This will be a 2 part guide and this is part 1

What are the common mistakes that you make!

ever got your wordpress blog hacked? Well even my blog got hacked once Take a look at the image on the top. From this simple how to guide, Im going to explain some little facts about the common mistakes that you make against security and if you got hacked some tips that you can use to remove the malicious stuff from your blog and get back to running condition.

• Most of us tend to CHMOD ( setting permissions about the usage of files and folders) our files and directories to 777 maybe on the start and forgets or don’t even consider to set back the permissions to something secure like 644

Thats what happens most of the time. Some scripts even wordpress requires some directories such as upload directories to be set 777 permissions recursively in order to store the uploads and temporary files.  Newbies who setting up their blogs sometimes gets mad on the directories and set whole http directory and files to 777.  Yes some of you might laugh at this but this happens. And even I did the same thing on the beginning. But fortunately wordpress has been evolved these days and its smart enough to tell you what are the permissions required and its able to check if the permissions are correct on the folders while installation. So you might be lucky these days but even today some additional plugins require the file permissions specially to be set on some folders and you should be careful while doing those things.

• Never set 777 permissions on the main http folder. If your plugin require that, forget about the plugin!

• Always use trusted web hosts.

No matter how secure your blog is there can be loopholes on your hosting.  Yes you might be short with money but still there are plenty of good web hosts on the world which you can get bang for the buck. Forget about the web host advertised on your local discussion forum. Starting a web host is like nothing these days. Anyone with a dedicated server or VPS and cpanel license, whmcs license can start a web host. But good security wont be there most of the time. So you need to be careful. Chances of leaking your data to others is very high.

• Dont use your mysql database user password for something else such as your email accounts or anything.

You might be wondering why is that, its not because of someone stealing your email account password and then accessing your sql database. But I meant the reverse process. Think if your db user name and password got exposed due to a web server hack or something. Hacker will probably try the credentials for login to your email account or other online accounts. So have something special and unique as your mysql user password and never use it on anything!

• Using your web host provided backup system? Good! but take your time and backup off site too!

Its not always the index.php exploit. Sometimes wordpress core gets attacked due to weak-spots on the core itself and some brutal things happened with wordpress not far ago. So backups are most important. If your database got exploited and there is no information yet about how to remove the exploit and get back running you may really enjoy if you have backups in hand. Waiting for a statement and patch from wordpress team or something is not the best way specially if you are running a busy site. So if you have backups its like cheese!

So listen we know most web hosts give you the option to backup data on their control panel so the restoration will be easy and such. But dont depend on it. Like on the previous case if the whole server gets hacked or something. You might lose the backups and will left with nothing but sorrow! So be prepared and take backups redundantly!

• There is cool plugin on for wordpress I’m going for it! That’s not a problem. But view the ratings and read the forums on wordpress before installing a life changer plugins.

This is crucial. WordPress plugins emerge day by day and you need to be careful. The more plugin gets complex and interesting the better the chance of modifying the wordpress core heavily. So those plugins can really maybe weak spots later because of the modifications done to the wordpress core thus leaving possible exploit options. The best way to get around this problem is downloading your plugins from the wordpress.org plugin repository itself and read the ratings and corresponding forum ( there is separate forum for each plugin which can be found on plugin page) about the user experience! Trust me plugins are evil!

• Always update the plugins and wordpress core to latest

See Im using LNMP on my VPS which runs this blog and Im not running FTP service on it. So wordpress updates on the control panel and the easy one click plugin updates doesnt work because they all require FTP to do the trick.

So the get around is following the traditional way of upgrading stuff which  we did on wordpress 2.x.x That is downloading updates and overwriting files . What Im going to tell you is that always keep up to date on the plugins and wordpress core. See my way is very hard and sooo 2008 but I still do that when upgrade comes out and trust me I see upgrades very often with my 25 plugins.

• Read wordpress.org about the latest news and new releases.

Do this at least twice a week. Sometimes you may not even know when a large scale attack or loop hole on wordpress gets exposed to hackers and they are doing mass destruction. WordPress.org maintains a news blog here which provide news about new wordpress releases and most importantly security releases and flows. Don’t think wordpress core itself is very secure and you don’t have to look in to that, WordPress core loop holes has been exploited many times before. So be prepared!

