The Tech Bench: The Single Best Security Tip

Your server is only as secure as what you choose to serve.

Harsh words, but it needs to be said. At ServInt, we work very hard to deliver servers to our customers that are as secure as they can be. But every customization of and installation on a server creates holes in that security. It is simply the nature of the Internet and networking. If you have data to share, you must find ways for users to access that data.

Security is a balance. The most secure server is one that is powered down and not connected to the Internet. But obviously, this server is little more than an expensive brick. To be useful, clients need to customize their servers, installing various programs that serve data out to and receive data from users on the Internet. Read more

The Tech Bench: Jailshell in cPanel

Jailshell is a level of shell (SSH) access that limits a user to his or her specific directory structure.  Under regular SSH when users log into their servers they are taken to their home directory and can execute commands within their directory structure.

Under SSH that user can also travel to any directoy on the server and even use “ls” to get a directory listing, they just cannot open the files or interact with them.  Jailshell, on the other hand, logs users into their directory structure and locks them in (much like a prison or jail cell), disallowing them from openly traversing the directory structure outside of their home.

Jailshell is easily implementable in cPanel. You can switch an account’s shell access in WHM by navigating to Manage Shell Access, under the Account Functions header. Read more

The Tech Bench: Controlling spam and mistakenly blacklisted IPs

Editor’s Note: For this week’s Tech Bench, we thought we’d share the particulars of a recent MST ticket. If you’ve ever struggled with administering email  for clients over your VPS, this is one’s for you.

 

Recently, a customer submitted a ticket to the MST asking for help with the email on his VPS. It quickly came to the attention of our Director of Network Compliance, Mike Witty, when the customer explained that all email going through the mail delivery IP address on his server was being blocked by AOL, Gmail and AT&T.

The reason given by the email services for blocking his IP address was that it was a suspected source of spam. Yet the customer was in contact with all the users on his VPS and knew that they were not sending out spam.

Read more

Help Us Help You

As Director of Network Compliance, one of my less enjoyable jobs is to explain to a customer whose server has just been hacked exactly what damage has been done and what data can and cannot be saved.

All competent webhosts should provide customers with hosting solutions that are secure out of the box. Managed hosting providers work hard to make sure that what we provided customers remains secure on an ongoing basis. But most people can’t make much use of a hosting solution without taking it and making it their own–adding what they need to make their business work. Unfortunately, start adding anything to the solution you’ve been provided and it changes the security profile of the box.

It is not always obvious when a server is hacked. A malicious piece of code may lie buried in a random directory for weeks or even months before it activates and begins doing harm to the server or to other machines.

Unfortunately, this means it is usually not possible to simply restore a customer server from backups. Though we keep a daily, weekly and monthly backup of every VPS customer server, there is no way of knowing if the corruption occurred before the earliest backup was made. All too often, this means a customer is left rebuilding his or her server from scratch. Thankfully, this is a rare occurrence. ServInt, as well as most reputable software providers take active steps to deter and prevent malicious attacks.

In the 1990s websites were largely static html pages. The bulk of the work was in designing the pages. Once they went live, they changed little and needed updating only as often as the owner wished to update the content. But two things have occurred over the last 15 years that have dramatically changed the way webmasters interact with their sites.

The first change has been the development and implementation of server-side software such as PHP, ASP, and even WordPress and Magento. Most websites are no longer simply pages of static text, they are highly interactive and highly customizable. These new software developments open up a world of new things you can do, but they also open up all kinds of security pitfalls that need to be carefully avoided.

The second change is that the hardware that hosts these sites has become far more powerful. Advances in technology have not only increased the processing power and memory of host machines, but they have brought the price of this technology down so far that these machines are available for even entry-level hosting packages.

The keys to the Ferrari.

What this all means in terms of customer experience is that where at one time signing up for a web hosting account meant getting to borrow a bicycle to ride down the block, now it means getting the keys to the Ferrari.

Over the past five years especially, this combination of increasingly complex software and more powerful hardware has led to a dramatic increase in hacked servers on the web. Good managed web hosts routinely monitor their clients’ servers looking for any suspicious spikes in usage that might indicate unauthorized access. Companies should—and many do—try to work with customers to ensure that their server is ‘hardened’ (a pretty loaded term) and when circumstances dictate, that they have firewalls in place. But even with these steps and many others—forgive me if I must be intentionally vague here—at some point there is little even the most proactive host can do to anticipate a hack.

