MEBBiNET | Consultancy & Support for Virtual Server Technologies

Scalr - The Holy Grail of Auto-Scale

2012-02-05T13:18:00.000Z

MEBBiNET use Amazon Web Services as core technology for all cloud solutions, for us it's the perfect platform offering robust cost efficiency with ease of administration and development flexibility. That said, it does have it's limits and auto-scaling from live instances is one of them.

Scalr is an open source or hosted service which addresses this problem directly, and delivers a resolution beautifully. Not only does it provide an answer to dynamic auto-scaling but provides globally resilient load balancing for single server farms, let's take a look at what's on offer.

AWS does provide auto-scaling, and it works very well, however it's only possible from pre-built AMIs (Amazon Machine Instances). If you have a live instance running, and update it, in order to propagate changes to your other already running, auto-scaled instances you have two options. Update manually, which is a real pain if you have a sizeable farm running, or create a new base instance, change the farm scaling script and re-launch the server farm. Both options are time consuming, convoluted and we know you'll have better things to do.

Creating a server farm in Scalr couldn't easier and once running you can snapshot an updated build and replace all running instances with the new version, quite literally with one-click, it can, and will, save you days of work.

Scalr provides a whole array of pre-configured server options covering not only the usual suspects (Apache and MySQL etc) but extra roles such as dynamic memcache boxes and/or bespoke builds from base images, it can deliver solutions for both Linux and Microsoft and provides resilient managed load balancing from Nginx, you can even load balance the load balancer...!

The interface GUI is clean and intuitive and provides comprehensive options for every conceivable dynamic (and some). Below is a basic farm with balancer, Apache & MySQL instances.

Fig 1 : The Scalr Roles GUI.

The icing on the cake though has to be the ease of build for multi-region farms. Scalr allows you to create a server farm using instances from different AWS regions, i.e with a mix of instances from US-East, US-West, EU-West, Asia or South America to provide a true globally resilient infrastructure, it doesn't get any better and if you wanted extra resilience above that the next step would be an instance on the moon.

We've just touched on the main points here but Scalr does offer the full package (for example it will even host your DNS). We honestly can't recommend it enough. Yes, the hosted option is a paid for service but it's a mere fraction of comparative offerings from competitors such as RightScale and personally we think it's a much nicer, much cleaner and much better product, plus for the man hours it saves you it will most definitely pay for itself several times over.

The Scalr website is HERE, the superb Wiki HERE and they offer a free 30 day trial so you can have a play first to see just how easy your life could be. Support is not only swift and friendly but when you get a personal eMail response from the founder you know you're dealing with the right sort of people.

ZPanel on AWS EC2 - 2 : Route 53 DNS for eMail and Web

2012-01-29T15:26:00.001Z

In Part 1 of this series we looked at installing ZPanel to an AWS EC2, a quick and easy process, however to 'go-live' with your new installation you'll need to let the internet know where your domain and website are, and where to send your eMails to (and from). You could manage your DNS through your domain registrar using their own namservers + related records config, or, you could use Amazons superb Route 53. I really like Route 53 and in this post I'll show you how to configure it, with tailored settings go get you up and running in quite literally, 1 minute.

You don't actually need to manage your DNS 'off-site' (so to speak), and other panels such as ISPConfig 3 or OpenPanel offer easy setup for inclusive hosting + DNS on the same box, however this is not recommended. Having everything on one box is an obvious single point of failure as you have one NS record IP. It's best practice to have at least x2 nameservers for redundancy, Route 53 provides x4.

Ok, down to business, you've set up your domain in ZPanel and configured some eMail mailboxes, the next step is to configure Route 53 (accessed from the AWS Management Console).

Firstly, create a Hosted Zone to correspond to your domain, once done create a base selection of 'Record Sets' as below (I'm using ec2services.net as an example domain).

Note the TTL (Time to live), in this example I've set things to 60 seconds, this will ensure we're ready to roll when I update the NS (Nameserver) records. The IP address corresponds to the EIP (Elastic IP) of your ZPanel EC2 instance (And no, that's not a genuine IP, obviously).

The next, and last stage is to update the NS records at your registrar, this is a simple step and the method for doing so is about the same for all hosting companies, I use 123Reg and the procedure is super easy. The advised update window is usually 48 hours, although with 123Reg I've had things dropping in inside an hour (which is why I use them). Simply remove the existing registrars NS records and replace them with the x4 AWS NS entries as listed in the Route 53 Record Set for your newly created Zone.

To check update progress I use http://www.zoneedit.com/lookup.html, once things are resolving to the AWS NS for your Domain you should be good to go.

One small 'gotcha' I had (and thanks to the superb ZPanel support team for resolving this for me) was to do with eMail. One domain I'd created was using Google Apps for eMail, with corresponding MX entries listed as Route 53 Record Sets, however a PHP contact form on the hosted site relayed nothing, nor were other domains on the same box able to send to any address for the domain in question, all I was getting was a 'Virtual Hosts 550' error. The problem? I'd pre-created a mailbox on the server which although I'd deleted, the 'domain' itself was still present in the PostFix database, thus fooling the server into thinking it managed mail for a domain it actually didn't. I deleted the problem domain from inside the Postfix MySQL DB using phpmyadmin and mail started flowing freely and happily. Easy when you know how :-)

For info AWS Route 53 is charged at $0.50 per Zone per month, which is about £3.80 for the full year in UK currency. If that's not value for money I don't know what is.

ZPanel on AWS EC2 - 1 : Installation

2012-01-24T14:05:00.000Z

This is a two-part post continuing along a hosting theme, today looking at ZPanel, why you should use it and how to install it on an AWS EC2 instance with linked Route53 DNS management.

We've previously looked at EHCP, discussed it's DNS inclusive feature set and highlighted its intuitive interface and ease of install, however if you're looking for complete resolution resilience, and even more polish, I think we might have just the thing. Read on....

We'll skip the basics of AWS and dive straight in to the install, which is easy enough but does require a couple of tweaks to get it functioning on an EC2 instance. The installation listed here covers a 64 bit Ubuntu Linux 10.04LTS 'Micro'.

After launch allocate an elastic IP (EIP), update & upgrade your instance and set both hostname and hosts file to match the AWS public DNS name as per the attached EIP, once done log on as root (su) and install ZPanel as follows..

wget http://sourceforge.net/projects/zpanelcp/files/releases/6.1.1/zpanel-6.1.1.tar.gz

mkdir /etc/zpanel

 tar -zxvf zpanel-6.1.1.tar.gz -C /etc/zpanel/

 chmod +x /etc/zpanel/lib/dev/zpinstall_ubuntu.sh

/etc/zpanel/lib/dev/zpinstall_ubuntu.sh

You'll be asked various bits and bobs during install, the usual stuff, internet site for postfix, hostname etc and will have to choose usernames and passwords here and there. The most important entry is what you give when asked for the installation sub-domain. EC2 instances can't handle subdomains, as such you need to list a sub FOLDER, i.e use your EC2 public FQDN but add a forward slash + name of folder (/zpanel). When you're done note down the MySQL and panel access details, reboot the server and log in when it comes back up.

Below is a grab of the ZPanel GUI, which I personally think is the cleanest and most simply coherent of any other hosting panel.

Tweaks :

On checking Service Status you'll notice that both MySQL and SMTP aren't started, getting them fired up is an easy fix and just requires editing a couple of config files.

SSH into your instance and we'll sort SMTP (Postfix) first..

nano /etc/postfix/main.cf

Simply locate the two hostname entries (they're near the top of the file) and remove the trailing folder from the FQDN as listed (i.e /zpanel), save the file and start Postfix..

service postfix start

All good, now MySQL..

nano /etc/mysql/my.cnf

Comment out the following lines (with the #)..

socket = /var/run/mysqld/mysqld.sock

bind-address = 127.0.0.1

Save the file and restart MySQL..

service mysql restart

With everything running you'll probably now move on to create a domain, and on doing so you may wonder why it shows 'Pending' once created. This is because by default ZPanel runs an hourly Cron job to update the Daemon, it's a simple file edit to alter this to something a bit more dynamic..

nano /etc/cron.d/zdaemon

..and change to 0 to */10 to run every 10 minutes.

The rest of the admin utilities are quite self explanatory to those familiar with hosting, and there's no more behind the scenes tweaking required to get things running smoothly. You will, of course, require some form of DNS management to get your newly created website (and eMail) live and in the next post I'll show you how to do so via Amazons superb Route53.

Mini Me - OSX on the Dell Mini 9

2012-01-03T13:49:00.000Z

I wasn't going to write this post as there are plenty of others detailing the experience and procedure, however I'm so happy with the result I felt obliged to spread the love.

Basically (as many others have done) I've turned my Dell Mini into a pocket sized Apple OSX Netbook, and the results are quite surprising. So, here I'll provide an overview of the procedure I used with a few extra comments covering minor glitches I encountered and how to fix them.

Firstly, you'll need a Mini 9 of suitable spec, i.e with a 16GB SSD, 8GB is too small to hold the OS, also if you have 2GB of DDR it will perform MUCH better. You'll also need a retail copy of OSX 10.6 (The OEM version is no use) and an 8GB USB key (I use a hi-speed Patriot Xporter XT).

To kick things off you need to prepare the key, this is done as follows by simply formatting and 'restoring' the OSX DVD image too it.

As shown simply drag the mounted OSX DVD image to 'Source' and your USB key, formatted with 1 partition, as Mac OSX Extended (Journaled), to 'Destination', click 'Restore' and let it do its stuff.

Next, download the simply awesome NetBookBootMaker and install it to your OSX install USB Key.

http://code.google.com/p/netbook-installer/

Before you install OSX to your Mini there are a couple of settings you'll need to check in the BIOS. To access the BIOS hit the '2' key at boot. Make sure 'USB BIOS Legacy Support' is enabled of else you won't be able to boot from USB. Insert the USB key, reboot and hit '0'.

From the boot menu select the USB device, you will boot into the familiar OSX installation screen, select your language but do not begin the installation. We first need to prepare the internal SSD, this is done using the 'Disk Utility', accessed from the top menu, simply select the SSD and format as Mac OSX Extended (Journaled), once done you are good to continue with the installation.

Select 'Customize' and de-select all extra options (languages, printer drivers etc), although they are useful there is limited space on the 16GB SSD, as a rule they are invariably unused anyway. Once done proceed with the installation. The system will restart when it is finished and you can input your details as you would with a regular new OSX build.

Ok, we're all good, now to update to 10.6.3. My machine took the OSX 10.6.2 Combo quite happily (always download and use the Combo installs, DO NOT use software update), however 10.6.3 took a bit of tweaking to get sleep functionality working properly. Download 10.6.3 v1.1 from HERE.

You may also want to check and/or upgrade your Mini 9 BIOS. Version A06 seems to be the preferred release and Dell provide a really neat utility for doing so (pictured below), the download page and link for this is HERE.

It's all quite straightforward (although you do need to run it from a Windows PC). Run the utility and 'Install to USB Flash Drive', boot the Mini 9 from it and upgrade the BIOS. Make sure you have the mains power plugged in whilst doing this as if things fail halfway through you could brick your Mini.

Back to 10.6.3 then. Fixing the sleep function took a few mods for me. In the System Preferences under 'Security' disable secure virtual memory, next open Terminal and type the following commands..

sudo pmset -a hibernatemode 0

sudo rm /var/vm/sleepimage

Next I needed to remove one of the kext files, this took some finding out but fixed the lockups I was experiencing when the machine returned (or didn't) from sleep. The file path (and file) I removed was found at the following location..

/System/Library/Extensions/IOATAFamily.kext

Finally I re-ran (Install) the NetBookInstaller (you'll find it in the Applications folder) and rebooted, making sure 'USB Legacy Support' was disabled in the BIOS. For me all was well and sleep/resume functioned perfectly.

An added bonus of NetBookInstaller is the extra TrackPad utility it drops into the System Preferences panel.

This is really cool and provides options for two finger and horizontal scrolling plus tap and drag, it's the icing on the cake if you're a Mac user.

So, there you have it, the procedure I followed to 'Hackintosh' my trusty Dell Mini 9. I'm still really surprised with the outcome, not only because it was very easy to do but also in how it performs. It boots in around 30 seconds, which is almost twice as quick as my MacBook Pro, itself no slouch with a 2.8GHZ CPU, 8GB Memory and a 500GB Seagate Momentus XT SSD hybrid HD.

Below is a photo of the beast itself. In my opinion a 'Must Have' for every man-bag.

EHCP - Domain Creation and Management

2012-01-01T11:39:00.000Z

The previous post gave a compared first look at EHCP, the install procedure and its admin GUI, here we'll go a step further into Domain creation and management.

EHCP offers a really nice 'Easy Add Domain' utility, which does exactly what it says. You simply type in a domain name and it populates a DNS template for you containing all required default records (NS, A, CNAME etc). Once done you can manage extra domain functionality or package installs via it's own admin panel.

The control panel GUI provides a comprehensive toolset covering all aspects of Domain management. Particularly useful is the 'Install Script' utility under the 'Advance' section. This provides auto-scripted installation for a whole range of regularly requested web frameworks covering (among others) - Wordpress, Magento e-Commerce, Joomla, Drupal, Coppermine, ZenCart, Moodle and many more. Very useful, and a feature you would perhaps only expect from more commercial (paid for) offerings.

Direct access to the Apache template is available (should you need it) and extra config above default record entries is provided through the 'Edit DNS Template' utility. Both present actual system files for editing in the same format they would be as created outside of the GUI, this is a nice touch as it gets you up to speed nicely with the 'real deal', but in an easy to comprehend, less daunting way than if navigating raw around config files from the Linux CLI.

As before the grab shown here is running the 'Sky' template and I can't understand why they don't tag this as default as it's by far the cleanest and nicest looking of the lot.

The EHCP website provides extensive support with a lively forum should you have any queries.

Easy Hosting Control Panel

2011-12-31T12:29:00.000Z

There are a number of free hosting panels available for Linux and I've evaluated them all. The main contenders are ISPConfig 3, ZPanel, OpenPanel and EHCP (Easy Host Control Panel).

