servers by delivering assets from 127 data centres.

    Cloudflare Global Network

    Setup

    You will need to sign up at cloudflare.com

    Cloudflare

    After you create an account you will be prompted to add a siteAdd SiteCloudflare will pull your public DNS records to import.

    Query DNS

    You will be prompted to select a plan (I selected free)

    Plan Select

    Verify DNS settings to import.

    DNS Import

    You will now be asked to change your DNS nameservers with your domain reseller

    DNS Nameservers

    TIP: If you have an SSL cert (e.g Lets Encrypt) already setup head to the crypto section and select ” Full (Strict)” to prevent ERR_TOO_MANY_REDIRECTS errors.

    Strict SSL

    Cloudflare UI

    I asked Twitter if they could kindly load my site so I could see if Cloudflare dashboard/stats were loading.

    The Cloudflare CTO responded.  🙂

    Confirm Cloudflare link to a domain from the OSX Comand line

    Caching Rule

    I set up the following caching rule to cache everything for 8 hours instead of WordPress pages

    Page Rules

    “fearby.com.com/wp-*” Cache level: Bypass

    “fearby.com.com/wp-admin/post.php*” Cache level: Bypass

    “fearby.com/*” Cache Everything, Edge Cache TTL: 8 Hours

    Cache Results

    Cache appears to be sitting at 50% after 12 hours.  having cache os dynamic pages out there is ok unless I need to fix a typo, then I need to login to Cloudflare and clear the cache manually (or wait 8 hours)

    Performance after a few hours

    DNS times in gtmetrix have now fallen to a sub 200ms (Y Slow is now a respectable A, it was a C before).  I just need to wait for caching and minification to kick in.

    DNS Improved

    webpagetest.org results are awesome

    See here: https://www.webpagetest.org/result/180314_PB_7660dfbe65d56b94a60d7a604ca250b3/

    • Load Time: 1.80s
    • First Byte 0.176s
    • Start Render 1.200s

    webpagetest

    Google Page Speed Insights Report

    Mobile: 78/100

    Desktop: 87/100

    Check with https://developers.google.com/speed/pagespeed/insights/

    Update 24th March 2018 Attacked?

    I noticed a spike in and traffic (incoming and threats) on the 24th of March 2018.

    I logged into Cloudflare on my mobile device and turned on Under Attack Mode.

    Under Attack Flow

    Cloudflare was now adding a delay screen in the middle of my initial page load. Read more here.  A few hours after the Attach started it was over.

    After the Attack

    I looked at the bandwidth and found no increase in traffic from my initial host VM. Nice.

    cloudflare-attack-001

    Thanks, Cloudflare.

    Cloudflare Pros

    • Enabling Attack mode was simple.
    • Soaked up an attack.
    • Free Tier
    • Many Reports
    • Option to force HTTPS over HTTP
    • Option to ban/challenge suspicious IP’s and set challenge timeframes.
    • Ability to setup IP firewall rules and Application Firewalls.
    • User-agent blocking
    • Lockdown URL’s to IP’s (pro feature)
    • Option to minify Javascript, CSS and HTML
    • Option to accelerate mobile links
    • Brotli compression on assets served.
    • Optio to enable BETA Rocket loader for Javascript performance tweaks.
    • Run Javascript service workers from the 120+ CDN’s
    • Page/URL rules o perform custom actions (redirects, skip cache, Encryption etc)
    • HTTP/2 on, IPV6 ON
    • Option to setup load balancing/failover
    • CTO of Cloudflare responded in Twitter 🙂
    • Option to enable rate limiting (charged at 10,000 hits for $0.05c)
    • Option to block countries (pro feature)
    • Option to install apps in Cloudflare like(Goole Analytics,

    Cloudflare Cons

    • No more logging into NameCheap to perform DNS management (I now goto Cloudflare, Namecheap are awesome).
    • Cloudflare Support was slow/confusing (I ended up figuring out the redirect problem myself).
    • Some sort of verify Cloudflare Setup/DNS/CDN access would be nice. After I set this up my gtmetrix load times were the same and I was not sure if DNS needs to replicate? Changing minify settings in Cloudflare did not seem to happen.
    • WordPress draft posts are being cached even though page riles block wp-admin page caching.
    • Would be nice to have ad automatic Under Attack mode
    • Now all sub-domains were transferred in the setup ( id did not know for weeks)

    Cloudflare status

    Check out https://www.cloudflarestatus.com/ for status updates.

    Don’t forget to install the CloudFlare Plugin for WordPress if you use WordPress.

    More Reading

    Check out my OWASP Zap and Kali Linux self-application Penetration testing posts.

    I hope this guide helps someone.