This is where customers come in.

One of the single best ways to prevent hacked servers is to keep all server-side software up to date. Vendors are constantly learning about and correcting weaknesses in their software code, releasing free updates to their users.

It would be great if a hosting company could magically update all of the third-party software customers have installed on their servers, but with literally thousands of different pieces of software for web designers to choose from, this is impossible on a practical level. A managed host does its part by upgrading operating systems and kernels as needed, but without consulting each customer personally and maintaining extensive lists, there isn’t even a way to determine all the software that is running on a customer’s server, let alone individually updating each customer’s products.

So what can customers do to protect themselves? Here are a few steps:

First, only install the software you need. Each application installed on a server opens that server up to any security risks the software has. The fewer pieces of software running on your system, the lower the chance of our server security being compromised.

Second, keep track of your installed software so you know what you’ve set up. I can’t tell you how many times I have traced the source of a security compromise for a customer only to have them say, “I didn’t even know that was still on my server.”

Third, keep the software you are running on your server up to date. There are options you can enable in cPanel and some other control panels to inform you when any software you downloaded directly from your control panel has been updated.  Also, many places such as The Symantec Security Focus Bugtraq list allow you to sign up for emails that will send you information on software updates.

For all other software, there should be a page on the designer’s site which lists current versions and where to download updates. Keeping a folder of bookmarks of these sites can be a real life saver. Simply surf to the pages you have marked a couple times a month and check for software updates.

Fourth, ensure that the computer you are accessing your website from is properly protected. Keeping your server locked down against attacks and completely up to date is only so helpful if a piece of malware on your desktop tracks your keystrokes and finds out your server’s password when you log in. Having your server’s  root access compromised (getting “rooted”) makes for a very bad day.

Finally, it sounds simple, but it is very important. Change your password, and change it often.

A few simple steps can put the power of security in your hands and go a long way to ensuring your server doesn’t fall victim to attack. A good managed host will work tirelessly to make sure that your business always stays up. But if you keep a close eye on what you put on your server and keep it updated, it’ll go a long way in helping us help you.

Photo by jonworth-eu

RAID, Backups and Beyond: The Basics of Data Protection

When you invest in the monthly expense of a hosting service, one of the biggest questions in your mind—other than, will my customers be able to get to my site?—is: How protected is my data?

Managing thousands of servers here at ServInt, we’ve seen it all: from the common problem of a VPS customer who accidentally deletes an important file to a host machine head crash physically etching the disk of the hard drive.

Human error and hardware failures are simply part of doing business as a hosting company. Even the most competent webmaster or programmer can inadvertently overwrite a file. And no piece of hardware created can be guaranteed error-free 100% of the time. So how is a customer supposed to protect him or herself from the inevitable need to replace lost or corrupted data?

There are three important—and distinct—data protection options to consider when researching hosting solutions. ServInt recommends customers utilize all three options whenever possible.

1. RAID. RAID stands for Redundant Array of Independent (or Inexpensive) Disks. Simply put, RAID is a way of replicating data over multiple disks such that if one or more disks in the array fails, no data is lost. The simplest form of RAID is RAID 1, which mirrors of one half of the array onto a second. But many other configurations exist including RAID 0, 2, 3, 4, 5, 6 and any number of combinations of these configurations.

Each RAID configurations takes a slightly different approach to duplicating data across an array including striping, mirroring, and dedicated or distributed parity (a form of checksum used to “rebuild” lost data). Different configurations have benefits and drawbacks regarding efficient use of disk space, write speed, recovery characteristics, etc.

This layer of protection—when available—allows the seamless rebuilding of degraded disk arrays and prevents much of the data loss that would otherwise occur when a disk fails. But while RAID is important data protection, it is not a complete backup solution. RAID is a means of writing data to a drive. If one disk (or more, depending on the size and type of the array) fails, the data remains accessible on the other disks while the failed drive is replaced. But if a file is corrupted or manually deleted, the fanciest RAID array in the world won’t bring it back to life. That’s where backups come in.