In this post we're going to take a look at EHCP, a product I'm happy to both recommend and use. It offers easy installation and comes with a comprehensive range of features coupled with a clean and intuitive look and feel.

Post installation the admin GUI is a good place to start and although OpenPanel offers a really nice 'OSX-esque' interface, as a hosting panel per se (for production use) I personally don't think it offers the industry standard look and feel hosting admins will prefer. ISPConfig3 is more basic and although ZPanel is great it doesn't come with any DNS management as standard, whereas EHCP does. No DNS management is admittedly no show stopper as there are plenty of options (i.e DNS at registrar level or AWS Route53), but if you do want to provide inclusive DNS services it's certainly something to consider.

Below is a screenshot of the main admin GUI running the 'Sky' template, looks pretty nice right?

As you can see from the grab you're provided with a comprehensive suite of hosting tools covering all aspects of domain and client management, presented in an attractive GUI. The Domain tools are particularly nice and offer thoughtful on-stop combination utilities such as 'Easy Add Domain', 'Bulk Add Domains' and 'Add DNS Hosting With Panel User'.

EHCP is supported from Ubuntu 6.06 to 11.10 plus Debian Etch & Lenny. Installation is a breeze and is scripted from a wget as follows -

wget www.ehcp.net/ehcp_latest.tgz
tar -zxvf ehcp_latest.tgz
cd ehcp
./install.sh

Input name, passwords, FQDN etc as requested from the on-screen prompts and you'll be up and running in around 20 minutes, it couldn't be easier.

Further information and support is available from the main website - http://ehcp.net/

In the next post we'll look at creating a domain with related management and auto-script installations.

Secure Linux in the Balanced Cloud

2011-12-27T13:37:00.000Z

A recent client project required a resilient framework from which to deliver their secure web facing application. Their initial request was for a load balanced, Linux AWS EC2 platform with MySQL replication and https (SSL) access, what we delivered provided all this, but with the added bonus of Intrusion Detection and self monitoring, self healing servers with eMail alerting. Below is a schematic displaying the build and server relationships. A detailed explanation follows.

The project was completed in a mere five days from initial consultation on-site, to actual go-live on the fifth day, both ourselves and the client were very pleased with the outcome.

Technology breakdown

Instances used were all based on the x64 bit Ubuntu 10.04LTS EC2 EBS image (Canonical supplied) which we tailored to specific server functions as required. To cater for the nature of load, and to provide dynamic capacity for future expansion, x64 bit bit instances are preferred as related EC2s can be self upscaled to higher capacity instances in a matter of minutes with no requirement to re-install the build into a new image. Using Ubuntu also opens up potential for EBS (Root volume) expansion using resize2fs.

We used the Cherokee webserver on the application boxes. Cherokee offers a huge upscale in configurability and admin above basic Apache whilst concurrently providing a much wider range of web utilities and services.

Load balancing was configured for application side sticky sessions set to client specifics.

Rsync was was used via configured cron jobs for application data pool mirroring with MySQL master/slave replication configured accordingly to provide realtime database backup.

Instances were double firewalled at both AWS security group and operating system level with all IPs nailed down between respective servers only.

OSSEC was used for intrusion detection with remote agents applied to all servers and MONIT installed on each configured to dynamically alert and restart any failed services.

Authorised SSL client connectivity was provided from a single SSL CA applied to the AWS load balancer, this gives the advantage of being able to use a single cert across multiple IPs/servers, something which can, and does, give problems in other virtual hosting platforms where a single IP per server model is used. Load balancer traffic was secured between hosted instances only using a combination of tied IPs and self signed certs, the AWS load balancer has no problems with self-signed CAs and accepts them readily on port 443 without warning.

Extra security measures included SSH lockdown (root disabling etc) plus non-default port configurations for all services.

If you are interested in the above, would like further information on the specifics, or require a load balanced, resilient platform for your own web application, we would be more than happy to help and advise. Simply get in touch via the contact page from the main website - http://mebbi.net/contact.php

MEBBiNET are based in Leeds, West Yorkshire, and you would be most welcome to visit us at the office to discuss your requirements, alternatively we can come and see you, although we work in the cloud it's always nice to hook up in the real world.

Cherokee - Little Big Web

2011-11-26T17:00:00.001Z

In Linux world the ubiquitous Apache web server has held position as undisputed big chief since inception, however technology, as it does, advances and amongst an ever increasing proliferation of realised Linux platforms there's many a sysadmin embracing the rise in popularity of it's biggest contender, Cherokee, still from the same open source 'reservation' but with a fresher, faster footprint and a substantially more user friendly admin interface (in that it actually has one). Could the days of cli admin and confusing .conf file editing be over? Well, I must admit since discovering Cherokee I honestly can't see me using Apache again.

Cherokee is developed to be light and robust whilst offering easy administration through a clean and comprehensive web GUI. Below is a breakdown of features offered and applications available.

Web server features

TLS and SSL
Virtual Servers
URL rewriting and redirections supporting regular expressions
Authentication via htdigest, htpasswd, LDAP, MySQL, PAM, Plain, and Fixed list.
Reverse HTTP proxy
HTTP Load balancing
Traffic shaping
Custom and Apache compatible log format.
Ability to launch web applications on demand
Audio/Video streaming
On the fly gzip and deflate compressions
Resilient to the 10000 simultaneous connections barrier
Server Side Includes
CGI
FastCGI
SCGI
uWSGI support
chroot support
RRDtool statistics
Data base bridging and Sharding
Graphical configration interface
Point & Click deployments through an application market

Web applications

Configuration wizards are provided to automatically configure the web server to perform specific tasks, or run frameworks and applications. These provide support for:

The web GUI is invoked from a CLI via the cherokee-admin command which provides a dynamic login password active for one session only. On returning to a command prompt the admin session, and any related access, is terminated completely and becomes inaccessible, as such all configuration parameters and administration are kept completely secure.

Fig 1: The Cherokee Admin main GUI

For those hesitant to migrate who may be concerned about potential disparities between Apache and Cherokee functionality, well, don't be. Cherokee is a direct drop in replacement for Apache, matching structure (/var/www/) and functionality perfectly whilst demystifying previously confusing areas such as Virtual Host config with reassuring visual simplicity.

Installation (for Ubuntu) can be dropped in directly from existing repos via the apt-get command, however to obtain the latest release it's recommended to add the Cherokee PPA (followed by an apt-get update and apt-get upgrade)..

sudo add-apt-repository ppa:cherokee-webserver

As you may have gathered MEBBiNET are big Cherokee fans, we think you will be too.

http://www.cherokee-project.com/

SSL Load Balancing on AWS EC2

2011-11-25T11:53:00.001Z

In this post I'm going provide an overview for one of the most sought after AWS EC2 setups - A securely load balanced pool of instances with HTTPS pass through all the way from client to instance.

Not only does this solution offer secure pass-through, it also provides a method for using a single signed SSL certificate across multiple servers/IPs.

Amazon may have their own way of doing things but the results you can achieve with the tools they offer in the admin panel alone are really quite splendid.

The key to this is knowing that the ELB will happily accept self-signed SSL certs without asking for any confirmation (which doesn't happen if you access the same server from a browser), and yes, you could just use officially signed SSLs but then costs add up, and why do so if you don't have to and are still able to get a seamless and secure pass through without shelling out big bucks? Yes, exactly.

So, what's the deal, well, here's the (brief) overview..

Add your official certificate to the ELB top level and just configure the ELB > EC2 for port 443 to port 443 (without backend authentication).
For ELB > EC2 security lock-down create an AWS security group for your instances with an entry for port 443 using amazon-elb/amazon-elb-sg as the source. This ties the EC2 instance(s) to accept traffic ONLY from the ELB. After saving the entry you'll see it change to reference the ELB name.
Tie down your other entries to relevant access IPs. For example my instance pool runs Ubuntu boxes with the Cherokee web-server installed, as such I have entries for port 22 (SSH) and port 9090 (Cherokee admin) tied to the relevant instance IPs.
On your EC2 instances enable Cherokee SSL/libssl, ensure port 443 is active and provide location path entries to your self signed certs where required.
In your host DNS config create a CNAME record pointing at the full ELB name.
Wait the statutory time for DNS replication (some are quicker than others).
Test using https://your_domain_name and if all is well you should now get a nice, direct https connection.

So, there you have it, we hope this was useful. MEBBiNET offer a whole range of cloud server support covering all aspects of AWS across both Linux and Microsoft solutions, if you would like advice or assistance with content covered in this post, or any other aspects of cloud technology or virtual server security please feel free to get in touch.

Useful links for this post:

http://aws.amazon.com/
http://uec-images.ubuntu.com/releases/lucid/release/
http://www.cherokee-project.com/
http://www.123-reg.co.uk/

Domain hosting - Easy as 1-2-3

2011-11-21T12:31:00.001Z

I've had fun and games with various different web hosts over the years and service levels ranging from restrictive to blatantly annoying. The jokers who lost a full months worth of blog posts and IMAP emails because the "...hard disk has failed" were a particular set of idiots I'd rather forget (I mean, 'The' hard disk? Seriously?). However they're not all bad and in recent times I've settled quite happily with 123-Reg, for many reasons but predominantly due to their clean and simple options for self DNS management at NS (nameserver) level.

If you manage web hosting it's important to be able to point your domains NS records at nameserver names & associated IPs you manage, and create the relevant entries for doing so. Not all domain reg hosting companies will let you do this and of the ones that do I've yet to discover any who offer such an accommodating no-nonsense method of doing so than 123-Reg.

123-Reg provide a superb DNS overview which explains everything you need to know through A records to CNAME and mailserver (MX) entries in easy to understand stages. Download the free PDF HERE.

OSSEC HIDS - Secure Protection for your Web Face

2011-11-14T16:54:00.001Z

Running a server platform requires escalating levels of security awareness and best practice if you want it to keep functioning and your data safe. Business systems incorporate lock down policies which predominantly deal with threats from holes at user level, however if you're web facing, outside the snug protection offered by a corporate firewall, you'd better make sure you're zipped up even tighter.

The internet is a very, very dangerous place and if you're open in anyway *they* will be in, there's nothing so certain.

Hackers are clever, much cleverer than you're average coder when it comes to getting into somewhere you don't want them to be, even so, that's not to say they're going to get into your systems regardless, and by being aware of what's on offer and taking a few sensible precautions you can secure your systems from default very quickly.

The first steps are the most obvious, but you would be amazed (or maybe you wouldn't) at how many people leave root access open (for Linux), or the Administrator account active (for Windows), I mean, are you serious? A virus checker and a (correctly configured) firewall are another good place to start, and if (like us) you use Amazons AWS EC2 platform it's a no-brainer to tie your security group entries to specific IP addresses.

Once you have everything tied down you can sit back and relax, yes? Popping back every so often to keep and eye on things and make sure nobody has rattled the locks? Well, you could do that, or, if you'd rather be properly secure, and be notified of any and all suspect activity, with suitable blocking in place to prevent serious damage, you could install a Host Intrusion Detection System to secure and monitor your infrastructure, and if that's something you think you might be interested in you could do a lot worse to look at OSSEC.

To quote from their website..

"OSSEC is a scalable, multi-platform, open source Host-based Intrusion Detection System (HIDS). It has a powerful correlation and analysis engine, integrating log analysis, file integrity checking, Windows registry monitoring, centralised policy enforcement, rootkit detection, real-time alerting and active response."

OSSEC can also help with your PCI-DSS compliance needs, plus, as OSSEC is Open Source it does it all for free.

OSSEC operates in couple of ways, as a server, self monitoring with agents installed to sub-systems, or agent-less, which basically means it monitors the system it's installed to 'stand-alone' (useful for single servers). Microsoft server platforms can only run the agent so you need a Linux OSSEC server to monitor your Server 2003/2008 instances. This means you need an extra box, but that's not a bad thing, in fact it's the preferred option, I for one wouldn't trust an MS server to look after itself, let alone get in touch if anything dodgy happens.

Installation of OSSEC couldn't be easier, and in most cases you really don't need to do anything other than accept the defaults and input an email address + SMTP server details (which OSSEC uses to send you alerts and reports). To install to MS servers you simply install the agent, using a pre-created agent key from the OSSEC server, connect, and that's it, the agent runs as a service so will be active from reboots and it's all good. There's even a nice web interface you can install to the server from which you can check logs etc using a GUI.

The OSSEC website is here - http://www.ossec.net/ And, as usual, if you would like any help or advice regarding this, or would like MEBBiNET to install OSSEC for you, configure your server farm or W.H.Y please feel free to get in touch.

DMR, 1941-2011. The inventor of modern computing logs out

2011-10-26T11:59:00.001+01:00

Overshadowed by the high profile departure of Steve Jobs into an iCloud this month was the equally notable death of Dennis Ritchie, a name the vast majority will not be familiar with however without him the world of IT and computing would be a very different place.

Along with his work partner, Ken Thompson, Dennis Ritchie was responsible for inventing and developing the greatest computer operating system of all time, UNIX.

The impact of UNIX cannot be underestimated for it underpins every aspect of modern computing. The infrastructure of the internet runs predominately on variants of UNIX (Linux) and Apples very own OSX is actually a branch of UNIX under the skin (Darwin UNIX).

As if creating UNIX wasn't enough Ritchie was best known for the creation of C, the most widely used programming language in the history of computing. Impressed? You should be.

I love computing history, not only is it fascinating to see where our modern day systems evolved from, it also provides a great opportunity to post fabulous retro photographs like this..

Dennis Ritchie and Ken Thompson plus PDP-11 system - Circa 1972
Picture courtesy of - http://cm.bell-labs.com/who/dmr/picture.html

Happy Mac - The Legacy of Steve Jobs

2011-10-06T12:23:00.001+01:00

The flip side of losing Steve Jobs is the legacy, vision, and of course the products and iLifestyle he's given us. I remember the beige years without Steve when Apple computers were perceptually sub-standard, even though OS9 was still a far superior and more advanced operating system than anything Microsoft could produce. And today, after the iMac, the iPod, the iPhone, and the visionary successful iPad, look where we are, it's an iWorld, and I would say a much better, happier, and more enjoyable place for being so.