    Ask a question or recommend an article

    Your Name (required)

    Your Email (required)

    Your Question

    Revision History

    v1.8 host Command from the OSX CLI

    v1.7 Subdomain error

    v1.6 Cloudflare Attack

    v1.5 WordPress Plugin

    v1.4 More Reading

    v1.3 added WAF snip

    v1.2 Added Google Page Speed Insights and webpage rest results

    v1.1 Added Y-Slow

    v1.0 Initial post

    Upgrading the RAM, CPU and Memory on a Vultr Ubuntu VM in the cloud

    by

    Upgrading the RAM, CPU and Memory on a Vultr Ubuntu VM in the cloud is quite simple.

    Advertisement:



    I have a number of guides on moving hasting away form CPanel, Setting up VM’s on AWS, Vultr or Digital Ocean along with installing and managing WordPress from the command line.  I prefer Vultr as they are located in the country (Australia) and are easy to use.

    First, you need to shut down the server from within the VM (SSH), I used the command.

    Once the VM is shut down (wait a few minutes) you can turn off the VM in the Vultr GUI.

    Shutdown

    You can then go to Settings, Change Plan and review upgrade options.

    Upgrade Options

    Snapshot

    Don’t forget to take a final snapshot.

    Snapshot reminder

    Goto the Snapshots page (read this guide to restore a snapshot) and click Take Snapshot.

    Take Snapshop

    You can see snapshot progress on the main screen.

    Snapshot Progress

    It may take a while for your snapshot to change from Pending to Processing.

    Processing

    Upgrade

    When the snapshot is done it will auto boot and allow you to upgrade.

    Manage

    Choose the Upgrade specifications (Settings, Change Plan)

    Upgrade Specs

    Click Upgrade

    Upgrade

    Confirm

    Confirm

    The upgrade process will take a few minutes (I could see the CU and Ram was updated but the Storage was pending)

    Upgrade Pending

    Testing

    After the upgrade happened the VM will autoboot, login and check tour specifications (Useful Linux Commands).

    I use the htop command to view specification information.

    I did a quick benchmark pre-optimizing and I can see a speed bump of 0.2s. Time to optimize.

    Benchmark

    I threw 50 concurrent clients at my website (with loader.io) and the server handled it fine with no increase above memory capacity like before.

    Concurent Users

    Optimize

    Now I need to Optimize.  Truth be told  I did optimize and harden PHP and crashed PHP-FPM so I had o restore a VM snapshot.

    Troubleshooting

    If all else fails (post-upgrade configuration) you can restore the Vultr VM from a snapshot.

    I hope this guide helps someone.

     

    P.S If you don’t have a VM on Vultr click this link to set one up in minutes (setup guide here).

    Ask a question or recommend an article

    Your Name (required)

    Your Email (required)

    Your Question

    Revision History

    v1.0 Initial post

    PHP implementation to check a password exposure level with Troy Hunt’s pwnedpasswords API

    by

    Developed by Simon Fearby https://www.fearby.com to allow PHP developers to integrate haveibeenpwned exposed password checks into their websites sign up’s (or logins). Get the latest version of this code from https://github.com/SimonFearby/phphaveibeenpwned/.

    Advertisement:



    This demonstrates a PHP framework less way (using HTML 5, Javascript and PHP) to validate a password by hashing (SHA1) the password (before the HTML form is submitted). A part of the password hash is checked at https://api.pwnedpasswords.com/range/{[}xxxxx} API (before a decision to save the form data is made). A Password exposed result returns the user to the sign-up form and no match completes the submission process.

    SHA is performed on the password entered in the HTML form in Javascript (Your password never leaves the browser) and the PHP submit receiver performs a partial hash check at api.pwnedpasswords.com. Only a fraction of your password hash is sent to api.pwnedpasswords.com and only a partial hash of your password is returned with other partial matches (Making it hard (for anyone listening) to know what password you used).

    This demo does not enforce SSL, sanitize, validate any form data or save the password to a database etc. The aim of this page is to demonstrate integration with api.pwnedpasswords.com. This demo displays a password strength meter. signup_submit.php allows you to enable debugging to see what is going on (detected errors are sent back to the submit.php and alerts shown.

    Basics

    signup.php – Main PHP file with a form with basic Javascript validation.

    signup_submit.php – The form submit sends the form data here and calls the pwnedpasswords API

    signup_ok.php – Is loaded if the password is not exposed

    The initial HTML code was generated with the Platforma GUI web generator.  I added to the Javascript and relevant code. the HTML input field types are set to “text” (not “password”) so you can see the passwords.  A password SHA1 hash is generated on form submission and the users password never leaves the browser.

    haveibeenpwned-001

    A SHA1 hash of the password is updated and displayed (I am using the jsSHA library).

    haveibeenpwned-002

    After a basic HTML Javascript form validation is performed the uses password is replaced with a hash then the form is submitted (to signup_submit.php).

    signup_submit.php then takes the password hash, get the first 5 chars and fires up a curl connection to https://api.pwnedpasswords.com/range/$data when the data returns PHP checks the haveibeenpwned API body for matches of the matching password hashed and compared the known hash with the passwords has. Read more about how the API works here.