Continued to Part 2

Other posts you might feel interesting

• LNMP V0.8 The complete Nginx auto installer!
• 1+ Years of Uptime with linode! Review
• Linode Tokyo/Japan Speedtests
• Linode XEN VPS review
• Find out uptime of a server without SSH

I have published article about my modified nginx auto installer about little over a year ago. Which can be found here. Which got somewhat famous and counted over 1000 installs. The framework which I was used was came from a chinese developer called licess and the framework now has been evolved a lot and now we can count it as fully fledged auto installer.  It now includes latest nginx version ( Which lacked at the time which I modified the script to include the latest and greatest) . And also now it includes separately tweaked installers for debian, centos, and ubuntu, which I had on my modified installer since day one   So its nice to see that he baked 2 options which my modified installer had since day one.

This installer is extremely useful but its not popular in the international community since its written in Chines and no support provided on English.  So with this post I just wanted to introduce that great tool to you guys and edit the original source code little bit to remove the time zone rewrites.

What I have removed

•  Original installer rewrites the time zone to China. I have removed that so your original time zone will remain on the server.

All the credits must go to Licess at www.lnmp.org and you can donate him there. I take no credit for this and I’m just listing the installer here and I just wanted to provide some support for it in English, thats the moral of the post!

What does the installer include

• Nginx 1.0.10
• PHP 5.2.17
• Mysql 5.1.60
• PHPMyAdmin
• Eaccelerator (optional 1 click install)
• VsFTPd, PureFTPd (Optional 1 click install)
• PHP Suhousin Patch
• Memcached (optional)
• Zend Optimizer

install Instructions-

You can use debian/ubuntu/centos 32bit or 64bit. So login via SSH and issue these commands (you must be root user to install LNMP )-

1. Download the installer package-

wget -c http://www.ruchirablog.com/lnmp0.8-full.tar.gz

2. Decompress the install package-.

tar zxvf lnmp0.8-full.tar.gz

3. Go to install directory-

cd lnmp0.8-full /

4.  Start installing-

For ubuntu  – sh ubuntu.sh

For Centos  – sh centos.sh

For Debian – sh debian.sh

It will ask some questions like your domain name , mysql root password ( Use your root password if you are newbie) just answer to them promptly.

It will take at least 30 minutes to fully install and then you will see a massage saying install completed. So then you can try navigating to your ip address to see it working.

After installation -

• PHPMyAdmin will be located on http://yourip/phpmyadmin
• Navigate to your url or ip and it will display a test page

1, install eAccelerator, execute the following command.  / eaccelerator.sh , follow the prompts to select the version, press Enter, it will automatically install and restart the web service.

2, the installation of ionCube, execute the following command  / ionCube.sh Enter to confirm, it will automatically install and restart the web service.

3, the installation imageMagick, execute the following command  / imageMagick.sh Enter to confirm, it will automatically install and restart the web service.

4, install memcached, execute the following command  / memcached.sh Enter to confirm, it will automatically install and restart the web service.

And a advantage of  the new installer is you can upgrade nginx or php with just one shell command.

• To upgrade the nginx  execute the following command:. / upgrade_nginx.sh It will prompt a thing which you need to enter the nginx version number. Its simply asking which version that you want to upgrade. So head over to http://nginx.org/en/download.html and find whats the newest nginx version and enter the number correctly on the shell prompt. For ex- 1.0.10 and press enter. its just easy!

• PHP  upgrade, execute the following command:. / upgrade_php.sh prompted, enter your php version number, such as 5.3.6.

You can manage the LNMP by issuing these commands-

/root/lnmp {start | stop | reload | restart | kill | status}

• For example if you want to restart lnmp issue /root/lnmp restart

LNMP files will be located on
mysql: /usr/local/mysql
php: /usr/local/php
nginx: /usr/local/nginx
Site Directory: /home/wwwroot

How to add more domains (Virtual hosts) for this setup?

You can add more domains to your setup with easy steps. You just need to open your SSH client and type

./vhost.sh

And it will ask you which domain name to add also if you are setting up new domain for wordpress it can automatically add rewrite rules for your permalinks Just answer for the questions when you run ./vhost.sh

Here are another guides for full LNMP 0.8 setup!

• How to upload files to LNMP0.8 without SSH deamon

• How to setup DNS to point your domain to LNMP0.8 server ip

So enjoy your server and please add a comment if you are happy with outcome!