I previously blogged about the original iMac and as I said at the time I still rate it, without exception, as my all time favourite computer, for many reasons. Technicalities aside, its visionary design quite literally rebooted computing for us all and its ubiquitous impact cannot be underestimated.

So, where, and what now? Can Tim Cook steer Apple into the future with matched product vision and drive? Well, Jobs was one of those special people in time who are few and far between, and as such in all honesty cannot be replaced, however I for one have faith in Cook as CEO and firmly believe that the Apple platforms we run our media from, and the products they produce, which we love and enjoy daily, will still evolve and develop to further enhance our iLives. And even if things do change, the blueprint for the future of Apple was always there from the word go, for, as Steve said - "Think Different".

Force Quit

2011-10-06T09:40:00.002+01:00

Steve Jobs - 1955-2011

Rolling with Arch Linux - No Upgrade Required

2011-09-25T11:31:00.010+01:00

I've been a staunch Ubuntu guy (more recently Debian) for years, I provide free hosting from a Debian based server and produced my Linux Integration Workshop based on the Ubuntu Desktop release, however client needs have recently pushed me to look elsewhere for my server platform.

It's basically down to online merchant security. I have a client running Ubuntu 10.04LTS in a Linode, who needs installed packages (i.e Apache, PHP etc) to be the most recent version releases in order to comply with the latest PCI-DSS scan requirements. Ubuntu 10.04, although an LTS (5 year long term service release) doesn't deliver up to date package versions from its repos, which is somewhat annoying and requires back porting from the more recent distro repos to patch (I'm not a fan of manual installs in this instance), a workaround yes but not the cleanest, and, still a 'workaround'. What I needed was a rolling distro offering the most up to date versions of all packages at every upgrade, a bit like the Mint LMDE, but server based, i.e a distribution you only ever have to install once, and once only.

After voicing my requirements I was put onto Arch Linux by a colleague in the NTI Leeds co-working space, and, after only two days of R&D I honestly can't see me ever using anything else for my base server builds, it's the business.

Light and clean Arch Linux offers i686/x86_64 network or combined installation options with a staged install process. Admittedly it's not the most user friendly installation routine and for the uninitiated may appear quite daunting after the guided hand holding of Ubuntu, however if you know your onions and apply mild diligence it's actually quite straightforward, especially of you're only laying down a CLI based server instance.

System management is via the pacman utility with 'repos' holding thousands of quality packages from core, extra and community sources. The Arch Wiki is outstanding and I've been pleasantly surprised at what's on offer, and how easy they all are to install at every stage (the ufw was one such example). Particularly nice is the BSD style DAEMON loader which offers simple 'run at boot' config by simply adding a launch DAEMON to the /etc/rc.conf file, super quick, super easy, and works flawlessly. After enabling a few mods I had a secure LAMP up and running in no time and with a symlink across to user public_html and an accompanying chmod o+x on both was serving up php pages quite happily.

As stated before, and worth reiterating, Arch Linux IS NOT Ubuntu, it IS NOT Debian, and as such does require mild tweaking to get things running slick and happy, however there's nothing deep required in doing so and in most cases it only involves manual creation of a few web folders, some permissions work and some config file adjustment from defaults, all of which, as server users, should be areas you're on top of as a matter of course anyway.

Arch Linux is available as an option from Linode, and although not a standard offering from Amazon EC2 can be launched quite happily. In fact should you wish to dabble I have an 8GB US East public instance configured for general use, just do a search for AMI number ami-978548fe (As it's only an 8GB image new users qualify for the 1 year AWS free tier if launched as a Micro). Initial login is via root using your selected .pem and you're strongly advised to create a new system account, immediately disable ssh root login and re-configure hostname + hosts accordingly.

I would also like to point you at the excellent LifeHacker Arch Linux intro which lists everything you need to get going. For LAMP and more server related How-To's, again, the excellent Arch Linux Wiki is the place.

If you would like help setting up your Linux server, of maybe fancy some free hosting? Feel free to get in touch anytime - http://mebbi.net.

Wunderlist - The wonderful ToDo for you for FREE

2011-08-24T13:50:00.002+01:00

I've always used To-Do lists in one for or other and have been through a broad range of offerings over the years, never really settling on one in particular for sustained use, until I stumbled across 'Wunderlist'. It was so small and simple I never thought it would hang around past the statutory 'install and evaluate' 15 minutes most new software usually gets (if that) however it's still in my dock, and still in daily use almost a year after download.

Developed in Germany by Berlin based startup 6WunderKinder, Wunderlist has been nominated as web app of the year, and rightly so I say for it's a joy to use. It works seamlessly, it's completely cross platform, and, it's FREE. What's not to like?

As intuitive apps go I don't think there's much to beat it. List and contained task creation couldn't be more straightforward and with combined scheduling plus related cloud sync to the online version and/or all your devices you can empty your head, pull back contents, and get reminders from anywhere at anytime.

The icing on the cake for me is the amazingly simple share facility offering real time task list collaboration amongst other Wunderlist users. Click the list sharing icon, type a user email(s) and send the invitation, superb, although sharing my 'Jobs to do around the house' list with Lesley might have been a mistake as it quadrupled in a matter of minutes, damn.

Wunderlist is available via the App Store for Desktop, iPhone and iPad, or for those of you with 'other types' of computer (or Android devices) download from HERE.

The IIS7 FTP Publishing Service 7.5 on AWS EC2 Instances

2011-08-22T12:44:00.005+01:00

In a previous post I advised on how to configure a 3rd party FTP Server under Windows Server 2003 for an Amazon AWS EC2 instance and the tricks required to open up the data ports for passive transfer.

In this post I'm going to describe how to install and enable the new FTP Publishing Service 7.5 under IIS7 on MS Server 2008, again this is relative to an Amazon AWS EC2 instance.

The first thing you need to do is install the service itself and under IIS7 on Srv08 this, and all other IIS related operations, are carried out using the Web Platform Installer. Download the WPI from HERE, install and once open search for, add, and install the FTP service as shown in Fig:1.

Fig:1 - Install the FTP Service through the WPI.

Once installed you'll see the new services in the IIS admin window (Fig:2).

Fig:2 - The FTP Publishing Service shown as installed into the IIS admin panel.

The next stage is to open up Firewall support for the passive data port range and/or add the external (Elastic) IP of your instance (Fig:3).

Fig:3 - The Data Channel Port Range, input as desired along with your static (Elastic) instance IP.

The next step is to actually create your FTP site as you need somewhere to upload files to. This is done from the left hand pane under the 'Sites' tree by (obviously) adding an FTP Site.

Choose the site name and path/folder, in this instance we have used default c:\inetpub\www, although for security purposes you may wish to channel uploads elsewhere than directly into your live website folder.

Fig:4 - Add FTP Site.

Fig:5 - Choose IP address binding (or leave as default) along with VHost and SSL options.

The last stage in IIS is to select authentication and users. Either use an existing account or create and select a dedicated FTP user (preferred).

Fig:6 - Authentication and Authorization.

*NOTE* - If you do create a new user you will have to grant them permissions to the upload folder you selected earlier.

Ok, all good, we have the FTP service configured in IIS however now the tricky part. Although we've specified a data port range the relevant ports on the actual firewall aren't yet open. You can easily open a single port (i.e 21) under the MS Firewall settings through Control Panel however there is no GUI option to facilitate a dynamic port range to cover the chosen data port allocation, for this we need to go back to the command line. Luckily the commands needed are quite straightforward. Simply fire up a CMD window as Admin and..

To open port 21 enter the following command..

netsh advfirewall firewall add rule name="FTP" action=allow protocol=TCP dir=in localport=21

To activate a firewall application filter for FTP (aka Stateful FTP) that will dynamically open ports for data connections enter the following command..

netsh advfirewall set global StatefulFtp enable

Manually restart all services.

The final stage is to configure your AWS Security Group (Firewall) and as well as the regular webserver ports (i.e HTTP/80, HTTPS/443, RDP/3389, FTP/20-21) you'll need to open up a range for the data port allocation you configured in IIS, for example if you set 40000-41000 then you'll need an AWS Security Group TCP port range entry to match.

And that's it, or should be, feel free to get in touch if you have any problems, I'm always happy to help.

Original iMacs - The Colour of Cool

2011-08-22T10:01:00.003+01:00

With the return of exiled Steve Jobs (to his own company) the "bubble" iMac, designed by Jonathan Ive, was launched in 1998 to huge critical acclaim.

Apple declared that "The back of our computer looks better than the front of anyone else's" which in a world of faceless beige square boxes couldn't have been more true.

Dated as the original iMac is today, and although I don't own one anymore, it's still my all time favourite Apple computer.

I have an old Mac Classic I use as a bookend in the office so perhaps I should get a complimentary iMac for the other side? And if so what colour?

The 'Flower Power' and 'Blue Dalmation' iMacs, admittedly not to everyones taste but you have to admit, they were certainly fun. I almost bought a Flower Power.

This is the 'Graphite', the model I actually owned. Aside from it being the most powerful iMac of it's time as a techie I loved the less translucent casing which allowed to you see the insides clearly. Unfortunately someone else also liked the Graphite, mine in particular as I was burgled and it got stolen. Dark times ensued and I had to use a PC for a while until the insurance paid up and I could replace it. I've since made up for it though and have literally lost count of the number of Macs I've owned. My record was eight at once, although I never did get that Cube.

I'd better rectify that, and what better bookend to match the Classic. Ok then, I'd better go, eBay awaits.

ISPConfig3 - Two NS records for a single IP on AWS EC2

2011-08-22T08:16:00.006+01:00

One of my servers runs ISPConfig 3 for entry level client web hosting, which is fine for in-house and personal use. It offers a professional front end with the installation routine to get there superbly presented on HowToForge and covering all variants of Debian, Ubuntu, CentOS, Fedora and OpenSuSE.

Aside from problems with SSL certificate installations (...I'll never get that time back) there are a couple of other configurational nuances which are good to know about, and one of the main and most important (for any hosting platform) is the set up of NS servers/records, specifically in relation to Amazon EC2 for stand alone instances where a single Elastic (Static) IP (EIP) is used. It's best practice to run two name servers, and on a commercially active hosting platform you must, however in certain scenarios where self hosting and/or smaller operational requirements are the case it's viable to run x2 on the same IP, and here's how, it's actually quite simple and as ever is all about the 'A' records.

Basically you configure your DNS Zone (via the wizard) as normal, inputting the domain name, contact email and specifying x2 NS records, however once done, in order to resolve to your server IP, you need to add x2 extra A records for the corresponding NS entries. Checkout the example below and you'll see what I mean with A records for ns1 and ns1 created to point at the AWS Elastic IP for this particular EC2 instance.

With the Zone in place you can then proceed to set up your (web) sites, ftp (users) plus email domain and accounts. Once done drop into your domain reg (I use 123-Reg) and point your TLD DNS at the x2 NS servers you have created, specify the EIP as the same for both and wait for resolution to do its thing.

Base documentation for ISPC covering the API, DNS basics, sites, email and users is available HERE.

Postbox 2 - Purrfect eMail to make your Lion happy

2011-08-08T18:16:00.002+01:00

I've never really taken to the OSX mail.app and to be honest haven't even opened the new version after upgrading to Lion, I know I should but I've read no glowing reviews and to be fair have plenty of other much more interesting things to do. Interesting to me of course, I am aware Linux VHost development might not be for everyone.

I use (and swear by) Google Apps for Business and have for some time used the wonderful Mozilla Thunderbird client to connect (see previous post). Built on Mozilla technology (the same people who bring you Firefox) Thunderbird is rock solid and delivers comprehensively as an integrated comms client where MS Outlook glaringly fails (i.e by accommodating Google contacts and calendar), however what with the softer, slicker (nicer) look of Lion I fancied something a bit more in keeping, so, I thought I'd give PostBox another try. I'm glad I did as the latest release (v2.5) is a joy.

Installation was quick and accommodating, it picked up Thunderbird and imported all my settings without a hitch. Once opened, I hate to say it, but it really makes Thunderbird look dated and you instantly feel the extra development across layout and formatting, design areas Thunderbird always seem to be on the periphery of. Even with an OSX matched 'Aqua' skin, which helped, it never really felt 100%. Thunderbird also did strange things with fonts in email replies, something I never did get to the bottom of. Admittedly PostBox does still require an add-on installing for Google calendar (two actually), however picks up Google contacts straight off the bat, which makes the install much cleaner.

Operationally it offers default HTML composition, a great font and an elegantly spacious three pane window (Or four, if you pop the 'Today' calendar bar). Threaded message views work seamlessly and conversations are equally as smooth. It all works brilliantly and is perfect for Lion.

Postbox is a paid for app, however it won't break the bank and at £13.99 (through the App Store) sits nicely in the realm of 'sensibly affordable' applications, the type I like and the type I recommend. Check out the website - http://www.postbox-inc.com/ and follow the App Store links for a free 30 day trial.

I don't stick with anything if there's a better option and completely deleted Thunderbird after using Postbox for only 10 minutes, if that.

VMWare vSphere Hypervisor - Part 3 : The iPad client

2011-08-01T16:54:00.002+01:00

When the iPad was unveiled I, like many, was mildly curious as to where it would slot in. Obviously I was aware Apple, being Apple, wouldn't bring out such a revolutionary new product without being confident it was going to be a success and I should have had more faith having being similarly bemused when first seeing the 1st gen iPod. Even so as a predominantly back-end server and systems guy I never considered all that swiping and gesturing would appeal to me, wrong again, for here I am promoting an iPad client utility for managing vSphere, and quite nice it is too, let's take a look.

Looks slick yes? Well, it is, however nice as it looks to get things up and running it's not as easy as merely clicking 'install' from the App Store, unfortunately there's a bit of work to do first and you'll need a vCenter Mobile Access Server installing in your vSphere environment.