2. Backups. All data on a server should be protected by backups daily. Any reputable hosting company will provide a competent backup solution to its customers. Many include off-server solutions that combine the backup needs of many host machines onto large storage servers.

Why off-server? How protected is your data if the backups are stored on the same hardware as the main data? To be fair, in-server second drive backup solutions are fine in many cases, but they do require a technician to remove the drive from the chassis in case of restoration to a new piece of hardware, or replacement of the primary drive before data can be recovered from the secondary drive.  Additionally, on-server backups do not allow for central management of backup data and provide a relatively finite amount of backup capacity as compared to networked backup server solutions.

3. Off-Network/Off-Site Backups. If the only concern in our lives were the reliability of host machine hardware, hosting customers would not need to worry about off-network and offsite backups. But this is just not the case. No matter how robust a hosting company’s data protection measures are, multiple redundancies are built into systems specifically because multiple failures can happen.

Every responsible customer should initiate a program to back his or her data up on machines that are completely independent from the host machine’s hardware and network. For most small customers this might be as simple as archiving data through your control panel and downloading it to a home computer. For larger customers, this may mean seeking out a second solution from their hosting provider. Does your provider offer servers on multiple vlans in independent data centers? If not, it may pay to investigate a second hosting company for your secondary backup solution—or to switch hosts completely.

The needs of customers’ off-network/off-site backup solutions are so varied that it is difficult for hosting companies to provide out-of-the-box solutions. For this reason, it is often left up to the customer to be proactive regarding this last line of defense against data loss.

These three levels of data protection just scratch the surface of what’s available to the customer serious about protecting data. But it’s a baseline. If you can confidently say the data protection solution for your online content includes these three levels of protection, you are well on your way to secure deployment. And you are ahead of much of the competition as well!

 

Photo by Ruben Molnes

Cloud Hosting Series, Part 3: Making Hosting Better… Not Just Bigger

In part 2 of our Cloud Hosting Series, ServInt CTO Matt Loschert made some interesting comparisons between VPS and Cloud Hosting.  One of the things Matt said was “Cloud Hosting creates a world in which server instances are transient and disposable. The instance is no longer important — the communication and cooperation between instances is.” Pretty dense. Still, it got me thinking because this notion is at the heart of the promise of Cloud Hosting.

I was still thinking about it when I showed up to the local deli for a sandwich yesterday. I usually go around 2pm. Yesterday I went at 12:30. The place is tiny and normally sleepy-quiet. It’s just the owner at the counter and her son working the register. Frankly, I’ve sometimes wondered how they stay in business. But yesterday, an hour and a half earlier than I usually go to lunch, the joint was PACKED – and three times while I was there I saw groups of people come to the door, look at the line and walk out. Most of the time the owner’s just sitting on her hands when I come in. I realized that at 12:30, her business is MADE – but it’s not maximized.

So what does this have to do with Cloud Hosting? Well, the number one goal of Cloud Hosting seems to be the ability to achieve new levels of scalability. My deli experience serves to remind that the challenge of scalability to a business is not new.

ServInt has been a pioneer in finding solutions to the needs of customers who need to scale, sometimes quickly. Our entire VPS and Dedicated lines have been built to allow customers to expand and contract their single server at will. With the tech we employ today you can do things you can’t do in the real world. In an enterprise-class VPS world my little corner deli could simply grow in size to meet demand by calling the landlord—in this case a hosting company like ServInt—and ordering up a bigger space. One simple move later and the deli could handle the increased number of customers.

This has been a revolutionary and tremendously successful model, but it’s not without its problems and inefficiencies. The VPS model relies on manual configuring by the hosting company and time to complete any necessary migrations. The promise of a well-designed Cloud Hosting platform offers a tempting improvement on this.

To be fair to VPS, new improvements are continually being developed that bring these basic Cloud benefits into the VPS realm. In fact, there is a lot of pressure in the industry for companies like ServInt to call what we do with our VPS products “Cloud Hosting”. After all, when well-designed and backed up by high-end hardware, VPS has high-redundancy and incredible on-demand scalability at the core level AND the individual resource level. It doesn’t fit every technologist’s dream list of what a Cloud Hosting offering should be, but what does? It’s Cloudy and that’s good enough for some people.