PS- To keep in touch with updates (next releases) of this script you can subscribe to my email feed. No advertising or spam will be sent. You can unsubscribe at anytime!

Other posts you might feel interesting

• How to change SSH port on Centos,Ubuntu,Debian
• wordpress with nginx
• Nginx+Mysql+PHP-FPM Auto installer for centos 5 and debian
• 1+ Years of Uptime with linode! Review
• Setup Squid as a HTTP proxy to browse blocked web sites!

If you are sending considerable amount of emails to your visitors or customers you may have a problem reaching most of the users inbox because the risk of getting your IP’s blacklisted etc. So using your own servers to send emails for like 1000 users per day is a disaster because of the possibility of getting blacklisted. And a simple workaround for this problem is using Google Apps mail and its SMTP functionality.

And even there is a hard cap on sending emails from google apps mail and you will need to consider something else for the demand. And Amazon SES (Simple Email Service) offers a great and simple way to get through this problem but hey its not a innovation and these kind of service providers existed long before SES. But SES offers you very good price than the other providers.

But until now SES lacked major functionality. Thats sending emails over SMTP. All your web apps which need to send emails outside will simply use SMTP when you want external service to send the emails for it. Best example is wordpress. you can find SMTP plugins to use with google apps. But previously SES required some complex CLI actions and special programs to do the trick! In simple words its not user friendly.
But now Amazon SES introduced SMTP functionality and new section inside your amazon aws account.

you can simply obtain your SMTP login details from SES control panel and implementing it is very easy.
I have gave it a try and unfortunately for some reason it didnt worked for me on this blog and other site and I guess its minor problem on my own account or something like that and I will give a try again. I hope it will work Happy sending everyone

Other posts you might feel interesting

• 1+ Years of Uptime with linode! Review
• Cloudberry Explorer review
• Amazon S3 and Cloudfront Review
• Yahoo mail gets new interface
• LOL Mails 2011 March

Having some special unforgettable skype video calls?  Then you might be interested in recording those video calls for later reference. There is a perfect solution for it called “SuperTinTin” yeah I know it sounds weird but does the thing.

However its a premium software which means you have pay for it. But there is a trial version. Trial version got all the options but it got 5 minute record limit. But thats not a problem, when it finishes recording 5 minutes it will stop but you can start recording again instantly by pressing the RED button. There is no limitations between records on the free version.So for me free version is completely Okay. Its about recording the call and as soon as first 5 minutes finishes press record button again and it will start to record again vice-versa

I have personally tested this and

• It records videos of both cams on picture in picture or any method that you set
• Records sounds of both sides
• No Quality degradation on recorded videos. It records same as what you see on skype and saves on .AVI format

You can download and read more about it here - http://www.ruchirablog.com/go/supertintin  ( This isn’t a referral link)

Other posts you might feel interesting

• 1+ Years of Uptime with linode! Review
• Linode Tokyo/Japan Speedtests
• Linode XEN VPS review
• Text editor for programmers notepad++
• Skype SPAM’s

Have you ever wondered about a great feature which lets you to copy photos,videos,music and stuff wirelessly to your phone while you are on home or work? I know that now you will think about bluetooth file transfer but its so slow can even think about copying a movie to your phone from your pc.

If you have a Android handset and Wifi connection on your pc you are lucky. I’m going to show you are very easy way which I found about 10 minutes ago to mount your phone’s internal memory and external SD card via wifi on your windows Vista or 7 PC.

It simply means that you can access your phone memory just like you access it when you plug USB cable in mass storage mode. Yes in this method the memory will show up as a drive on your pc which you can behave like you are accessing it on mass storage mode! So lets get to the topic,

What you need-

• Android Phone
• of course you need to have wifi on your phone
• Wifi access on your pc
• Simple and small app called swiftp ( Wait its free) https://market.android.com/search?q=swiftp

Just install that app and setup it. Here are my install screenshots

Note- If you are running Android Froyo on your phone change the default path as shown in the right corner picture “/mnt/sdcard/” leave the default one for gingerbread.  After giving a user name and password of your choice press Save and Start

Now it will show you the wifi url and you can visit it on your PC’s web browser visit the url and when it asks for user name and password give your predefined username and password on it. You can use any kind of computer which is on your network for this because its just a FTP url and its accessible via any FTP supported web browser on your network.

And as final step lets move on to mounting this as a drive on your windows pc.