The vCMA is basically a virtual appliance which acts as the management bridge (proxy) between your vSphere ESXi instances and the iPad client, and like the iPad client it's also free to download. Install by downloading the relevant OVF & VMDK files from HERE and following the simple 8-point install.

VMWare vSphere Hypervisor - Part 2 : Tools and Snapshots

2011-07-14T16:32:00.002+01:00

In Part 1 of this series we looked at the VMWare vSphere Hypervisor product, the reasons for use plus installation and server VM image creation, in Part 2 I'm going to run through VMWare Tools for both platforms with accompanying machine instance snapshot and restore.

To provide maximum control of server VM's inside the ESXi environment you need to install the VMWare Tools for each instance. Doing so enables extra functionality such as dynamic vDisk resizing and controlled shutdown/restart.

VMWare Tools for Microsoft Servers

Open the vSphere client and connect to the ESXi hypervisor.
Right click the relevant MS Server instance from the left hand panel.
Select 'Guest / Install VMWare Tools'.
The CD image will mount inside the Server VM.
Access the image and install.

VMWare Tools for Linux Ubuntu Servers

Open the vSphere client and connect to the ESXi hypervisor.
Right click the relevant Ubuntu Linux server instance from the left hand panel.
Select 'Guest / Install VMWare Tools'.
Access the server instance CLI via the vSphere console (or SSH/terminal).
Log in and promote to su.
Install the prerequisite build tools and kernel headers.

apt-get install build-essential linux-headers-generic

Mount the CD and access the VMWare tools image.

mount /cdrom

cd /cdrom

Copy the tools image to a temp directory (Replace with the given tools version name).

cp /cdrom/VmwareTools-x.x.x-xxxxx.tar.gz /tmp

Go to tmp.

cd /tmp

Extract the installation files.

tar -zxf VmwareTools-x.x.x-xxxxx.tar.gz

Change to the install directory.

cd vmware-tools-distrib

Start the installer.

./vmware-install.pl

Accept all defaults and once installed restart the server instance.

shutdown -r now

With VMWare Tools installed to either your Linux or Microsoft servers you can now safely and cleanly shutdown and restart directly from the vSphere Client.

VM Snapshots

One of the most beautiful things about server virtualisation has to be the snapshot facility, i.e being able to take an instant image of a running server, archive it, and restore if needed just as quickly. Something that just wasn't possible in the 'old days'of 'real' servers. Taking instance snapshots in ESXi couldn't be easier.

Open the vSphere Client
Connect to the ESXi hypervisor
Right click over the server instance (or highlight and use the menu bar snapshot icon).
Take Snapshot and name/save accordingly.

Once done you can view, edit and organise your snapshots in the Snapshot Manager. To revert to a previous image simply choose and click 'Go To'.

Server Logs

Another cool tool in vSphere Client provides the ability to access and view server logs from inside the management console. Very nice, no more trawling around the CLI, simply drop down the View menu and go to Administration / System Logs to see what's been going on behind the scenes.

In Part 3 we'll look at alternative methods of access and administration.

VMWare vSphere Hypervisor - Part 1 : Installation and Use

2011-07-13T11:36:00.005+01:00

Cloud migration makes sense on many levels however there may be certain server operations your business prefers to keep local for whatever reason, and for multi-box resource intelligence a virtualisation solution delivering consolidated server IaaS (Infrastructure as a Service) is the way to go. Gone are the days of a single server per function sat sucking up power at 2% of load 24/7/365. Thankfully technology has evolved and today we can operate our systems across substantially more efficient and manageable platforms.

VMWare are kings of virtualisation and offer a comprehensive range of products to accommodate all needs, from basic desktop offerings enabling Microsoft functionality for Macs (VMWare Fusion) all the way up to multi-thousand node SAN based installations for cloud IaaS. In this short series of posts were going to be looking at entry level IaaS for localised server consolidation using VMWares free solution, the vSphere Hypervisor.

The latest vSphere Hypervisor consists of two products, the ESXi 4.1 platform, and the vSphere management client.

ESXi 4.1 is a cut down version of VMWare ESX designed to run on 64 bit hardware, it offers a smaller footprint, single device installation (as oppose to SAN) and has no console or web service management. VM limits and combined thresholds are more than adequate for small to medium enterprise use offering up to 320 virtual machines per host. ESXi is managed by the (presently PC only) vSphere Client.

ESXi Installation

For those wishing to evaluate ESXi prior to real world installation the latest version is recognised and runs quite happily inside the VMWare Fusion desktop client, simply register at the VMWare site, download the .ISO, select accordingly as shown below and run through the installation.

Fig:1 - ESXi Server 4.1 VMWare Fusion installation

Once installed you will need a second Windows based Fusion VM to run the vSphere client. Install the OS, download the vsSphere client, install it, and connect to the ESXi using the IP address as supplied.

Fig 2: EXSi Hypervisor VMWare Fusion instance installed and running showing the connection IP.

VM Installation

It's up to you where you store your installation images and how you install, i.e from disk or image file. I like to keep mine in the main ESXi data store where they can be re-accessed quickly and easily, here's how to upload :

Highlight the ESXi IP from the left hand management pane of the vSphere Client window.
Select the configuration tab.
Right click the related datastore in use and 'Browse Datastore'
Create folders and upload .ISO files into them as required.

Fig 3: The ESXi Datastore Browser accessed through the vSphere Client.

When creating a new VM ensure the relevant boot (ISO) image is both attached and set to connect at power on. Once done simply boot the instance and install accordingly. Connection once installed is either via the internal vSphere console or via RDP (for Windows), or SSH (Linux).

Fig 4: VM Properties window highlighting Datastore ISO connection.

In the next post we'll examine operational tools and monitoring plus image backup and restore.

Server platforms need the X-Factor

2011-07-07T10:22:00.005+01:00

In this age of rapidly evolving web applications, social networking and internet mobility it's easy to forget (or for some perhaps not even realise) that all this "stuff" has to run on something, the "something" being a server or server platform (or even a "web-farm" if you prefer the more contemporary term). As buildings and builders are to people and society as are servers and infrastructure developers to web content.

I don't doubt the majority of people will have heard of the internet, equally as many of Microsoft, but what of Linux?

Linux is the predominant server operating system around the internet with Linux based platforms presently delivering around 80% of all web content, that's some market share, especially for what is in essence a community developed and totally free operating system. Microsoft doesn't get a look in as contrary to what you might be led to believe it's just too high maintenance and isn't stable enough for sustained efficiency. There is no doubt that Microsoft do "business" very well, the MS Outlook/MS Office/MS Exchange/Active Directory combo is king of the enterprise hill (although I would personally recommend the forward thinking cloud wonderfulness of Google Apps myself) however for real computing, where security and reliability are crucial, it has to be Linux.

Linux is actually a fork of UNIX with underlying concepts and modular construction the same as they were when UNIX was first developed by AT&T way back in 1969. You think the latest cutting edge technology is actually "cutting edge? Not so, even OSX, Apples flagship operating system, runs a version of UNIX under the skin (Darwin), which is why it's so stable and resilient to viruses.

UNIX commands. Linux serves.

Mobile Websites - That's Handi

2011-06-27T17:49:00.007+01:00

The mobile internet has exploded and today everyman and his dog has an iPhone or Android, devices used with increasing predominance as main access portals into our connected lives and pushing a whole new genre of mobile websites and mobile website design services.

When we say mobile we don't just mean accessible from anywhere, that's a given as all websites already are (providing there's relevant connectivity). Mobile in the context of handhelds means the site is specifically designed around touch tap technology for limited screen real estate. Desktop websites are meant for desktops and even with auto area selection are still annoyingly difficult to navigate when pinched, scrolled and sectionally zoomed.

Apps are already designed in mobile format to smoothly deliver information accordingly, and although the vast majority are free (or almost free) unlike a mobile optimised website require download and local installation plus post development and store acceptance. A website, mobile or otherwise, is just a website and as such is not only free from all App Store constraints but is available to everyone with updates instantly visible. No App Store acceptance, no subscriptions, no downloads and no installations, just a website, free from content restrictions, globally accessible and centrally managed from a single location.

HandiSites are the established mobile arm of MEBBiNET providing mobile website development and mobile website design across all areas including mobile eCommerce (HandiRetail). Prices start at only £299 for a basic HandiSite with a potential one week turnaround from initial contact to go-live.

How much would you pay to globally mobilise your website? Click the HandiPhone to find out more.

FTP access for Windows instances on AWS EC2

2011-06-17T16:33:00.008+01:00

The Amazon AWS platform is firewalled using their superbly simple 'Security Group' method and as such is inherently secure from default, an obvious advantage however it can catch you out if you're not on top of the technology.

One of the more common stumbling blocks, and an obvious show stopper for any web server, is that of FTP access for Microsoft based instances (Server 2003 and/or Server 2008). Across regular VPS offerings it's a simple procedure to install a 3rd party FTP server (i.e FileZilla or perhaps Cerberus) and configure secure access for uploading website files and data, however there are forums full of queries from tired sysadmins sat scratching their heads wondering why they're apparently connected but can't get a folder listing from their EC2 instance. In this post I'll show you how to get things hooked up.

There are two types of FTP, well, three, but we're not going to discuss SFTP in this example. At base level you have Passive and Active connections, both are listed as using port 21, known as the 'Command' port (Active mode also uses Port 20), however both connections also utilise a random privileged port above 1023 tagged for 'Data Connection'. If all port ranges aren't catered for in the AWS security group you won't get a connection and this is why there is no pre-set 'FTP' security group entry listed. Settings are flexible and for security reasons it's expected you'll configure your own specifics.

In our example below using the Cerberus FTP server we've chosen 11000 to 12000, which is quite a broad range. Anything over 1025 would suffice (for example 1025-1125 would be adequate).

Next, you need to match the chosen port allocation in your AWS security group. Below is an example range for a base web server configured for FTP (Passive) using the specified port range(s). Note RDP (Port 3389 - Remote Desktop) and HTTP (Port 80 - Web access). You can (and should) lockdown IP's to your FTP upload sources.

And you would think that was it? Well not quite, depending on how you have your Windows firewall configured. Obviously you'll need to match the opened ports there too. Microsoft Server 2008 won't allow you to specify a range of ports via the GUI, it's just Windows being its typically annoying self, but there is a workaround via the CLI (Otherwise known as the DOS prompt for those of us at a certain age).

Here's the command line string to open the port range as specified in this example, be sure to make note of the upper/lowercase syntax + spaces/no spaces where applicable -

FOR /L %IN (11000,1,12000) DO netsh firewall add portopening TCP %I "Passive FTP"%I

If you have a large range of ports it will take some time to run through them as it opens them all one by one. When it's finished you should be good to go.

MEBBiNET develop and support dynamic EC2 server platforms across both Microsoft and Linux. If you would like to find out more about the great range of services on offer from AWS why not give us a call.

Ubuntu Server - The simple four stage security lockdown

2011-06-10T14:33:00.004+01:00

Server security can make or break a web business and todays hackers aren't getting any less intrusive, nor is the data we publish on line geting any less sensitive, in fact quite the opposite. There is no such thing as a totally secure computer system, no matter what anyone may tell you, however at base level there is a simple four-stage configuration you can implement which will substantially increase your chances of protection from the vast majority of attacks.

The following four point system is applicable to the Linux (Ubuntu) server platform.

1. Disable ssh access for the root account.

This is a no brainer. I have the superb OSSEC HIDS installed on my main web boxes which logs, blocks and informs me of any and all activity relating to system changes and attempted intrusions, the majority of which are attempted ssh brute force attacks to, yes, the root account. Disabling ssh root access is quick and easy. Simply edit as follows and change the option for PermitRootLogin to No. Save and close.

$ sudo nano /etc/ssh/sshd_config

2. Block the IP addresses of ssh attacks.

This is easily achieved with denyhosts. Install as follows (config is automatic)

$ sudo aptitude -y install denyhosts

…..and to view blocked IP's

$ sudo less /etc/hosts.deny

3. Install, configure and enable the Linux Ubuntu IP Tables (Firewall).

Simply done by using the wonderful Uncomplicated Firewall utility (ufw). Once enabled the ufw, by default, blocks all incoming ports. Installation and config for basic ssh & http access is as follows.

$ sudo aptitude -y install ufw

$ sudo ufw allow ssh

$ sudo ufw allow http

$ sudo ufw enable

4. Don't enable, use or configure FTP (Port 21).

FTP is quite long in the tooth these days and a predominant attack point for intrusion attempts. Secure FTP (SFTP) is inherently more secure and also much easier to install and configure as it comes ready to roll as a component of ssh. With ssh installed simply connect using SFTP on port 22 using a dedicated admin account.

And, finally, implement and use a secure password policy. Something so obvious I'm reluctant to even list as an entry, but if you really do need help I suggest you read the following advisory from Symantec -

http://www.symantec.com/connect/articles/simplest-security-guide-better-password-practices

Of course this is server security at its most basic, even so you would be surprised how many people will power up a server with default settings, install their website and immediately publish to the internet. Just by following these four basic procedures you will be inherently more secure.

As mentioned I would also highly recommend the superb OSSEC HIDS system. OSSEC is free, open source and offers out of the box protection and alerting through a powerful correlation and analysis engine, integrating log analysis, file integrity checking, centralised policy enforcement, rootkit detection, real-time alerting and active response.

If you have security concerns about your virtual or local Linux server platform by all means get in touch. Here at MEBBiNET we have a proven history of Linux security patching and would be more than happy to help you 'tighten up'.

Mini Me - The Dell 9" Home Server

2011-06-09T16:39:00.006+01:00

So, you fancy a home server for bits and bobs of development, but don't want to buy another bulky computer, and especially not something expensive and server class. Aside from a need to house it in the garage due to fan noise, server units aren't renowned for their energy efficiency and that RAID array, although fault tolerant, will suck up more power than you realise. Unlike work it's you who pays the bills 'at home'.