Imagine what it would mean to my deli owner’s business if she could rely upon scaling technologies like the ones that I’m describing here. When the deli is packed, the owner hits a button and the deli magically gets bigger. When the rush ends, the owner hits another button and the new store shrinks back down. The landlord simply bills the deli owner rent and utilities based on the size of his restaurant at any given time. It would truly allow her to maximize her business. This kind of scaling may be fiction in the real-world, but in the Internet it’s very real – and available today. You can achieve that kind of rapid scalability right now, by either purchasing a scalable platform such as a VPS, or a Cloud instance configured to be used like a VPS.

But as Matt pointed out in his post, this benefit—while enticing to many—does not realize the true potential of Cloud technology. What VPS—and Cloud utilized like VPS—provides is the ability to take a single store, and either during a special promotion or just during the peak time of the day, turn it into a much, much larger single store. What Cloud Hosting promises you’ll be able to do is to take that single store and, instead, turn it into five, ten or one hundred identical stores working both independently and interdependently, increasing both redundancy and scalability in the process. At some point, no matter how big a single deli you build, if that deli becomes infinitely popular that one deli will eventually be too crowded to handle its business effectively. But if you turn that one deli into a whole chain on the fly… that’s another matter.

But here’s the thing – right now that kind of scaling doesn’t work right out of the box. Right now it takes coding. And so, frankly, a whole lot of people are getting Cloud instances and using single-instance scalability – basically using a Cloud instance like a VPS. And that’s fine for many.  This industry’s next steps will be in taking the true scalability promise of Cloud and making it attainable to a general business consumer. Once we do, we’ll truly achieve what Matt Loschert was talking about when he described a world in which individual server instances are transient and disposable. Once that is achieved, so will incredible levels of scalability, to greater degrees than we have imagined — and incredible levels of redundancy as well.

So just how does a hosting company build out a Cloud solution? Coming soon in part two of this post, I’ll talk about what providing businesses with the ability to scale like this looks like behind the curtain from a nuts-and-bolts perspective.

Photo by Liber

Cloud Hosting Series Part 2: VPS to Cloud?

I have to admit, I’m a bit baffled by some of the messages I’ve heard coming from our competitors and from customers recently about what Cloud Hosting means to our industry. I often get questions from customers and read advertising from other hosting companies that equate Cloud Hosting to being the obvious replacement for dedicated server or VPS hosting. We hear things like, “upgrade to our Cloud solution” and “host your website in our Cloud,” as if your website wasn’t working on its current platform, or with the advent of Cloud, your website would stop working all of a sudden.

Don’t get me wrong, Cloud Hosting has its place in the market, and it will become increasingly relevant with time. In fact, as a platform, Cloud will become a necessity over the next few years. But, right now – are you ready for it?

In the SMB realm, our industry continues to sell hosting as it has since pre-Cloud days. It’s all still server, VPS, or instance focused. Everything goes back to a software architecture and design philosophy that places the greatest emphasis on managing your operation on the server level, and automating as much of that operation as possible, hence the the proliferation of control panel software over the past 10 years. Control panels attempt to simplify web hosting management, a task that was previously highly technical and arcane, requiring deep knowledge, typically gained after years of experience.

If, as a customer, you think of Cloud Hosting through this server-centric lens, you won’t reach the promise of Cloud. You can have your server in the Cloud, but it won’t give you and your hosting company anything more than a way to more quickly and flexibly provision and bill for VPSs. If you’re looking at hosting the way most do who have been consuming hosting services in the era of mass-market server virtualization, Cloud Hosting offerings in the market today can seem marvelously underwhelming. It’s virtualization with provisioning automation, or — put another way — it’s hosting where provisioning control has been given to the consumer.

Okay, so then why does anyone care about Cloud? What has truly captured the attention of the industry is not what Cloud Hosting currently is for the SMB community, it is the promise of what it can and will be. Cloud will revolutionize hosting, but not in the way that some seem to assume right now. It is not going to make server management more simple, or optimize the software platforms of today. And it won’t simplify your life. Cloud will, however, make possible a paradigm shift in the way that applications are hosted on the Internet.

