Hosting/Webhosting MEGATHREAD

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > Hosting/Webhosting MEGATHREAD

Unity Gain: Sep 15, 2007; dancing blue

less than three posted:

I'd suggest looking into MediaTemple's Grid service as an entry point.

I'd actually recommend not.

If you poke around webhostingtalk (the forum for hosting industry professionals) you'll find lots of complaints about MT's grid, and even the MT rep admits the system isn't quite there yet.

# ¿ Dec 6, 2010 22:20

Adbot: ADBOT LOVES YOU

# ¿ Apr 29, 2024 01:21

Unity Gain: Sep 15, 2007; dancing blue

I do indeed remember when MT had a sterling reputation and a big following with the creative set. Seems that lately the shine's worn off a bit

On WHT, people complained that the grid service was hit or miss, having trouble with both random (and extended) downtime and scaling.

For the former, MT said they were "working out the kinks". For the latter, they recommended add-on services like a database grid, which got expensive awful fast.

I personally have no experience with them, so you've got me on that; I'm just recounting what I read on WHT.

# ¿ Dec 7, 2010 05:25

Unity Gain: Sep 15, 2007; dancing blue

hackedaccount posted:

Gonna set up a site on Github Pages with Jekyll 2.0

Anyone doing this? Any gotchas or tips you would like to share?

I did. I went with Jekyll Bootstrap instead of plain Jekyll as it adds a few extras and I found a theme I liked better. I spent quite a bit of time tweaking and customizing my theme of choice, but it was fun, and neither difficult nor tedious.

No gotchas at all. After you go through the setup process on the dev side of things and get used to the watch/generate/commit/push cycle it becomes second nature. I never had a problem, never had anything fail or crash or behave unexpectedly. It all Just Worked™

A couple of points:

I'm on a Mac, so if you're on Windows, YMMV.

Some older docs (including some on github itself) talk about USERNAME.github.com, but you should really be using USERNAME.github.io

Unless you want to pay for a private repository, your blog's uncompiled source code will be publicly viewable. This shouldn't be a problem, as the site is static so there are no secret API/auth keys or usernames or passwords to expose, but just make sure you don't put anything sensitive (or anything you don't want to be read by the public) in your source comments, and don't leave any sensitive stray files in your repository.

# ¿ Aug 14, 2014 00:39

Unity Gain: Sep 15, 2007; dancing blue

Heskie posted:

Yeah Linode have been excellent for me over nearly 3 years.

Its good that they recently started offering $10 packages, but I wouldn't mind an even smaller $5/mo as Digital Ocean do just for my little hobby projects.

I've got a few $20s, and just picked up a couple of $10s for some small projects. I'd love a $5 price point too, but I read somewhere recently that Linode firmly stated that they have absolutely no interest in the five dollar market

# ¿ Aug 19, 2014 19:37

Unity Gain: Sep 15, 2007; dancing blue

DarkLotus posted:

Yay, another round of vulnerabilities...

SSL v3 Security Vulnerability
OpenSSL has released information regarding the SSL v3 vulnerability:

https://www.openssl.org/~bodo/ssl-poodle.pdf

Please pay close attention to the recommendations and implement as necessary.

You can test your site and certificate here: https://www.ssllabs.com/ssltest/index.html

After some aggressive nginx tuning I got an A+. If I can do it, so can you!

# ¿ Oct 16, 2014 02:53

Unity Gain: Sep 15, 2007; dancing blue

fletcher posted:

Mind sharing the ssl_protocols & ssl_ciphers values you used to get an A+?

Sure, it's just gonna take me a little time to go gather everything from the conf files. Give me an hour or so to post back.

edit 1: ok, here it is:

code:

     ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

     ssl_ciphers 'EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 
EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA 
!aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS+RC4 !RC4';

The cipher line made vb throw up, so I manually split it into three pieces. It's should be one long line with no linebreaks.

But you need to do a bunch more things as well. I started with this guide: http://tautt.com/best-nginx-configuration-for-security/

but it got a couple things wrong: only 2048 bit dhparam (needs to be 4096), and, directly related to your question, the cipher list wasn't up to snuff. The list above is.

edit 2:

Here are the required settings in nginx.conf (I've edited out non-related settings)

code:

http {
	# regular stuff goes here

	server_tokens off;
	add_header X-Frame-Options SAMEORIGIN;
	add_header X-Content-Type-Options nosniff;    
	add_header X-XSS-Protection "1; mode=block";    

	# include your virtual hosts here
}

And here's the complete virtual host conf file:

code:

server {
	listen 443;
	listen [::]:443;

	ssl on;
	ssl_certificate /PATH/TO/cert.pem;
	ssl_certificate_key /PATH/TO/cert.key;

