Hosting/Webhosting MEGATHREAD

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > Hosting/Webhosting MEGATHREAD

MrMoo: Sep 14, 2000

reading posted:

How is reselling hosting space a market?

Usually it is tied to someone churning out basic template websites to small businesses and individuals.

# ¿ May 24, 2015 01:32

Adbot: ADBOT LOVES YOU

# ¿ Apr 28, 2024 23:05

MrMoo: Sep 14, 2000

Well lets encrypt went beta/live and pretty good albeit some weird quotas on IPv6 addressing (especially if you are on Linode). Puny code is not available in the beta, and Nginx is not supported for automated configurations.

I am surprised Nginx has pretty awful non-obvious SSL configuration, everything else is not too bad.

I have A+ rating on SSL Labs SSL Server Test but it appears that means all old versions of MSIE are blocked :lol:

MrMoo fucked around with this message at 01:07 on Dec 5, 2015

# ¿ Dec 5, 2015 01:05

MrMoo: Sep 14, 2000

I just tested a server at work and it managed an A- grade supporting all the way back to IE8/XP. That rules out SNI though for SSL virtual hosting so I don't care too much for that.

A- grade for developers.thomsonreuters.com (a site that I unfortunately have to work with)
A+ grade for yorkion.com (a site that I manage)

I think the certificate chain support for OCSP stapling is a bit messed up in Nginx with Let's Encrypt. I'm not going to run it on anything important for a while.

# ¿ Dec 5, 2015 01:24

MrMoo: Sep 14, 2000

Rufus Ping posted:

This isn't configured properly for https://www.

What should it be doing? There is vanilla http://www.yorkion.com redirecting to https://yorkion.com. If I need https://www.yorkion.com to redirect to https://yorkion.com I need to register another certificate against Let's Encrypt :derp:

# ¿ Dec 5, 2015 04:42

MrMoo: Sep 14, 2000

The docs for Let's Encrypt now specify https://www.example.com and example.com so a bit better than before. There is a command line option "--duplicate" to pull in extra sub-domains on certificate and raises a dialog if there are new domains.

The SSL Server Test tool seems happier now, thanks :toot:

# ¿ Dec 5, 2015 06:11

MrMoo: Sep 14, 2000

If anyone is interested I am using the configuration posted by Croc Monster earlier in this thread.

OCSP stapling requires a certificate in the Nginx default_server, I'm using Nginx on CentOS 7 so it is a rather old 1.6.3 but includes support for SPDY 3.1.

code:

server {
        listen       8443 default_server ssl spdy;
        listen       [::]:443 default_server ssl spdy;
        server_name  <server name>;
 
        ssl_certificate /etc/letsencrypt/live/<server name>/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/<server name>/privkey.pem;
        ssl_trusted_certificate /etc/letsencrypt/live/<server name>/fullchain.pem;

        include /etc/nginx/ssl.conf;
...
}

And each virtual host, using SNI looks the same without default_server.

The include file:

code:

    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:50m;
    ssl_session_tickets off;

    # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
    # openssl dhparam -out dhparam.pem 2048
    ssl_dhparam /etc/nginx/dhparam.pem;

    # modern configuration. tweak to your needs.
    ssl_protocols TLSv1.1 TLSv1.2;
    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-E
CDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256
:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES
256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128
-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5
:!PSK'; 
    ssl_prefer_server_ciphers on;
        
        
    # OCSP Stapling ---
    # fetch OCSP records from URL in ssl_certificate and cache them
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8;

The cipher list is from the Mozilla SSL configuration generator.

# ¿ Dec 5, 2015 17:37

MrMoo: Sep 14, 2000

The annoying bit afterwards is now that all embedded content needs to be HTTPS to work in modern browsers, which usually means changing all links from "http://example.com/blaa" to "//example.com/blaa".

I'm using a referral link from http://ipv6-test.com but alas they don't have HTTPS on IPv6 so I had to cheat and copy their image.

# ¿ Dec 5, 2015 17:47

MrMoo: Sep 14, 2000

piss angel posted:

read the docs, it's actually not that difficult at all and far more powerful than apache's imo. pretty much everything you need will be ssl_*

I expected to be able to set some global ssl variables like the other http parameters, not having to include an entire file for every virtual host.

# ¿ Dec 14, 2015 17:46

MrMoo: Sep 14, 2000

Bob Morales posted:

How many big ugly security breaches is that for them? Ugh.

Are the DDoS's still going on?

Cannot follow the link to the blog due to a DDoS, awesome sauce.

# ¿ Jan 5, 2016 21:13

MrMoo: Sep 14, 2000

Ugh I hope not, I'm more than 8,000 miles away from the bank I'm using for that :stare:

# ¿ Jan 7, 2016 01:10

MrMoo: Sep 14, 2000

clockworkjoe posted:

Do you have any recommended shared hosts?

Comedy option Azure, as slow as anything else I would expect.

# ¿ Mar 19, 2016 20:36

MrMoo: Sep 14, 2000

nem posted:

RAID0

RAID 0 on SSD is an improvement from mechanical drives, from the underlying storage perspective it is reasonable as there is already error recovery in place, you are only beholden to the controller flaking out which is likely for any other chip in the data path too.

# ¿ Jul 7, 2016 14:41

Adbot: ADBOT LOVES YOU

# ¿ Apr 28, 2024 23:05

MrMoo: Sep 14, 2000

Hong Kong and Singapore have Amazon data centres now, performance is OK and you avoid the bureaucracy. Beware most smaller data centres are overpriced and inferior to US hosting, this is predominantly due to pressure from self-hosting and cheap metro-Ethernet connections.

# ¿ Oct 5, 2016 16:30

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > Hosting/Webhosting MEGATHREAD