How about something you could fit in a shoe box, something which will run completely silently, at an energy efficient 5w, comes with its own built-in screen and keyboard plus SSD hard disk and combined UPS (Battery), and all for just over £100? Am I deluded? Not at all, I run a Dell Mini 9 Netbook. Totally useless as a computer but absolutely brillant as a home server.

Bought from eBay for a mere £113 (inc delivery) my 'server' is spec'd with a 16GB SSD, 2GB of DDR memory and a surprisingly competent Intel Atom 1.6GHZ CPU. It runs Ubuntu Server 10.04LTS and I tell you, it flies. It'll boot to the CLI in 20 seconds and serves MEBBiNET around the internet quite happily. I'd initially just hosted the website on there for testing purposes but it's so reliable, easy (and fun) I've had it sat there for months now and honestly can't see any reason to move it

In Terabyte world 16GB of disk space doesn't sound like much, but I never bought it for storage, I've a 500GB Buffalo Linkstation Mini for that, and as it goes for hosting websites 16GB is actually a huge vat of space.

The Mini 9 only offers 100base ethernet but that's fine for serving up my small six page flat HTML site, I only have a 10MB cable connection anyway and any streaming round the home LAN comes from the NAS which delivers a Gig of bandwidth. I also offloaded the blog back to Blogger (which has really come on in recent years) so there's no real overhead at all and it loads up as snappily as any other website.

As a systems guy I obviously enjoy home hosting and if you too fancy a go this is such a great way of doing so. A few years ago I had another Mini 9 which I took to Berlin to use for LAMP development (yes, I have history with these things). The Wi-Fi in the apartment was somewhat flaky so I rigged it up through a little Netgear x4 Port Switch to an AirPort Express and configured it as a localised DNS Cache box, it worked superbly and sat there all summer.

Check out my home (Front Room) 'Server Room' - Dell Mini 9, Virgin Cable Modem, Buffalo Linkstation Mini NAS and Cisco Linksys E2000 Router. All housed (rather tastefully, I must say) in period style with accompanying storage (i.e a drawer) for spare Cat5 cables or W.H.Y.

For anyone who's interested the cabinet cost me £45 from the local second hand furniture salesroom in Saltaire, personally I think it's the best part of the whole setup. Note rear 'ventilation', I did feel a bit harsh removing its rear panel but I was very careful and it can always be replaced if the IT room ever needs to be de-commissioned (Although as you can see there's still plenty of room for expansion, heck I could fit another ten servers in there and it would still only be half full).

Microsoft Web Farm Framework using AWS EC2

2011-05-30T13:28:00.017+01:00

As can be the case with some products there can be a degree of tweaking required outside the advised setup to get them functioning, and the recent addition to IIS, the 'Web Farm Framework' (WFF), is no exception.

WFF is great in concept and there's no doubting it's usefulness for distributed web application and site replication across a multi-server platform. In this post I'm going to show you how to set up a basic two server WFF using EC2 instances across the Amazon AWS platform.

The first stage is to configure your AWS security group (Firewall) at the Amazon side in order for things to function smoothly during install. The following config is needed (don't worry, you can tie it down later) and I'll explain selective port allocation as we run through the installation.
In this example all source IP's are open however you can (and really should) tie things down to your own schema where possible (i.e for RDP etc).

You'll need a suitable Server 2008 AMI (Amazon Machine Image). For my WFF I used Amazon instance number ami-c3e40daa which is an i386 Server 2008 SP2 Data Center Edition base build. Onto this I added IIS, .NET4, all associated default dependancies + the most recent Microsoft updates, I've also (controversially) installed Microsoft Security Essentials. Yes, I know it's not officially recommended for a server environment but I'm not running a domain and it actually provides decent protection.

Ok, down to business.

For a two server setup we actually need three servers, one as the controller and the other two as primary and secondary instances. Fire up three AMI(s), selecting preferred region + zone, choose (or create) your key pair and select the security group you configured earlier. Should you wish to have all instances in the same zone you can start any number at once, however as this is a cloud platform resilience is recommended and multi-zoned instances are strongly advised. Due to the nature of Amazons DNS and IP allocation, and for obvious reasons, you'll also need to associate elastic (static) IP's to each server. This is quickly and easily achieved through the AWS console.

Carry out the following procedures on all three instances

Obtain the EC2 Admin passwords for each server (Right click over the instance in the AWS console and select 'Get Windows Password'). Generation can take up to 15 minutes but once you have it connect via RDP (Port 3389) to configure the build. Install base necessities as advised and update.
Set yourself up a WFF Admin account (with, of course, Admin rights) and disable (de-check) User Account Control (UAC) - This is VERY IMPORTANT. WFF will throw a permissions error and won't connect to the chosen account unless you do, it took me a full day to discover this.

Next, Windows Firewall (Control Panel > Windows Firewall > Allow a Program Though the Windows Firewall). Here you'll need to check Core Networking, File Sharing + Remote Administration. These entries correspond to the opened ports on the AWS security group but you will also need to add specific ports for the WFF itself (8173 & 8675), do so as single separate entries via the 'Add Port' tab.

The best, and most reliable way to install the WFF is by using the Web Platform Installer (WPI), this installs all dependancies and should have installed as part of IIS, if not download/install from here - http://www.iis.net/download/webfarmframework - Install, re-boot, and logon as the WFF Admin user you created earlier. *NOTE* - You only need to install the WFF on the Controller.
On the controller instance open IIS Manager and right click 'Server Farms', create/name your farm, check both the load balancer + the provisioning boxes and input the WFF admin account you created earlier, click next.

Make sure the 'Load Balancing' checkbox is ticked and add the elastic IP of the primary server. If all your security group settings are good it should drop in nicely with no errors.

Next add the elastic IP address of the secondary server and 'Finish'.

Back at the main IIS advisory screen under the server farm activity window you'll see the agents being installed to the primary and secondary boxes, it only takes a minute and once done you'll see load balancing status for both boxes change to 'Yes'. Try adding an application or website config to wwwroot and you'll see the changes being replicated. And that's it, WFF is installed and working.

Supplemental :

From the Amazon side you can (and probably will) install your boxes behind a load balancer, there's no requirement to tie this in with the WFF balancer as the AWS balancer can be configured with its own range of comprehensive up/down schematics to route traffic accordingly, irrespective of what the WFF is up to.
Once installed you can remove the AWS security group entry for 49152-65535. This was only used by WFF for dynamic RPC during the initial setup to remotely install the agent.
*VERY IMPORTANT* - Once up and running you MUST tie down the security group ports between servers for respective IPs on at least ports 135-139 and 445. The last thing you want is an internet facing open SMB port.

Autosnappy for EC2 Snapshots - The No Brainer

2011-05-20T14:59:00.003+01:00

The bulk of our recent development has delivered various virtual server platforms across Amazons superb EC2, which, on the back of last months outage has prompted an extra level of awareness for built in resilience.

Multi-zoned load balancing for web boxes is easily catered for using standard AWS tools, but what of SQL? Especially for a client budget restricted to the non-replicative self-contained simplicity of MS SQL Express (It's free for a reason).

Obviously your default SQL backups should be pre-configured as a matter of course (to S3), but as extra cover for potential outages, and to feed into your SLA, it's useful to have procedure(s) in place to get things back up and running should the worst happen. AWS provide a range of options covering AMI (Machine instance) replication and/or EBS volume snapshotting, both of which should be part of any cloud scenario, however as yet it offers no simple service for automation. The solution? How about an EBS Volume for SQL data attached to your main SQL Server and configured for hourly (?) snapshots using AutoSnappy.

AutoSnappy is a CRON based online subscription model which enables you to configure an extensive and comprehensively resilient volume snapshotting schedule from intervals of 1 minute upwards to day, hour, week and month. Pruning and monitoring are set using the same format with retention chosen as you see fit (For example you may wish to keep the last 20 newest shapshots). It's a great service, powerful in its simplicity whilst concurrently invaluable for the cover it provides.

So, the bottom line - cost. What price for such cloud resilience? How much would you pay to sleep at night knowing you could restore your virtual database platform in minutes rather than days (Or months?).

AutoSnappy is a ludicrously meagre $3 per month, which you have to agree, is most definitely a no brainer to end all no brainers. Sign up here - https://www.autosnappy.com/

Thunderbird and Google Apps - Mail/Contacts/Calendar.

2011-04-27T19:26:00.015+01:00

Google Apps for business is great and MS Outlook is the most widely used communications portal in business, two statements of fact which need a third to highlight a problem and the reason for this post - They don't interface correctly.

Although Google Apps provides comprehensive Exchange configuration with seamless mail, contacts and calendar it's only good for the iPhone, desktop mail is relegated to IMAP with calendar and contact sync flaky at best (if at all) and certainly not accommodated comprehensively by Outlook (2011). Not much help to the organised amongst us who like everything in one place, I mean come on, it's 2011, communication platforms should communicate with each other.

I've read forum entry after forum entry from distressed Outlookers struggling in vain to find a smooth solution for one-stop sync-up of the three (mail, contacts & calendar) but as yet there appears to be no movement from either side to help facilitate it, however there is an answer, don't bother.

When I say don't bother I really mean don't bother with Outlook, or even OSX (Mac) Mail (& Address book) for that matter, life is too short and why bother with something that's never going to work properly when there's a perfectly elegant solution available that will - Enter Mozilla Thunderbird and it's wonderful addons.

As partner to the now ubiquitous Firefox Mozilla Thunderbird has been with us for a while and is now at version 3.1, it's tried, tested, stable, nice to use and with easy installation of a few addons happily delivers Google Apps to your desktop as an integrated bundle. Here's how.

Make sure your Google Apps eMail address is enabled for IMAP. This is a check box under eMail settings through the online interface.

Download and install Thunderbird. Configuring eMail is literally as easy as typing in your Google Apps eMail address and password, it finds your account and sets up all the SSL for you.

Next, download the following Thunderbird Add-Ons. Install via /Tools/Addons from the Thunderbird top drop-down menu.

http://www.mozilla.org/projects/calendar/lightning/
https://addons.mozilla.org/af/thunderbird/addon/provider-for-google-calendar/
https://addons.mozilla.org/en-us/thunderbird/addon/google-contacts/
https://addons.mozilla.org/en-US/thunderbird/language-tools/

Once installed the only one you really need to set up is the calendar, you'll see Google Contacts already populated under the address book tab of Thunderbird. Here's how to configure the calendar add-on.

Obtain the XML string of the specific Google Apps calendar you wish to use. Do so through calendar settings under the Google Apps online interface. When you click the XML address button you'll be given a link which looks something like the following.

http://www.google.com/calendar/feeds/yourname%40domain.com/public/basic

In Thunderbird open the Calendar tab and right-click the left hand pane to add a new instance, choose 'New Calendar/On the Network', select 'Google Calendar' and input the XML link in the location box at the bottom.

Next input your Google Apps eMail address and password, name your calendar and choose a colour.
Finish up and your Google Apps calendar will spring into life.
Delete the default calendar.

And there you have it, all done. Thunderbird mail is an excellent alternative to MS Outlook and with versions for Mac, PC and Linux it's completely cross platform, it's also totally free of charge and as shown here when configured with a couple of add-ons becomes not only a complete communications suite but quite amazingly the only one which can actually do the job.

Open Source wins again - #microsoftfail #applefail #outlookfail

Download Thunderbird HERE.

Hosting in style with OpenPanel

2011-04-14T19:16:00.005+01:00

Moving up from simple vhosting the next stage has to be an ISP style platform functioning as it's own DNS offering full on multi-domain functionality with combined eMail and W.H.Y, all quite achievable via CLI fun and games but it is 2011, time is short and rewarding as it might be for the geeky amongst us we all succumb to and enjoy (expect?) a more stylish and smoother way of doing things these days. It's all Apple's fault, but in a good way and for todays task in hand we present the elegantly intuitive Apple-esque hosting platform from OpenPanel.

Openpanel are a relatively new (2010) player to the field and slot in around the likes of EHCP and ISPConfig (but without the client shell). Their slick and stylish offering is advised for installation on Debian 5 (Lenny) and is a real joy. Let's take a look at how it pans out from install to domain go-live.

I used a 10GB Amazon EC2 Debian Lenny AMI for the base, to save you time the EC2 instance number is ami-9a6b9af3.

The Openpanel installation procedure is seamless and quick, simply connect to your instance via ssh, add the relevant repos and run the apt command to fire things off, accessing the GUI through https port 4089 when finished (Instructions HERE).

Operational documentation is presented cleanly on the OpenPanel website and even for those with limited knowledge of domain platforms is easy to follow, running through quick and simple domain creation with associated web & eMail. It is useful to have a handle on the basics though and for anyone who doesn't here's a 'nutshell' breakdown of how it all works for a machine configured as a Web DNS.

NS records - These relate to the name server. The nameserver ns record covers main domain direction, i.e so 'the internet' knows which server your domain and related services are hosted on. In Openpanel we configure x2 ns records to match our domain, i.e ns.ourdoman.com. & ns1.ourdomain.com. (note the trailing . ).
A records - The a records point to IP's (i.e in this case the elastic IP of our EC2 server) and are used to both back up linked ns records and to handle web (www) + any potential sub domain direction (i.e support.ourdomain.com or mail.ourdomain.com), we need to create x2 ns a records linked to the server IP to link with the main ns records.
MX records - Created for mail, mx records also require a corresponding a record pointing to the server IP.

It's all about the a records….!

I configured a domain, added the website name (+ alias) and corresponding site FTP account, stuck an eMail address or two up and pointed the domain name hostside to the newly configured ns records. After that it was just a case of waiting for internet DNS replication to do its thing. Replication round the web is advised at around 48 hours however I've had Google Apps migrations dropping eMail in under 30 minutes and things popped up live here in an easy half a day, not bad. I FTP'd the website up, tested eMail send/rec and that was it, clean, quick and seamless. I've had things up for over a week now with no problems at all.

The OpenPanel admin GUI is one of the cleanest I've seen and aside from general domain config also provides easy options for MySQL, Firewall and User management, heck, it even let's you directly update the OS.