	#read more here [url]http://tautt.com/best-nginx-configuration-for-security/[/url]
	# to generate dh4096.pem:
	#	cd /etc/ssl/private
	#	sudo openssl dhparam -out dh4096.pem 4096
	ssl_dhparam /etc/ssl/private/dh4096.pem;
 	ssl_session_cache shared:SSL:10m;
  	ssl_session_timeout 5m;
	ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
	ssl_ciphers 'EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 
                           EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA 
                           !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS+RC4 !RC4';
	resolver 8.8.8.8;
  	ssl_stapling on;
  	ssl_trusted_certificate /PATH/TO/cert.pem;
	add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";

	# rest of your conf stuff goes here
}

REMEMBER: I manually wrapped the cipher line in the above conf file! It MUST be one long line.

edit 3: I'm using a bog-standard $9.00 comodo SSL certificate bought via Namecheap.

Unity Gain fucked around with this message at 03:59 on Oct 16, 2014

# ¿ Oct 16, 2014 02:58

Unity Gain: Sep 15, 2007; dancing blue

Interesting. Did a bit of googling RE paypal IPN and SSL3 and found this: http://stackoverflow.com/questions/26379773/paypal-ipn-acknowledgements-failing-with-ssl-routinesssl3-read-bytessslv3-aler

# ¿ Oct 16, 2014 05:31

Unity Gain: Sep 15, 2007; dancing blue

Ugh. I know from all the chatter on WHT that WHMCS is a (how do I put this kindly) beast, but I didn't realize it was ion (or whatever) encoded. That sure changes the game.

Thankfully, since I don't run a host, I've never had to deal with this. But I sure do feel bad for you guys every time I see some sort of hosting-related CVE and how long you sometimes have to wait for a vendor patch.

# ¿ Oct 16, 2014 06:06

Unity Gain: Sep 15, 2007; dancing blue

Ahahah yeah, that's what I've read. Everyone hates it, no viable alternative, end up rolling your own.

# ¿ Oct 16, 2014 22:35

Unity Gain: Sep 15, 2007; dancing blue

Excellent. Glad I could help.

# ¿ Oct 25, 2014 03:31

Unity Gain: Sep 15, 2007; dancing blue

DarkLotus posted:

Yay, another round of vulnerabilities...

SSL v3 Security Vulnerability
OpenSSL has released information regarding the SSL v3 vulnerability:

https://www.openssl.org/~bodo/ssl-poodle.pdf

Please pay close attention to the recommendations and implement as necessary.

Welp, Ars is now reporting a TLS-variant of POODLE. On one hand they say that a bunch of banks and other "high profile" sites are affected. On the other hand they say

Ars Technica posted:

So far, load balancers and similar devices sold by two different manufacturers have been identified as vulnerable. The makers are F5 and A10.

So I'm not quite sure if only the load balancers are affected, or if the problem is wider spread.

e: a little more info at computer world.

Unity Gain fucked around with this message at 14:20 on Dec 9, 2014

# ¿ Dec 9, 2014 05:14

Unity Gain: Sep 15, 2007; dancing blue

fuf posted:

What's a good alternative email host?

I've been using Polaris Mail for various "serious" mail accounts. $1.00/month per mailbox, unlimited domains and aliases. If you buy three mailboxes, each can be on its own domain, and each address can have any number of aliases. I've never had mail sent through them get rejected or be marked as spam.

The only "catch" is that below a certain dollar amount, you have to pay yearly. So 3 or 4 accounts would need to be paid upfront $36/$48 for the year. Getting into higher mailbox counts and you get options for paying every 3 or 4 months, or even monthly.

They have a free trial period (14 days?) so you can test them out risk free. Make sure to read their (excellent) docs carefully so that you set up your MX and SPF records correctly for each domain, as this is the #1 cause of unreliable delivery.

# ¿ Jan 15, 2015 17:02

Unity Gain: Sep 15, 2007; dancing blue

DarkLotus posted:

tl;dr, php sucks, use anything else
http://www.thalagyrtlovesphp.com/

Hello Dear,

I am wanting to make Site like Facebook using the PHP. I am offer 15$ You can make the Codes? It will success For sure.

# ¿ Jan 20, 2015 18:19

Unity Gain: Sep 15, 2007; dancing blue

14.04 LTS 4lyfe :smug:

For once I don't have to do anything.

# ¿ Jan 28, 2015 01:10

Unity Gain: Sep 15, 2007; dancing blue

DarkLotus posted:

WOOT! OpenSSL security updates issued!

Updates for OpenSSL were just released to address various security vulnerabilities, some of which they consider high priority and it is recommended that you update as soon as possible.
(Please keep an eye open for vendor / control panel updates that are related to these updates in the coming days.)