1. Right click on the My Computer icon on your pc and chose the “Map Network Drive..” option.

2.  Then you will get a window like this and on it click highlighted thing on red

Then you will be asked to complete a simple wizard and it will ask for your wifi url, username and password you defined. And now you are complete.

Final result-

Other posts you might feel interesting

• Wordpress blog got hacked? Part 1 What are the common mistakes you make!
• Employ your Android devices gyroscope! Shaky tower!
• What is Google Panda?
• Google finally updated page rank :)
• Pagerank updates 2010

Ever wondered how many clicks that you do everyday with your PC? It can be thousands for me its about 300 per hour when I’m browsing web. How to find that? Well I found a simple .exe file which stays on your task bar when you run it and when you move your mouse pointer on top of the star icon it will show how many Left,Right,Middle clicks that you done since start up of the program.

Its just 191KB single file .exe program and wont eat any resources of your pc. And you just run it when you need to count and like I said it will show stats when you hover mouse on top of it.

Download file here- www.ruchirablog.com/downloads/ClickCounter.rar ( Fully virus free and tested )

Care to share your click counts in comments

Random Posts

• Find out uptime of a server without SSH
• How much does your Twitter worth?
• Get a free mastercard
• Track online users live in your wordpress blog!
• How to get more twitter followers

This is hilarious and I cant stop laughing watching these videos and this soundboard makes me think of making some prank calls

So whats this all about?

You heard about prank calls right? But most of them aren’t  make us laugh they are boring sometimes. But believe me this “Chinaman” never made me boring listening to his calls on youtube.

To be more informative there is a thing called soundboard. Nothing magic but its a like little program which makes sounds when you click specific buttons on the board. Just like the buttons on Organs (key board) make drum sounds when you click them. So in this example sounds can belong to some popular characters speech. Which lets you sound like that person.

So in this prank call world there are many soundboards can be found which makes sounds or speech phrases of popular persons like Micheal Jackson etc.

Easiest way to make prank calls is using your PC because you can easily let other party hear your soundboards sounds without hooking anything up to your PC to your Phone’s microphone. You can use skype or any kind of VOIP software for this.

Take a look at embedded soundboard on top ( Its property of www.realmofdarkness.net ). Thats the best soundboard for prank calls which I ever found. When you click on the phrases it makes sounds. Actually you need some practice before making real prank calls using this because it needs sometime to remember where are the correct phrases to answer to other party immediately when you are on the call.

You can find many videos done using chinaman soundboard and other soundboards on youtube!

My god this is hilarious! I cant stop laughing hearing this chinaman!

You can find many soundboards on www.realmofdarkness.net

Random Posts

• Am I dead?
• Guide to unlock any Huawei HSDPA modem for free
• Cherry’s better than apple?
• Wordpress permalinks with lighttpd without mod_magnet
• Next time you spam be creative like this

For about a year I had mystique wordpress theme on my blog and it was really nice theme! But it was too popular and used by many bloggers as their wordpress theme. So its not very good to have a theme like that for branding purposes no matter what quality things that you post eye contact will be problem there!

And with mystique theme I had mysql problems because in default mystique theme include recent post thingy in comments area so readers can view recent posts of auther but its querying mysql database like crazy monkey so every page load results in about 100 queries sent out to database server to get recent posts. That resulted high page generation times. Previously it took little more than 1.2 seconds to generate a post page! and also I’m getting bad results on google webmaster tool siteperformance measure It means I might be getting lower SERP’s than I should have default, Thats the real headache I had. I’m no php+css expert to comment out that queries and modify such a advanced theme like mystique and time is came to move to my own theme.

So I got Thesis wordpress framework and built the current theme with my own custom icons in past 8 hours. If you visited few hours ago you may noticed live changes because I made it all live. Thesis framework is amazing and Ill save about it for later.

I always wanted to make simple theme like Lowendbox , HostingFu does. Current theme is not 100% complete but this is it!

Results

• Page generation time for page load become less than 0.2 seconds (BIG UP)
• Low Mysql queries! most of the time less than 30 for each post!
• Low bandwidth, No huge graphics, more text oriented and 70% Gzip compression with nginx
• Helps me to rank better on google because pagespeed is now golden rule!