The OpenPanel GUI.

And there you have it, who says life has to be difficult? OpenPanel not only make ISP style multi-hosting a breeze but do it with a stylish and intuitive solution. My only gripe would be the lack of a dedicated web panel to facilitate individual client accounts but that said it's not a show stopper and I'll certainly be continuing to use it myself, it's OSX-ey design and super slick functionality I don't think can be beaten.

Oh, and did I mention it's Open Source and Free?

The Story of Linux - Commemorating 20 Years of the Linux OS

2011-04-08T16:18:00.000+01:00

Welcome to the Jungle

2011-04-06T22:27:00.000+01:00

I recently attended to a spot of cloud admin for a fast moving media delivery client. They already host data on Amazon S3 and after having dedicated VM problems decided to migrate their web front end across to a couple of MS 2008 EC2 instances. With sticky sessions scripted and running happily across two load balanced AMI’s thoughts moved toward an easier method for updating replicated copies of the inetpub.

I’d briefly considered DFS but with it being more of a domain based utility it didn’t get much further. FTP was an obvious consideration but even with just two versions to keep matched and mirrored still opened up margin for error. It needed a system which would simply sync up a chosen folder and set of files from a single location across to several remote instances, something like DropBox, but with more functionality, something like JungleDisk “Workgroup” perhaps?

Initially we weren’t sure if such a simply lateral solution could deliver, but for a mere $4 per user non-contracted monthly sign up it was certainly worth a shot and we were happily surprised to discover it not only worked perfectly and seamlessly, it also ran as a system service meaning there was no need to log on to the AMI’s to instigate the sync update, result. Backed by a choice of either S3 or Rackspace storage was also a plus, offering instant linking to the clients existing AWS account during signup, nice, connected and easy.

Being ITIL certified I obviously appreciate the reasons for change management methodology, however outside of the corporate bubble (my previous life) it’s incredibly refreshing at times like this to enjoy creative I.T flexibility with the latest web tech and to resultantly deliver a dynamically stylish and smooth solution for a client in less time than it would have previously taken just to request a departmental meeting.

Good times, next – Auto-Scaling.

NFS - A Home from Home

2011-04-05T07:00:00.002+01:00

The holy grail for enterprise clients are networked home directories, for many reasons, but most importantly they provide a centrally managed location for sys admins to take care of precious user data, you know, all those comedy email attachments and JPEGs from last years holiday in Benidorm, that important, business critical stuff we backup daily, weekly and monthly for them.

At least with an Ubuntu based client said industrious users are unable to tinker with the OS and break it, although the Linux networked home DIR, if integrating with Active Directory, can be a convoluted configuration to get on top of for *us*, and even if using Likewise Enterprise as the authentication bridge can still take a bit of application to nail down. After experimenting with CIF’s options around this area my own preferred method takes things back to basics via NFS based automount maps to a dedicated Ubuntu 10.04LTS NFS server, it’s a nice, clean option and provides a quick & robust stand-alone repository for all data. Here’s a brief overview of the setup.

Obviously a dedicated Linux (Ubuntu) NFS server is required, and by adding the nfs-kernel, nfs-common and portmap utilities & configuring related entries in the /etc/exports file to cover your desired network access is easily setup (It’s a quick admin procedure which is widely documented around the internet). Once done, and the corresponding portmap & nfs-common utils installed client side, you’ll need to configure things at the Likewise end.

At this stage familiarity with Likewise Enterprise is required with pre-configured Ubuntu client to Active Directory authentication tested and working, the rest of the config is carried out using a dedicated AD OU containing specified users (and group) across a linked Likewise Cell, a corresponding GPO to create the local (client) folder to be used as the mount point, an auto fstab entry to mount it to the NFS box, and finally, specifying home folder creation in the GPO and its location in the user (Likewise) settings entry, e.g – /<mount>/%U (The location can also be set in the GPO, either or). There are (admittedly) a few stages to keep an eye on here and it does take a bit of jiggery pokery, however after a few hours of R&D you get the picture and it all makes sense. I also like to configure the GPO with a few extra niceties such as the domain prepend at logon, it’s cleaner (and easier for the users).

I’ve seen and read umpteen forum entries containing reams of convoluted head scratching on this subject with many having limited success above anything other than losing days and weeks trying to get things sorted, however I will honestly say that apart from adding one single line of syntax to the NFS server /etc/exports file no other lengthy file mods were required for me, everything else was taken care of GUI-side using the excellent Likewise Enterprise Group Policy Object Editor. The GPOE is indeed a thing of wonder and I can’t begin to extol the virtues of saved sanity from AD incorporation.

If you’re one of the aforementioned forum head scratchers MEBBiNET would be more than happy to help and advise you with any of the above. I cover this and more in my one day Linux for Business (Workstation Integration) workshop held in Leeds. Feel free to either get in touch directly (using the links, top right) or book up for the workshop. We charge a mere £99 for the full day and we’ll even provide you with lunch.

Word Up - An Amazon EC2 LAMP for Wordpress

2011-04-04T11:42:00.000+01:00

AWS EC2 is a virtual server platform hosted in the Amazon cloud which you manage yourself. It offers builds around MS Server 2003 to 2008 as well as varying flavours of Linux and is priced intelligently on a “per use” basis. You can choose the server location and either build your own for upload or choose from one of the many pre-configured Amazon Machine Images (AMI’s).

In this post I’ll provide an overview of instances and run through a base Wordpress installation to an Ubuntu LAMP.

Procedure :

Build a quick and open Amazon EC2 Ubuntu LAMP server.
With a fixed IP.
Offering SFTP access.
Running a base installation of WordPress.

Prerequisites :

An Amazon AWS account.
A computer running Mac OSX.
The Transmit v4 FTP application.

Timeframe :

Estimated 30 minutes.

Instance Overview :

An Instance Store machine – This a dynamic build, you can modify it whilst it’s up but once terminated all changes are lost.
An EBS build – Has its full system volume held in Amazons Elastic Block Storage area, this facilitates instance stop & start plus options for re-bundling a modified system into your own custom AMI.

Using EBS you pay for backed storage use with costs presently at $0.10 per GB month (Equating to +$1 per year for a 10GB EBS volume on top of the reservation cost) with all data I/O also chargeable at $0.10 per 1 million requests to the volume. Although these add-ons do boost reserved instance costs they don’t add much to them, and for me it’s still an attractive and competitively priced solution for what is in effect a fully accessible Virtual Private Server offering not only all the related flexibility you would expect from such a device, but with the accompanying bonuses of AWS Elastic Computing – i.e Image snapshotting and re-bundling, server stop/start & reboot, plus easy security and directly scaleable paths into multi-server load balancing and auto-scaling.

Ubuntu’s EBS AMI’s are all 15GB so should you wish to take advantage Amazons free 10GB Micro-Linux tier instance number ami-c2a255ab is a 10GB Lucid build (although it’s only available in US East Zone 1).

Build :

Chose your instance type and fire it up, choosing your size option and selecting (or creating) a relevant security group & key pair. Copy the keypair (.pem) file to your local system and edit your security group to allow access for the following ports..

Port 80 – Web Server
Port 22 – For SSH/SFTP access

Port 80 requires open IP access (0.0.0.0/0) as it’s the web server, port 22 you can set as per your security preferences, although I personally like to nail it down to my own IP(s).

Once running, open Elastic IP’s from the AWS console, allocate an IP and associate it with your running instance. This is now your server IP address and will remain so after any stop/starts, it’s linked with your top level AWS account not the instance which allows you to re-assign it across another builds if required.

Next, open a local OSX terminal and connect via SSH, specifying the location of your downloaded secure keypair (.pem) file.

$ ssh -i <file_path/keypair_file.pem> ubuntu@<elastic_ip>

If you receive the warning about file permissions just chmod the .pem file to 600..

Accept the certificate entry and once connected re-set the user account password from default.

$ sudo passwd

Update the instance repository sources.

$ sudo apt-get update

And upgrade all packages.

$ sudo apt-get upgrade

To install the LAMP stack use tasksel, check LAMP Server from the list, select OK, and create a MySQL password when asked.

$ sudo tasksel

Once finished input your (Elastic) IP into a browser and if all is well you’ll see the Apache default website text informing you - “It Works..!”

You have your LAMP up and running, but how to copy files into it? Well, first let’s open up the web folder to accept data. *NOTE* - 777 is open access, once built drop to a minimum of 755.

$ sudo chmod -R 777 /var/www

To install WordPress, first install phpmyadmin to create the database. Install as follows, inputting your MySQL and Admin user password(s) when requested.

$ sudo apt-get install phpmyadmin

Once installed, access via a browser as advised and log in, select the ‘Privileges‘ tab and create a user with a matched database. You could use the name ‘word_press‘.

Next, download your WordPress installation and prepare as described HERE inputting DB_NAME, DB_USER and DB_PASSWORD.

An SSH server can already facilitate SFTP file transfer and as our pre-configured AWS security group allows SFTP (SSH – Port 22) we can dive straight in. In Transmit simply configure an SFTP connection to the server IP using the instances username and password. Click the key icon adjacent to the password entry box to specify the location of the keypair (.pem) file and connect. Upload your WordPress files to /var/www and kick off the installation at the following address (containing your own details) http://<your_server_ip>/wp-admin/install.php.

And that’s it, you should now have a working installation of WordPress in an EC2 Ubuntu Virtual Server.

There are a couple of things to be aware of with your shiny new build, firstly, as there is no standard Port 21 FTP utility on the server both WordPress and plugin updates will not function from within the application. You can re-configure WordPress for SFTP by installing and configuring the SSH2 package however it’s just as easy to manually upload & delete plugins using SFTP in Transmit.

Secondly, there’s the eMail issue, EC2 IP’s are allegedly blacklisted for sending mail, and although personally I've had no problems that's not to say you won't. As such it may be wise to configure some sort of SMTP relaying if you require comment notifications. The WP Mail SMTP plugin should accomodate this, download it HERE, upload, activate & configure.

Please feel free to comment or get in touch directly if you would like expanded advice on this or any other services we offer.

LTSP - Back to the Future

2011-04-03T07:00:00.001+01:00

During our Linux for Business Workshop we demonstrate Linux Terminal Server Project (LTSP) technology, and it’s fun to note parallels between what was, what is, and what’s going to be, as it seems the old saying is indeed true in that nothing is really new and “What goes around comes around”.

A “client/server” model was the original method of computing. Resources were held centrally and computing (processor) time allotted to remote terminals. Technology has of course evolved and now we have more computing power in a digital watch than was once delivered from the monolithic mainframe systems that used to spit out punched cards to the bespectacled analysts of the 70's.

The mainstream business PC of today has it’s own internal hard disk and is a fully functioning computing entity in itself, albeit an inefficient one prone to failure and resulting admin overhead, however the realised push for virtualisation is bringing change and thanks to initiatives such as LTSP offers resulting ease of implementation.

In a nutshell, LTSP offers remote network booting for PXE clients (Diskless PC terminals) from a single instance of a centrally managed Ubuntu desktop operating system. The advantages of which are multi-layered -

Substantial drop in hardware spec. No internal hard drive required, lower operational processing power, reduced memory & graphics, smaller unit footprint. Resulting savings for power consumption.
One single instance of the operating system to patch, update and administrate.
Simple backup (Data is already present in a single location on the server).
Default single location for all user accounts and managed groups.
Speed of installation for new clients (i.e “Instant”).

Plus, as the LTSP framework offers multi-client logins you can still manage your suite as an enterprise network, most excellent. The only “downside” (if you can call it such) is a 128mb memory requirement per-client on the server, and a decent network infrastructure of course, ideally GB but 100base is adequate.

Thin client technology predominantly enjoys widespread use around education establishments and dynamic environments such as internet cafes and co-working spaces, but with browser based software delivery becoming more the norm is an intelligent infrastructure option for any forward thinking office.

Ubuntu offer an “Out of the box” LTSP server install from their Alternate CD (download it HERE). Installation requires a dual NIC host and is as easy as pressing F4 at boot and selecting the "Install an LTSP Server" option (Fig:1).

Fig:1 - LTSP Install. Press F4 at boot to access the Modes menu as pictured.

Fig:2 - Primary NIC selection. The secondary NIC is used for client connection/delivery.

Fig:3 - The LTSP Client Boot-Splash with log-in. Note the local IP.

Once up and running all connecting LTSP clients are presented with a standard OS image (shell), something you will invariably wish to modify and lockdown. This is easily achieved using two standard utilities, Sabayon (Profile Editor) and Pessulus (Lockdown), installed on Ubuntu from the CLI.

$ sudo apt-get install sabayon pessulus

Once installed access from the Administration drop-down menu (Lockdown Editor & User Profile Editor). Configurations can be used in conjunction with the operating system Users & Groups utility to deliver a flexible and secure client access framework.

Fig:4 - The Sabayon User Profile Editor presents a fully windowed desktop for easy configuration.

If you are interested in expanded Thin Client technology feel free to give us a call, we would be more than happy to help and advise you.

Listen in Colour

2011-04-02T07:00:00.000+01:00

Just because something is more technologically advanced doesn't mean it's intrinsically better, in a lot of cases this can be true however we had a recent discussion about the Kindle and I won't lie, I hate the things. For me a book is more than the mere words it contains, I treat mine as respected artifacts and can't imagine reading (for leisure) from anything else. Digital text is cold and transient (and where do you put your bookmark?).

The conversation logically moved on to music with a retrospective aside on how we used to play one side of an album and physically turn it over to play the other, a completely different listening experience from absently flicking across disjointed audio tracks, plucked randomly as we do these days from a monolithic vat of faceless data.

Of course it’s a different world, a different lifetime, a different set of rules and yes, a different listening experience. I’m (mostly) as guilty as the next man and although I do endeavour to keep one foot in the past for the duration of a full album with all tracks played *as the artist intended*, my conscious commitment feels increasingly flayed by an abundant overload of available data combined with self imposed modern day constraints of time for listening to any of it.