What makes Cloud revolutionary is the mental shift that it allows in developing web-based applications. The ability for the hosting consumer and/or software developer to control resource provisioning allows development that goes in a completely new direction. Cloud Hosting creates a world in which server instances are transient and disposable. The instance is no longer important — the communication and cooperation between instances is. The developer writes provisioning logic into his application because, by breaking the functional requirements out into logically separable parts, he can build a system that can auto-scale to meet individual application requirements.

The problem is that many seem to assume that they’re going to bring their old applications, control panels, and knowledge to the Cloud, and that it’s all going to work even better. That’s not really the case. You will
be able to bring these things to the Cloud, but they will not take advantage of the true benefits of the Cloud. One solution to this problem is time – time for developers to begin writing applications to Cloud APIs and using technologies that allow for simple inter-server cooperation and synchronized data sharing and manipulation. This will naturally occur over the next few years, and it will come as a result of the creation of new development frameworks that make splitting hosting tasks into logical chunks a simple process.

Ultimately, Cloud Hosting is cool, and it is revolutionary. But right now, if you want to rush to the Cloud, ask yourself what problems you are trying to solve and who are you relying upon to solve them. For your own sake, make sure you know how your Cloud vendor will improve your operation. Otherwise, you might just end up getting sold a good old dedicated server “in the Cloud” — which you might even pay more for.

Cloud Hosting Series, Part 1: A Marketer’s Perspective

 

A few weeks ago, I traveled to San Jose, CA, where I attended the “Cloud Connect” conference. Cloud Connect is basically an annual symposium where the biggest players in the cloud industry gather together to talk about what’s coming next for the Cloud. Analysts opine, accountants report, Fortune 500 CTOs brag, consultants take notes, and those of us who are already deep in the trenches of the virtualized data center industry scratch our heads and wonder how any of this applies to “ordinary” businesses.

In later blog posts, our engineering and operations guys will get into the technical/management nitty-gritty of Cloud hosting. For now, I just want to share the following summary of what I learned at Cloud Connect, which I hope will set the stage for some of their comments:

1. Extremely large enterprises are now getting very serious about the cloud. What was a buzz phrase last year has turned into a real storage/processing/hosting option for some of America’s largest companies.
2. These companies don’t know how to approach the cloud. Should they go with a “private cloud” — i.e., a virtualized private platform that ensures security, but provides little to no economic benefit? A “hybrid” platform, where they keep certain apps and data behind lock and key, and burst out to the cloud only when necessary? Or should they go whole-hog and move everything to companies like Amazon? Most seem somewhat paralyzed by the choice.
3. The real adoption of cloud — even in the Fortune 500 universe — is still very modest.
4. Having said that, enough hyper-enterprises have moved into the cloud for industry bean-counters to be able to analyze some real data about computing resource efficiencies at those companies. This data has led analysts to conclude that at the enterprise level, cloud savings are very real, and can be very, very significant.
5. There are dozens of clever startups that are trying to turn the generic, SMB-hostile resource platforms offered by today’s cloud companies into more useful products. In my opinion, where these companies are succeeding, they’re offering only partial solutions to huge macro-level problems — and you still have to be an extreme early adopter to make sense of them.

So that’s the story as far as generic cloud services are concerned.  Much of the same story applies to companies that are marketing hosting “in the cloud.”  For the most part, they’re targeting their services at customers with the ability to take a bare-bones, science-project technology and develop it to meet their specific needs. That means hyper-enterprises with seven-figure IT budgets and early adopters eager to take a whack at a new, unproven platform. If you’re not one of those companies, good luck finding a cloud hosting solution that works for you “right out of the box.”

I’m a marketing guy, so I generally tend to be one of those “glass-is-half-full” people. For now, though, that’s my honest assessment of the current state of the Cloud in general, and Cloud hosting in particular.

Next week in part 2 of our Cloud Series: “From VPS to Cloud? Redefining Hosting” by ServInt CTO Matt Loschert.

 

Photo by Liber

What exactly is “Managed Hosting”?

Sometimes, as industries evolve, they spawn new jargon that only means something if you’re inside the industry. To outsiders — even potential customers — these turns of phrase can seem confusing at best, and downright mysterious at worst.