Official Link:
https://openssl.org/news/secadv_20150319.txt

Patch is now up for Ubuntu 14.04LTS

# ¿ Mar 20, 2015 20:34

Unity Gain: Sep 15, 2007; dancing blue

I'm sure others can provide better/more detailed answers, but as a developer who is also a reluctant sysadmin, my 2 cents:

Tortilla Maker posted:

I've been dabbling in a few python related projects and also have an interest in testing out open source projects such as OpenProject, OSticket, and a few applications made available on GitHub.

I'm using a 2010 Macbook Air and setting up a testing environment via Vagrant/Virtualbox hasn't been a success as it eats up all my resources and makes my computer crawl. I was thinking of using a hosting service as my playground but considering that I have zero experience with self-management, I have a few questions.

Up until recently I was using an old iMac and ran into the same problem. Just got a new 2015 rMBP, and it runs VirtualBox, netflix, xcode, and a bunch of other stuff all at the same time without breaking a sweat. Is there NO way you can get new hardware? This really is your best option. That said:

Tortilla Maker posted:

- Is it possible to partition out the server for purposes of different projects?
For example, OpenProject and OSticket both require (I think) that you run Apache, but 90% of the GitHub projects I'm interested in playing with are set up using nginx. Or is possible for them to run regardless of whether Apache/nginx is running?

You can run both at the same time as long as they are listening on different IP addresses/ports. This will of course require you to edit httpd.conf (and any included virtual server confs) as well as nginx.conf (and related virtual server confs). Can't be more specific as some VPS/dedi boxes come with a bunch of IPs, some come with just one, so it depends what kind of hosting you end up with.

Tortilla Maker posted:

- The whole self-management aspect is a little daunting but considering that this is all new territory for me, I wouldn't mind a little support to get things going. What should I look for in a hosting provider to help me get on my feet (e.g., I think you can install OSticket relatively easily via cPanel, but so many people seem to be anti-cPanel; what are the alternatives aside from shell installations?).

Also, I'm reeeallly new and dumb to all of this. It took me 3 hours to properly install php as I couldn't get my 'info.php' page to display (it instead kept downloading the drat file).

You're just going to have to power through, unless you want to pay serious monthly $$$ for fully managed. Even then, most fully managed plans don't cover 3rd party scripts or non-standard configurations. You could pay a pro by the hour, in the range of $50-$150, but honestly you're better off just learning this stuff. Me? I used stackoverflow, google, actual product docs (e.g. nginx site documentation) and an O'Reilly Safari Online subscription ($50/month) to learn what I needed. It's not easy going, but as devs, our needs don't really fit into that neat little box of traditional online server users.

Also, Digital Ocean and Linode have excellent how-to articles that can get you set up and running securely and efficiently. My preference in terms of hosting is Linode over DO (but DO has better how-to docs, which you can still use if you have a Linode VPS), but either will do you just fine.

# ¿ Jun 13, 2015 21:35

Unity Gain: Sep 15, 2007; dancing blue

fuf posted:

(Cross post from the web dev thread)

Where is this magical thread you speak of???

# ¿ Jun 29, 2015 19:43

Unity Gain: Sep 15, 2007; dancing blue

fuf posted:

http://forums.somethingawful.com/showthread.php?noseen=0&threadid=3554791&perpage=40&pagenumber=126

# ¿ Jun 29, 2015 21:11

Unity Gain: Sep 15, 2007; dancing blue

eightysixed posted:

Deadjournal

I actually love the idea of this, but the execution of that site is just...horrible, and the whole thing is slow. Maybe we're slashdotting it :laugh:

.

I looked at over 20 blogs and they are truly eyesores. 100% for ingenuity, 0% for visuals.

# ¿ Oct 13, 2015 21:02

Unity Gain: Sep 15, 2007; dancing blue

I had no idea! I thought it was someone's (bad) idea for going retro.

# ¿ Oct 13, 2015 23:28

Unity Gain: Sep 15, 2007; dancing blue

Glad this was of use! I remember the discussion here.

Just to confirm, I still use the same config on various sites, still have an A+ rating as well.

# ¿ Dec 5, 2015 17:42

Unity Gain: Sep 15, 2007; dancing blue

^^^ awesome!

This is actually a timely (re)discussion of SSL on nginx, as the 1.9 branch of nginx now includes http2 support in lieu of SPDY.

Good article from cloudflare here: https://blog.cloudflare.com/tools-for-debugging-testing-and-using-http-2/

Article from nginx itself here: https://www.nginx.com/blog/nginx-1-9-5/

According to the nginx article there's some issue with certain cipher lists.

I'm going to move from 1.8 to 1.9 this week, disable speedy, and switch to http2. I'll then make sure I can still get an A+ rating. If I run into trouble with the cipher list, I'll post back a new config here. Trip report either way, even if I roll it all back.