The listening experience is one thing and although potentially disjointed can be reeled back as was with a bit of self control, and although music is music there used to be other contributing factors which made it all the more special. For example there was the build up and anticipation of the release date combined with attainment of the physical product on the day. I vividly recall teenage excitement on collecting the latest pre-ordered 7″ from the UK-Subs, a Saturday morning purchase verging on the religious and doubly enhanced by the brown paper bag it came in, sealed and labeled with my name hand written on it in biro by an adolescent fantasy in the shape of one of the (then) coolest girls on the planet who served behind the counter of Thirwells record shop in Northallerton High St, at 14 years old it couldn’t have got any better. But there was more, and it’s the more which no amount of innovative iTunes timed releases, podcasts, pod-concerts or free album downloads and accompanying newspapers from Radiohead will ever, EVER replace – I’m talking about coloured vinyl, yes, the absolute unequaled, unrivalled and never to be repeated pinnacle of music related collectability.

My first ever self bought music was Cool for Cats by Squeeze on pink vinyl (I proudly still have a 12″ copy) and it went on from there to include most alternative and punk from the charts of ’78 to 82′. I’d kill to have that collection now, but as was the case with my stash of 2000AD comics they were moved on to make space for, and fund, the next thing, and in this case after records came motorcycles (the 2000AD’s previously went to fund the records).

The uniqueness of collectability seems to be missing in the digital age of audio. How could there ever be an MP3 released in coloured data format which you could frame later in life after re-discovering it in your loft, it’s completely impossible, those days have passed and with them the buzz of the collectable special, a collectable MP3? It’s just not going to happen. It’s all just data, lines of code, and with the advent of online storage not even magnetic states on our own personal media anymore. We stream 0′s and 1′s from the cloud, listen to a few snatches of a few tracks of something in our iPhone earpiece, switch off and it’s gone again…….what was even there?

New technology provides us with a lifetimes collection of music in our pocket, digitally enhanced to (allegedly) sound better with gadgets and applications to stream it when we want and where we want, but I still lament the loss of vinyl. It’s self admitted mid life nostalgia for a bygone age of adolescent dreamy evenings spent racking up a stack of 7″ singles on my mono box record player and having all the time in the world to play them over and over again, but equally I miss the loss of concept for the physically present limited edition gate-fold sleeve you could hold in your hands whilst listening to the audio, mainly for itself but also because there can be nothing to replace it, it’s gone, a full genre of interest and history from my youth is extinct.

Digital music, enhanced it may be, and it may be true that it sounds better (debatable), with the advent of the iTunes LP we also get video, but although hugely convenient (I love my iPod Nano) I do feel that todays music plays from a faceless and colourless format.

Messagical - The Newton iMessage Pad3

2011-04-01T10:19:00.010+01:00

Today Apple launched a surprise product as both a thank you to long time Mac fanatics and to address the staggering demand for the iPad2 which they are struggling to meet.

The new product is actually a revamp of an old favourite and those who have a history with Apple will immediately recognise the Newton, Apples 'vintage' iPad and the worlds first tablet computer, released way ahead of it's time in the late 1980's.

"We always knew tablet computers would be a success" said an iSpokesperson "We wanted to give our loyal fans something really special to celebrate the huge success of iPad2, and what better product than a super cool hipster-esque retro Newton running the very latest version of iOS4"

The funky new device is intelligently designed to slot into the huge gap between iPhone and iPad, a previously unfulfilled need thankfully now filled, and not only with a super cool product, but with one which pays homage to the legacy of the worlds most stylish computer company.

Aside from known inclusion of Apples revolutionary infra-red iLaser further specification is limited at present, however we will be posting a full review if ever we get our hands on one.

Keep Control - The Turnkey Linux PDC

2011-03-31T07:00:00.003+01:00

I’ve previously mentioned the need (or not) to implement a server at small business level (SMB/SME). Office workgroups (up to 12 PC’s) can happily share files and printers from a SAMBA NAS whilst running eMail & collaborative groupware from Google Apps, account admin is quite manageable with a dozen or so users and if remote desktops are enabled both application and operating system management can also be kept in check by the *appointed* office IT individual.

However, when infrastructure starts to expand (and funding doesn’t) the tight little managed workgroup can very quickly grow past it’s manageable boundaries and in such situations it's wise to get on top of things before they get out of control.

Even with financial constraints, if a few days R&D and admin time is allotted it’s quite easy to morph an existing workgroup into a professional domain model at very little (or no) cost. The answer? A Samba based Linux PDC (Primary Domain Controller).

There’s no need to buy a dedicated server as Linux will run quite happily run on a low end or second user re-purposed PC (Just make sure you back it up, and/or install a RAID1 disk mirror) and if existing workstations are already spec’d with a suitable business platform (as oppose to a “Home” operating system) centrally controlled domain logons, roaming profiles and related home shares can all be accommodated from no more than a few entries in the server smb.conf file. It really is very easy to accomplish and there are a whole array of quick “How To’s” posted around the web explaining the procedure. Or, for those wanting an even easier solution (and who doesn't?) Turnkey Linux provide a preconfigured SMB PDC as one of their many excellent pre-builds, simply download the .ISO, burn, install and configure via the web interface. We demo the Turnkey PDC in our Linux for Business Workshop and can't recommend it highly enough.

But, what about Active Directory I hear you say? Or MS Small Business Server? Well, yes, both superb solutions and de-facto models of choice across todays connected IT enterprise, however being Microsoft products they also come at a price, and to be honest for a single site SMB/SME a Samba based PDC model + cloud groupware tie-in is not only a substantially more cost effective option but sat on a Linux box it’s also more stable, more secure and substantially more resource efficient.

If your office IT is starting to fray at the edges and you don’t have the time to get things sorted feel free to call us, we would be more than happy to get you tightened up and ready for future expansion.

Continental Cost Savings - The French Police and Linux Ubuntu

2011-03-30T07:00:00.010+01:00

If implemented intelligently the resultant cost savings from mainstream software licensing against an open platform can deliver quite substantial returns. The larger the organisation the greater the potential for reduced TCO and there can be no greater example of this than the on-going migration by the French 'Gendarmerie Nationale' (National Police Force), the results are quite amazing.

The Gendarmerie accountant had questioned the escalating requirement and related cost implications for Microsoft Office licenses and decided to give Open Office a spin, he found the program adequately covered their business needs and it all started there. Open Office was rolled out first followed by planned migration of the desktop OS from Windows XP to Linux Ubuntu. Combined inception of a web based core system meant local platform specifics at workstation level were open for any OS running a secure browser and the systems team opted for the cross-platform conformity of Mozilla Firefox, matched with Thunderbird e-mail for their IMAP mail platform.

The rollout began in earnest from 2004 and to date is saving €2 million per year. With a structured upgrade plan targeting 10,000 desktops during each twelve month period it is estimated that by 2015 the Gendarmerie will be running Ubuntu across 90% of their 85,000 PC's. As of 2009 they had already racked up savings in excess of €50 MILLION from previously expansive licensing and support costs.

Lieutenant-Colonel Xavier Guimard of the Gendarmerie presented a keynote speech at the annual NOiV conference for open source standards in Utrecht, amongst an extensive breakdown of decisions for (and roadmap to) their adoption of open standards are some lateral points for anyone contemplating a similar strategy, reassuring and obvious comments (aside from the quite staggering cost savings) which should prompt anyone not to look too deeply into technicalities. Sometimes the most simple observations are the most poignant, in the words of Xavier himself -

“Moving from Microsoft XP to Vista would not have brought us many advantages and Microsoft said it would require training of users. Moving from XP to Ubuntu, however, proved very easy. The two biggest differences are the icons and the games. Games are not our priority.”

“Previously, one of us would be travelling all year just to install a new version of some anti virus application on the desktops in the Gendarmerie’s outposts on the islands in French Polynesia. A similar operation now is finished within two weeks and does not require travelling.”

“This year the IT budget will be reduced by 70 percent. This will not affect our IT systems.”

“Users need no training to use a web browser.”

In the evolving world of browser based application delivery from the cloud Linux is the cost effective King and a decision to adopt it will without a doubt reduce your IT expenditure, and as demonstrated here the bigger you are the more you’ll save. Amidst todays financial chaos everyone is looking for ways to save money which is why examples like this are welcome, reassuring, inspiring and why I write about them.

Story as reported on OSOR.eu - Click Here.

Expanded article on the Ubuntu Website - Click Here.

Open All Ours

2011-03-29T07:00:00.002+01:00

Open source means different things to different people. To some it’s a descriptive tag for certain platforms of community developed free software, to others it’s “lab” computing for geeks and at the far end it’s a comprehensive lifestyle ethos, however there is a constant and if we dig down we’re going to end up somewhere around root “collaboration”.

The word collaboration is invariably linked to production of an end result and is further described as being inherently positive (except, interestingly, during wartime), its corroborated companion, “co-operation”, is apparently always positive and the staunch anti-thesis of both comes to us as the dark deceitful back-door concept of “collusion”.

A perceptually large amount of the Open Source community relish the apparent notion we may indeed be at war, a war (for them) against a certain monolithic software giant (who shall remain nameless) and I must admit it does feel like that at times, although in war don’t you have to have two sides fighting each other? If not I believe there’s an escalating scale of aptly applicable descriptions for such systems one could pull on leading up to virtual despotism. But let’s not get too extreme, after all we’re the ones sporting (figurative) beards and sandals. Life is a choice and it’s all about options, ideally.

What’s more important in life to you? Security? Purpose? Status? Family? Can they be separated? I'm not sure they can or should, for if you factor in human flair for social interaction you complete the full package for endorsed happiness, with life, as a result, becoming substantially more than the sum of it’s contributed parts thanks to increased benefits attained through a collaboration of needs.

Positive energy flows from collaboration and through open collaboration it flows even freer, you know how nice it is when someone helps you out purely because they want to? Aside from being the basis for friendship it could even be the crux of potentiality for an evolved future of our species (If we ever stop trying to blow each other up). There’s no doubt the production of anything is instilled with a certain something extra if it has been created from passion and goodwill rather than on the back of a single focused drive to capitalise and make money.

What does this mean to your daily email and web surfing? Well, all I’m saying is that open source software is much more than just a great way of saving money. Our choices in life define who we are.

The Funky and the Fear

2011-03-28T09:41:00.001+01:00

I like the Germans. I love their open boundaries for inspired technical innovation, not only are they huge advocates (and users) of Linux but outside the virtual their adventurous ingenuity has developed all manner of engineering icons, many now globally revered for brand performance and reliability, but some, like the BMW C1, predominantly confined to a brief few years inside the physical and cerebral borders of the Fatherland.

You may or not have seen one of these things around your urban environment, not so much in the UK but most definitely around European cities. And what is it? Well, it’s more than just a scooter with a rollcage.

The C1 was designed to intelligently combat congestion by slotting in as a transport option between motorcycle and car. Initially produced with a 125cc engine it was later upgraded to 200cc and has since been redeveloped (in 2009) with an electric motor as the presently 'concept only' C1-E (Pictured).

As an innovative urban vehicle I really rate the C1, not only does the design keep you dry but also safe, in fact safety features are the C1′s main development feature. Included as standard are shoulder-height roll bars, a crumple zone around the front wheel and an aluminium roll cage creating a car-like protection cell, they also have twin seat-belts reminiscent of an aviation style four-point harness to keep the rider in place and BMW claim that in a head-on collision the C1 offers a standard of accident protection comparable to a European compact car.

Tests show that wearing a helmet with seatbelts can actually increase the possibility of neck injury in the event of an accident and the C1 was created to be ridden helmet free, a contributory factor which may have led to poor sales and the petrol based C1 line eventually being discontinued in 2003. Although the majority of European countries accepted BMW’s statistics and safety recommendations relating to helmets the stiff old UK refused to acknowledge and accommodate the C1 for what it actually was, i.e a revolutionary new form of practical, funky and fun eco-transport.

The helmet law was created to protect riders from injury however in this instance, as tests prove, it can have the opposite effect, even so in typical jobsworth letter of the law UK fashion there was to be no exception and having two wheels the C1 was unwaveringly classed as a motorcycle. There was a case taken to court several years ago where a helmetless C1 rider won his case but by then it was too late, the damage had been done.

Perhaps now, several years down the line, with the push for eco fuel cells and alternative forms of environmentally friendly transport at the forefront of everyday life the C1-E may still pull interest and acceptance. I'm personally hopeful, but as with Linux, which as an alternative computer operating system delivers its own range of benefits for realised adoption, the pull for the mainstream, from the mainstream, may still sadly give many the fear.

That said, one might wonder what the response would be were it branded, and marketed, by Apple.

Likewise 6 - Instant Integration

2011-03-27T13:08:00.003+01:00

The core of our Linux workshop revolves around the integration of Linux desktops into Microsoft Active Directory via a utility produced by US company Likewise. As such we were most keen to evaluate v6, their most recent release. The following review is based on a basic installation to MS Server 2003 SP2 with the concurrent client installed to Ubuntu 10.04.1 Desktop.

We’d already experienced a pleasing performance increase from the latest Likewise Open client so were expecting a similar boost with Enterprise, however from the word go it was apparent there was much more on offer. Version 5.3 (Enterprise) was (and still is) a great product but requires a degree of post install administration to level out a base GPO config across linked cells. Version 6 is an instantly more polished product delivering a hand held, coherent and inclusive integration procedure which starts at the initial DVD splash with an easy tabbed menu (fig:1), simply select your platform (32 or 64 bit) and away you go.

Fig 1 : Initial installation window.

You’re guided through a few simple steps which usefully install all the required MS tools (fig:2) and finish by opening the Likewise admin console to create a linked Likewise Cell (fig:3) and GPO for you, a superb and most welcome procedural upgrade from Version 5 and one which works seamlessly, cutting out a whole section of previously required extra config.

Fig 2 : Windows tools installer advisory.

Fig 3 : Cell creation (location).