So it is with the term “managed hosting.” Search the web for a definition, and you’ll get 10 different answers from 10 different companies. As ServInt’s Director of Managed Services, I want to take a minute to explain what managed hosting means to us. You may find that our definition is more expansive than those offered by our competitors.

Let me start with a pet peeve of mine. It really bugs me when web hosting companies use the terms “support” and “management” as though they were the same thing. They are not.

Support is reactive. It’s what you provide when things go wrong. It’s important, but if your goal is to achieve maximum uptime, support alone doesn’t help much — because it doesn’t avert catastrophe; it simply restores order when things go wrong.

Management — and, by extension, managed hosting — is proactive. It avoids problems. Here are some specifics from our to-do list at ServInt:  we provide compatibility checks; custom requirement analyses and one-on-one product and platform consultations; custom software installations; port, service and system monitoring; OS system patches and upgrades; and personalized technical advice and assistance. In other words, we don’t just support our customers when things go wrong; we manage the hosting of their sites to try and prevent things from going wrong in the first place.

Web hosting is a service industry. There may be lots of technology behind the solutions hosting companies offer, but the service they provide is what really differentiates their solutions. That’s why you see company after company touting their level of customer service as “heroic,” “fanatical,” “stupendous,” and so forth. Service sells! All I can say is: ask questions. Make sure that when they say “service,” they mean proactive management — not just support — of your online business.

One last thing: to get the most out of your relationship with your managed hosting service provider, stay close to them. Let them know when you’re expecting spikes or surges in traffic, or when you plan to launch a new app on your site. Inform them when you roll out a killer marketing plan, or when your site’s “high season” is about to begin. That kind of information will help them help you.

 

Photo by Karen Eliot

Does Online Advertising Work?

Just about every company worth its salt has some sort of online advertising component as part of its marketing budget. With the ubiquity and ease of use of platforms such as Google’s Adwords and Facebook ads, online marketing has truly become an accessible avenue for a lot of novice advertisers.

But there’s another question that has nagged advertisers in all mediums for as long as there has been marketing, does it work?

Online advertising, whether it’s in the form of a banner ad or text ad, seems inherently impersonal. You’re creating and placing ads that are viewed by nameless, faceless people who could literally be anywhere in the world…the task to reach them seems daunting doesn’t it?

What a lot of people forget is that this is exactly the same with all advertising, regardless of the medium. You don’t really know who’s looking at an ad on a billboard, or who is listening to the radio, or who is watching your commercial on television. Sure, there are demographic studies you could perform that could help you make intelligent guesses, but the truth is that data is useless if your product has a narrow or hyper-competitive market. In this respect webhosting is an excellent example, as costs per click (CPC’s) for popular keywords in our industry regularly hit the $25 mark in Google Adwords, the most popular ad network online by far.

comScore, a tech marketing analytics firm and a great source of genuinely interesting internet marketing info has performed a spate of studies recently that bring up some great points on this very topic.

In August, the firm released the findings of a study it conducted with dunnhumbyUSA that focused on the difference between television and online advertising. You can checkout a detailed press release about the study here, but I’ll do my best to summarize the findings.

The two firms used the example of consumer packaged goods, things such as food and snacks, to test whether online advertising actually worked. By tracking the buying habits of thousands of shoppers using their supermarket discount cards the firm was able to obtain fascinating, and to some extent unexpected results.

The study found that, in a sample size of roughly 200,000 shoppers, the brands who were exposed to consumers via ads on the web saw a 9% sales lift over a three month period with 80% of the campaigns showing a statistical increase. Those exposed through television ads saw an 8% sales lift over twelve months with only 36% of the campaigns showing a statistical increase. This is staggering data, it means nearly 1 in 10 consumers will change their buying habits in the affirmative after being exposed to an ad online and in a very short amount of time as well.

Of course, there are plenty of things to take issue with, the study doesn’t comment on the frequency of ad delivery or what percentage of ads were static vs flash, but it does at least validate the concerns of many advertisers out there.

What’s your take on the status quo in online advertising? Let us know in the comments, on our Facebook page, and on Twitter.

Photo by kevindooley.

Next Page »