    The PHP function that does the AI check is located here

     

    You can enable debugging in signup_submit.php if you wish (but if an echo has presented debug data and a header redirect happens it will produce an errror).

    echo statements are wrapped

    signup_submit.php will redirect the browser back to signup.php if an error is found

    A success event (no password hash found) the user is sent to ignup_ok.php

    signup.php will check for the Error query string

    Then display bootstrap alert errors for each error case

    Sample Errors

    Sample Password exposed error.

    haveibeenpwned-003

    Sample API Offline alert

    haveibeenpwned-005

     

    If form field needs attention a JavaScript event is written to set the focus etc.

    If no password hash has been matched with pwnedpasswords the user is directed to signup_ok.php (not very exciting but that’s your jobs to integrate it with your system and harden).

    haveibeenpwned-006

    Sample debugging output

    haveibeenpwned-007

    Get the code: https://github.com/SimonFearby/phphaveibeenpwned/

     

    More Reading

    If you are using Ubuntu don’t forget to set up a free SSL cert, setting up an SSL cert on OSX is also a good idea. I have guides on setting up an Ubuntu server on AWS, Digital Ocean and Vultr. I love Vultr VM hosts and have blogged about setting up WordPress via the CLI, uploading files with SSH, restoring Vultr Snapshots etc.

    I hope this guide helps someone.

    Ask a question or recommend an article

    Your Name (required)

    Your Email (required)

    Your Question

    Revision History

    v1.0 Initial post

    How to upgrade a Digital Ocean Ubuntu VM and increase the vCPU or memory

    by

    This blog post will show you how you can increase the memory and CPU allocation of an Ubuntu Server (Droplet) on Digital Ocean.

    Advertisement:



    If you don’t have an Ubuntu server on Digital Ocean use this link ( https://m.do.co/c/99a5082b6de5 ) and get $10 free credit (2 months free). Read my guide here on setting it up.

    Before you begin, ensure you have backed up your server.  You can read here about setting up a new server on Digital Ocean from scratch, connecting to your server via SCP or automatically syncing files away from your server to another server with rsync .

    In Jan 2018 Digital Ocean doubled the ram of $5/m servers from 512MB to 1GB so it’s time for me to get the free upgrade.

    Connect to your server (via SSH or Web Console) and shut it down

    After the server has shut down login to digital Ocean GUI and click (open) the server you want to upgrade.

    resize-droplet-002

    Click Resize and choose the new upgraded server capacity

    resize-droplet-003

    Click Resize (if the resize button is disabled you need to power off the server (via command line or via the power menu in Digital Ocean for the Droplet))

    resize-droplet-004

    Click the Power On button under the Access tab when the resize is completed to restart the VM.

    resize-droplet-005

    Congratulations, you will now have an upgraded server 🙂 Thank You Digital Ocean for the free RAM.

    If you don’t have an Ubuntu server on Digital Ocean use this link ( https://m.do.co/c/99a5082b6de5 ) and get $10 free credit (2 months free). Read my guide here on setting it up.

    Hope this helps someone.

    Donate and make this blog better

    Ask a question or recommend an article

    Your Name (required)

    Your Email (required)

    Your Question

    Revision History

    v1.0 Initial Post

    Connecting a 128×32 Blue OLED Display Module to a Raspberry Pi via IIC I2C

    by

    Below is how I connected a 128×32 Blue OLED to a Raspberry Pi.

    Advertisement:



    The OLED screens are quite cheap on eBAY (I would suggest ordering a few as some I received were damaged, they are quite fragile)

    Purchase

    Hardware Setup

    Connect the 3.3 to VCC pin

    Connect the ground

    Connect SCL to SCL pin on your Pi

    Connect SAA to the SDA pin on your Pi

    Setup the Python Library

    $ git clone https://github.com/adafruit/Adafruit_Python_SSD1306.git
    $ cd Adafruit_Python_SSD1306
    $ sudo python setup.py install

    Now you can copy the desired ./examples/ scripts anywhere and choose the module you have wired up

    ..

    # 128×32 display with hardware I2C:
    # 128×64 display with hardware I2C:
    # 128×32 display with hardware SPI:
    # 128×64 display with hardware SPI:

    ..

    Run the script

    sudo python mylcdscript.pl

    Stats example

    Stats

    Animate example

    Text

    Run at startup

    Type the following to open your crontab

    sudo crontab -e

    Now add the following line

    @reboot  sudo python /scripts/mylcdscript.pl > /scripts/mylcdscript.log

    Reboot your system

    sudo shutdown -r now

     

    TIP: Consider changing the sleep in the while loop to 120 instead of 0.1 to prevent flooding I2C

    More Reading

    I used this guuide to setup my OLED

    I hope this guide helps someone.

    Ask a question or recommend an article

    Your Name (required)

    Your Email (required)

    Your Question

    Revision History

    v1.0 Initial post