Another nice touch during new cell creation is the GPO “prepend” option (fig:4) which once you’re ready to roll client side means there’s no requirement to type a full domain string to logon, you can dive straight in with username only, much cleaner, you’re also given the option to auto-link your installation account (invariably “Administrator”) with the created cell & GPO. We did notice that configured policy wasn’t enforced by default however as it’s something you’d check (and more than likely add to) prior to client logon it’s probably not even worth mentioning.

Fig 4 : GPO Creation advisory.

On the Ubuntu workstation things are equally as refined and a simple sudo ./install.sh command executed from the Enterprise DVD (or .ISO) root recognises your platform, kicks off the installation and finishes by opening the domain join GUI for you (a nice touch). Domain-join was virtually instant and after the statutory reboot we created a user account in ADUC, enabled it for the Likewise cell and logged on, job done.

As an idea of just how streamlined Likewise have made Version 6 the full installation (including Active Directory, DNS config and making a coffee) took us no more than 30 minutes max from empty server instance to logged on domain-joined client.

*NOTES* – Pre-install it’s good to raise your domain & forest functional levels (if possible) to Server 2003 as Likewise schema mode is more readily received. Installation across a 2000 domain will still proceed with no performance hit, however raising the level provides tighter RFC 2307 integration with AD, basically it’s a good thing to do. Also, ensure your Ubuntu workstation can “see” your domain, this is best done through interface (eth0) & /etc/hosts config.

If you’re interested in getting “Hands-On” with Likewise feel free to contact us for information regarding bespoke consultancy and/or integration solutions for Likewise or any of the other services we offer.

AWS - The Amazon Cloud

2011-03-26T14:08:00.004Z

For the majority of organisations data backup is a full time job. As a former I.T Service Manager I was once responsible for ensuring a digitised archive was backed up, a lengthy and laborious process involving a multi-site system of networked tape libraries with accompanying software and a regimented physical routine for changing tapes and/or rotating them to off-site storage.

At the time I recall wondering why data couldn’t just be streamed up and across the virtual landscape of the emerging internet rather than held on site-based devices sat sucking up power and a whole string of other related resources. Well, today my musings have become a reality and I.A.A.S (Infrastructure as a service) or “Cloud Computing” (its user friendly name) is the increasing norm around enterprise I.T with offerings from web giants such as Google and Amazon happy to manage our off-site data and redeliver it with increasing ease. I’ve previously pushed the simplicity and cost bonuses of Google Apps however Amazon’s Web Services (AWS) are also worth exploring as they offer a whole range of products and services aimed at a deeper systems expanse. Let’s break them down and take a quick look at what’s on offer.

S3 – Basically, S3 offers expandable storage space in the Amazon cloud. You can specify zones in the UK, US and far East or opt for their “Cloud Front” which mirrors your content around edge locations for speedier delivery dependent on the access client. It’s cheap too, for example a static 10GB archive is going to drop in at around £10 a year, which is incredibly reasonable. S3 will also link data from and to your website infrastructure either statically or via configured API’s for functioned data usability, you can specify individually applied public or secured links for distributed download and (most recently) take advantage of their streaming media services.
EC2 – The “Elastic Cloud”. This is a platform for dynamic or fixed virtual servers. AMI’s (Amazon Machine Instances) can be fired up and configured at will or automated in response to load parameters. Offering elastic IP’s and load balanced content delivery with snapshots for volume backups you can quite literally have a virtual server farm running in a matter of minutes.
Amazon VPC – The “Virtual Private Cloud” securely extends your business network offsite into an easily managed accessible platform offering all the benefits of expandable on-demand cloud based infrastructure. Integration is through a regular VPN connection with charges following the same model as other AWS resources.

Overall the AWS platform is a superbly scalable and cost effective solution for any sized business looking at a virtual platform and we’ll be publishing a selection of specific AWS How-To’s in future posts, watch this space if you’re interested (Or sign up to our RSS update feed).

*UPDATE* - Amazon are now offering their "Cloud Drive", 5GB of completely free online virtual space, not bad. Check it out - https://www.amazon.com/clouddrive/learnmore

Clean up with Google Apps

2011-03-25T18:31:00.011Z

For one reason or another (invariably an infected PC running a local mail client unknowingly knocking out SPAM) it’s not uncommon to find your hosting providers mail server IP address has found its way onto an internet blacklist and you’ve frustratingly become some sort of virtual e-leper, unable to contact your important clients due to an inbox full of rejected messages.

It's not a great place to find yourself and certainly not conducive to the flow of business. You can request removal, and in most cases will be successful, however once *it* starts you can guarantee an increasing amount of on-going admin cleaning your name around around the www, which, aside from being incredibly annoying also sucks up a fair bit of time, and let’s face it, who has any of that spare these days let alone needs the added hassle, we’re all too busy just trying to keep on top of the work we already have backed up.

So, what’s the answer? Well, if you’re using a PC you’d better check that virus software and scan your operating system, you’re probably contributing to a global bot-net without knowing it. Next, to really nail it you could switch hosts, however it’s such a laborious and convoluted process you’d honestly be better off registering a completely new domain name, but what a chore that would be too, even with applied re-directs and masking you’re still asking for a world of pain and potential for general DNS disarray.

Or, you could just migrate to Google Apps for Business, we’ve never looked back, and neither have any of the clients we’ve migrated. The procedure is quick, painless, and for up to 50 clients across specified community groups is also completely free.

Not only do you get the most resilient enterprise class email system around the internet with conversation threading, message labelling & auto-archiving, it comes backed with linked groupware offering online Docs, Calendaring, Chat (Talk) and “Sites”, all slick and easy with seamless interoperability between all users from literally anywhere on the planet. You can forget about that restrictive old server sat in the corner of the office hoovering up dust whilst pumping up your electricity bill, the Big G can take care of all your needs, all you need is an internet connection.

MEBBiNET are mixed platform integration specialists and we would be more than happy to help you save time, stress, resources and money by helping you to migrate your enterprise hosting into a linked cloud.

Our base consultation is free. Give us a call, what have you got lose?

Seasoned Support

2011-03-25T09:37:00.002Z

The major mental hurdle for any business assessing open source software is that of support - migration support (impact on existing business), user support (familiarity training) and on going support (upgrades/roadmap etc). Such concerns can, and do, offset the most substantial of cost savings, but what’s the actual situation?

Microsoft obviously factors into the mindset and with its 90% market share support is more than available, however it does come at a price.

I’m not here to knock Microsoft solutions, not at all, their enterprise server platform is superb, although it would be incredibly short sighted given the present global economic climate for any savvy I.T manager to not at least cast an inquiring eye over cost effective alternatives from the perceived “other side”.

Microsoft support skills are ten a penny and the sector is saturated with MCITP’s of varying levels, both experienced and “paper” (non-experienced) however the majority of todays business I.T departments, rather than offering a broad range of computing knowledge and experience, provide no more than “Microsoft Support Services”. A computer is actually quite a capable box of tricks if you don’t choke it with bloated software and there's a whole lot more to the world of computing than the ubiquitous .DOC Word format. Over the years there has been a distinct dumbing down of in-house I.T skills, or should I say a tunnelling into the “Microsoft way”. However ubiquitous as it is Microsoft isn’t I.T, it’s Microsoft, just one option among many.

To highlight the situation take your mid-level car mechanic, he’s well versed and well experienced with vehicular concepts and corresponding fault finding solutions he can apply across the board from a mid 70’s Austin Mini to the latest space-age people carrier. Until electric cars become the norm we will still run combustion engines with pistons, cooling & fuel systems, gearboxes and all the surrounding and supporting gadgetry and electronics, even with hydrogen power cells we’re still going to need wheels and brakes. A seasoned I.T professional operates on a similar level, more than capable of cross platform support whilst a “seasoned” I.T department should be even more so and comprehensively rounded enough to allay any fears and concerns around support of non-MS solutions whilst performing relevant R&D to offer them for consideration to non-technical budget holders.

Aside from lack of confidence with in-house expertise people get jittery around Linux due to misconceptions relating to its source and development. “Open source” conjures up images of community nerds with beards working away in bedrooms across disparate sections of hashed up code to produce Frankenstein-esque applications looking like something from the late 80’s, there’s no doubt such fractions do exist however in 2010 the professional world of open source solutions (aside from product cost) is actually not too dissimilar from it’s corporate flip-side, with certain providers actually providing a more extensive support framework and product roadmap. Let’s take a look at Canonical as one example.

Canonical offer their Ubuntu client & server operating system not only for free but on a regular 6 monthly release cycle with a 2 year window for their LTS products (Long Term Support – 3 years on the desktop & 5 years for server), they provide a range of paid support subscription options alongside an extensive free on-line Wiki & technical documentation portal.

Such vendor support is obviously reassuring and if you choose your version intelligently from one of the big players the ROI can be most lucrative, but as discussed, if you have the right blend of seasoned staff you shouldn’t actually need it…..

Linux - Realised

2011-03-23T20:15:00.003Z

With a 70% forecast for enterprise additions over the next five years it seems the realised benefits of Linux have finally filtered through the proprietary marketing machine. It’s taken a while, but cream always rises to the top ;-)

Interesting too are the figures for new installations with a huge 66% across greenfield deployments.

Recent news surrounding cyber terrorism (and the threat of) should also prompt further take up, for as operating systems go if you want to operate with the best level security then you have to be *Nix based.

Given a choice (and you do have one) wouldn’t you rather select an operating system which was configurably secure “Out of the Box” as oppose to one which required immediate patching and extra virus prevention software installing just to make it safe? It is true there is no such thing as a totally secure computer however there is such a thing as damage limitation.

In with the In-Box

2011-03-23T20:07:00.004Z

Email is, of course, the ensconced backbone of global business communication at all levels and there’s no apparent mystique on how to use it, i.e “Create Message” and “Send”, that’s it? Well yes, that’s the bottom line, however in a dynamic business environment if you haven’t got a handle on your data flow and message management things can quickly get out of hand.

I recall an SMB tidy-up where the receptionist had an inbox pushing 18,000 messages going back to 2004, quite something, as was the time if took to transfer it all up into their new Google Apps IMAP account through the office ISDN.

You can give such users many a sideways glance but they should never be blamed, not everyone is I.T savvy and not every company realise the value of basic training, however as is the case with most things, a little can indeed go a very long way.

A quick 30 minute or one hour run down across folder creation, searches and message archiving not only helps the user to keep track of an unrelenting influx but by tagging on signature creation, contact manipulation and scheduling it provides them with added confidence to operate at a more professional level, move on to link up shared calendaring with meeting requests and it’s job done, quite literally.

MEBBiNET have years of experience across service delivery in user support environments and fully encourage queries from all levels during site and project visits. Without exception each and every user has the fear to some degree and will berate themselves for “not knowing about computers” (etc), but why should they? I know nothing about electronics, or plumbing, or social work, they’re not my areas and I wouldn’t dream of pretending otherwise, I also wouldn’t apologise to a visiting electrician or plumber for not being able to repair or install a related product myself, honestly, it’s madness, why do computers do this to people?

Just ask..! It’s really OK to do so and we ENJOY being able to help, it’s the most rewarding part of the job, fixing the hardware and systems is easy.

Does todays SME really need a server?

2011-03-23T18:41:00.003Z

Due to their size and admin requirement many small businesses cannot financially justify a fully dedicated I.T department (or employee), as such their computer systems usually evolve (in)organically over a number of years from one or two computers into a disparate mixture of self-installed desktops running an insecure and unmanaged mixed platform.

Everything is OK for a while, systems are joined to the local network (LAN) with POP eMail accounts added here and there as required, however before you know it a workgroup has developed, data is all over the place, users are treating their computers like home media centres and strange things begin to happen, then there’s the backup routine (or lack of).

So, in comes the contracted third party company with big ideas and an array of confusing concepts which in most cases revolve around installing an extra server on site, obviously running software of the Microsoft flavour, i.e “Small Business Server”.

Now, don't get us wrong, MEBBiNET are long time supporters of Microsoft server products, Active Directory and MS Exchange are excellent enterprise solutions and we deliver a desktop Linux integration workshop teaching integration method, however, at SME level their viable functionality and required admin incurred for the small amount of users is questionable when evaluated against combinations of network attached storage (NAS) and coupled cloud service hosting on offer these days.

Let’s take a look at NAS. A dedicated server can cost anything from a few £1000’s (entry level) to upwards of 10x that, and comes with a consideration for necessary (and expensive) server class licence programmes, the costs add up quite substantially. For basic data sharing you can, however, simply source a decent NAS box, which will take care of all your needs equally as securely and with noticeably less requirement for admin, configuration and maintenance.

NAS boxes start from around £200 (1TB) and plug into any existing network to instantly offer simple management through a browser interface. A NAS will function as an office print server and when configured for RAID-1 (Disk mirroring) provides a base level of in-built redundancy at hardware level, which although does not “officially” remove the need for extra backup is certainly a most welcome safety net. The range of NAS boxes from sector leaders Q-NAP run a Linux shell with comprehensive user & group authentication plus an in-built web server offering MySQL & PHP functionality.

You could admittedly create a simple folder share from one of your existing user PC’s, however you then need to make sure that it's backed up and powered up for continued access, both of which are problem areas when applied as required services from a desktop PC. Windows XP Pro for example has a 10 client connection limit (XP Home is 5) and of course neither the desktop hardware nor the operating system is designed for 24/7/365 up-time.

Combined cloud messaging and group collaboration are another rapid growth area, both of which totally negate a need for expensive on-site hardware and supporting resource, in fact many large organisations are junking their expansive MS Exchange platforms entirely in favour of the Google Apps for Business hosted service, it really is that good.

Take a look at that dust sucking old server unit sat in the corner of your office draining electricity and taking up much needed space, did you even change the backup tape last night? And what does that error message mean?

MEBBiNET provide a comprehensive platform and infrastructure evaluation service. Give us a call, we would be more than happy to help you tidy and secure your systems. We’re confident we’ll save you money, time and effort and we will never, ever install or sell you anything you won’t need.

Life can be complicated enough, your I.T doesn’t have to be.