Some Information

• Theme built on thesis platform
• Fonts used are obtained from google library vis API
• Using 28 wordpress plugins for now

Other posts you might feel interesting

• Wordpress blog got hacked? Part 1 What are the common mistakes you make!
• Contact forms without captcha doesn’t seem to be good idea!
• Day that Ruchirablog got OWND
• Wordpress Bad Behavior plugin blocks legitimate bots
• Most valuable wordpress plugin ever!

Have you ever worried about your government,workplace,school or ISP limitations for web sites? Are you behind Great firewall of china? are you worried about browsing speeds with overloaded or slow web proxy services?

HTTP proxies are the best solution for you. And with squid cache you can make a nice HTTP proxy for your personal or family use.

In my case I have tried SSH SOCKS5 method for access blocked sites but I feel it too slow because connection is encrypted but its so secure than HTTP proxy.

But I don’t need much security like SOCKS5 offer So I have decided to setup squid as a proxy server for my personal use. And felt that its delivering blazing fast speed as same as I’m browsing without proxies.

So now all my firefox traffic is going through HTTP Squid proxy running on UK 512MB XEN box that I had spare and I don’t thinking about going back to normal no proxy mode because speed is same as no proxy.

So here is my guide to setup squid as a proxy server on ubuntu or debian for you!

What you will need-

• A VPS or dedicated server with minimum ram of 64MB (64MB of ram will be enough because squid doesn’t eat much ram)
• Debian or Ubuntu installed on your server
• NANO text editor installed on your server ( run “apt-get install nano” to install it if you dont have it already)

Steps-

Install squid on your ubuntu or debian server, issue this command over SSH

 apt-get install squid

Then squid is successfully installed and you need to setup squid to access internet because its currently set only for localhost

squid’s config file is huge so we need to find some lines using nano on squid config file.

Issue this commands to open squid config file with NANO text editor.

nano /etc/squid/squid.conf

On there we need to add 2 lines to configure this for our personal use.

You can add then on top of the page. those 2 lines are

http_access allow all

http_access allow localnet

Here is the squid.conf file after adding that 2 lines

So that’s it on server side. Restart squid to load our configuration.

 restart squid

Like I said previously on this guide I’m not focused on setting up security for squid like adding ACL (Access Control Lists) to prevent other users using your proxy etc.

But this is 1000 times better than setting up a php web based proxy to browse the web.

While server side setup complete we need to setup our web browsers to use our proxy. I think you are probably using firefox to browse the web so here is the configuration for firefox for other programs you can use the same.

On firefox navigate to Tools=>Options=>Advanced=>Network=>Settings=>Manual Proxy Configuration

On that page enter your IP address that squid is installed and port as 3128 because we didn’t changed the default squid port. Also click the checkbox “Use this proxy server for all protocols”

Thats it!

Note that

• We didn’t setup Access Control Lists so any one who knows your squid server ip address and port can use your proxy.
• When choosing a server for setting up squid for your use try to get a server which gives lowest ping times for your location which will help you to browse more fast.

Other posts you might feel interesting

• LNMP V0.8 The complete Nginx auto installer!
• How to change SSH port on Centos,Ubuntu,Debian
• 1+ Years of Uptime with linode! Review
• Linode XEN VPS review
• Get Amazon EC2 instance free with ubuntu 10

Cloud is the future and they says that Dedicated servers not reliable cloud cloud cloud its everywhere!

How about cloud security + content delivery solution? Yes cloudflare is the rising star on that subject. Even providing free accounts so cant complain at all.

Well I thoght hey I should checkout this with my blog. Then I have visited cloudflare.com to find out more details about the service. And I was able to open cloudflare web site normally.( I think cloudflare is using their solution for their web site too, why not isnt it? )

Then I navigated to testimonials page and tried viewing one of web site. It loaded like normally and its not a blog. So I have looked for other testimonials to find a blog using cloudflare.

Then I found a blog using cloudflare then I decided to visit it by clicking link published on cloudflare testimonials page.

****BAM****

I dont know how they measured im infected? Probably like sixXs measure infected ips?

• Whats disappointing?

When I tried first result on testimonials page I was successfully able to view the site without this funny message! But when I tried another BAM. So is this really reliable?

Decide yourself!

Finally.

Other posts you might feel interesting

• Wordpress blog got hacked? Part 1 What are the common mistakes you make!
• Good news! Amazon SES now supports SMTP!
• 1+ Years of Uptime with linode! Review
• Linode XEN VPS review
• 10 Things you should need before starting successful webhosting business