# ¿ Dec 8, 2015 00:02

Unity Gain: Sep 15, 2007; dancing blue

Trip Report

All of five minutes, and I'm now http2 enabled. The cipher list is fine, still have an ssllabs A+ rating, and the chrome SPDY/http2 checker extension mentioned in the cloudflare article confirms that I'm connected via http2.

The only gotcha here is that in order to upgrade to 1.9 from 1.8, you need to switch from the stable channel to the "mainline" one. This could very well be a deal breaker for you.

# ¿ Dec 10, 2015 02:56

Unity Gain: Sep 15, 2007; dancing blue

^^^^ this.

piss angel posted:

read the docs, it's actually not that difficult at all and far more powerful than apache's imo. pretty much everything you need will be ssl_*

mainline is fantastically stable in my experience, and i've been running it since 1.9.0 without any issues that i can recall

this is anecdotal of course, but it probably won't be an issue, especially not for personally hosted sites

Yeah, I was on stable more by happenstance than anything. Never heard of any problems with mainline myself either.

# ¿ Dec 14, 2015 20:11

Unity Gain: Sep 15, 2007; dancing blue

I wonder how Arvixe is doing after the EIG buyout earlier this year. Surely it...

*checks WHT shared hosting subforum, which I haven't visited in months*

Oh. Yep.

Bonus points for an ASO thread on the first page too.

# ¿ Dec 29, 2015 21:29

Unity Gain: Sep 15, 2007; dancing blue

Wow. And I just saw they bought out Verio and the rest of Site5 as well.

# ¿ Dec 29, 2015 21:56

Unity Gain: Sep 15, 2007; dancing blue

DarkLotus posted:

They also bought Resellerclub.

!!! That one I missed.

No joke about their size..

# ¿ Dec 29, 2015 22:19

Unity Gain: Sep 15, 2007; dancing blue

DarkLotus posted:

Linode has some splaining to do...
https://twitter.com/linode/status/684448030867734528

oh ffs.

Guess it really is time to move to Digital Ocean.

e: or maybe AWS and route 53 like all the cool kids, but I really don't cotton to al the work involved.

Unity Gain fucked around with this message at 21:22 on Jan 5, 2016

# ¿ Jan 5, 2016 21:07

Unity Gain: Sep 15, 2007; dancing blue

Yeah. At least my sites (NJ datacenter) are up and running and snappy. For now. It's funny, a few weeks ago I started writing some ansible playbooks for provisioning my platforms in case of just such a problem. Kinda abandoned it over the holidays. Looks like I should get back to work on them pronto.

# ¿ Jan 5, 2016 21:16

Unity Gain: Sep 15, 2007; dancing blue

MrMoo posted:

Cannot follow the link to the blog due to a DDoS, awesome sauce.

Just came back up for me ~~, but still can't connect to linode proper~~.

Choice quote:

linode posted:

Thank you for your patience, understanding and ongoing trust in Linode.

Ahahahahaha, no.

# ¿ Jan 5, 2016 21:24

Unity Gain: Sep 15, 2007; dancing blue

^^^^^^ None here.

# ¿ Jan 7, 2016 00:33

Unity Gain: Sep 15, 2007; dancing blue

My linode payment went through as normal. Moved out of pending after a couple of days and is showing as a proper posted transaction.

# ¿ Jan 7, 2016 01:54

Unity Gain: Sep 15, 2007; dancing blue

eightysixed posted:

You could have mine, but I don't appear to have a 50% off coupon

Same.

# ¿ Mar 22, 2016 19:29

Unity Gain: Sep 15, 2007; dancing blue

Sentient Data posted:

Aww, that's mean, maybe the promo as a whole ended in 2015 rather than just the one from my account expiring. The hosting purchase page still mentions the coupon and says that anyone who's bought a domain should have one, they should update that text if the offer's gone. Thanks for looking at least, and in case anyone else has a gandi account and doesn't know where to look, it's hidden in the billing/promotions tab like http://i.imgur.com/IIHQW72.png

Aha! For me at least, mystery solved. I haven't bought any domains in my Gandi account yet. Checked my promos area as per your instructions, and indeed nothing there. Glad Thalagyrt could help you out

# ¿ Mar 22, 2016 22:25

Adbot: ADBOT LOVES YOU

# ¿ Apr 29, 2024 01:21

Unity Gain: Sep 15, 2007; dancing blue

Yeah, Gandi or Namecheap. I'm heavily vested in Namecheap so that's where I'm staying, but if I was starting over, it would be a coin toss; either one is top-tier.

# ¿ Jun 9, 2016 22:16

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > Hosting/Webhosting MEGATHREAD