Today was a mostly full day of tests at the Texas Transplant Institute, for both my uncle and my sister, that ended in all ‘”this is good news” (only holdup is waiting for the uncle to drop another 10-20 pounds) and “we’ll let you know what we find”. We went on a boat tour in downtown to wind down, post-anticipation.

Tomorrow morning is another 5 or 6 hours at the hospital, then we fly back to Michigan in the afternoon. Then more waiting. Always the waiting. But we’re so close. So. Very. Close.

PCI (DSS) Compliance for e-Commerce Sites

As much as people love to hate PCI Compliance (or more specifically, the scanners), it is a necessary evil. In an industry-wide race to the bottom, the Payment Card Industry Security Standards Council (PCI-SSC) had to implement a standard to which they could hold everyone accountable, and by which they would judge the security of consumer data, in all payment card transactions.

In 2006, the PCI-SSC got together and composed a standard that everyone in the Payment Card Industry (everyone who accepts payment cards, from brick and mortar stores to e-commerce), which they called the Data Security Standard. They wanted to help streamline an increasingly complex process (getting approved to process credit cards through your own in-house-developed payment application), but without compromising the security of consumer data. While the importance and relevance of PCI DSS can be overinflated, it is just as necessary as any other standard. Treat it like a list of regulations to follow, use common sense, and you should be fine.

To help you along, I have outlined much of what’s included in the PCI-DSS, and what you can do to help secure your server, and help your server pass its scan.

General Data/Application/Network Security Defined in the PCI-DSS

Most of the points addressed in the DSS would seem to be common sense, but they are outlined to prevent common vulnerabilities.

1) Write your application using clean and secure code.
All of the good developers I know have told me: using good, standard coding practices is key to writing a secure application.
2) “Protect Cardholder Data”
Specifically this means any ‘personally identifiable information’, which is defined below.
3) Encrypt and send securely all traffic and data
Use SSL, and encryption, for all traffic. Do not assume your customer/client will be protecting themselves.
4) Limit what you store.
The DSS clearly defines that you can and cannot store, and how you can store that information which is allowed:

PCI Data Storage Guidelines

5) Staff access/security
When it comes to “Cardholder” and “Authentication” Data, limit access to only those people and servers who need it.
6) Unique login credentials for each user.
Any person or server who has access to sensitive data has to have unique credentials, to aid in tracking.
7) Restrict physical access to servers hosting sensitive data.
If you are hosting this information in a datacenter, you are probably covered, but you will still want to double check with your hosting provider.
8) Use Anti-virus/malware software/scans.
This applies to application servers as well as employee workstations.
9) Maintain a strong written information security policy.
This policy must be strong, clear, and easily accessible to employees and customers.
10) Use non-default passwords
You cannot use default passwords in any software you have installed.
10) Increase Security through obscurity
Use private networks wherever possible, especially to limit traffic. If you have your sensitive data hosted on a single server, by itself, use a private network to connect it to your public web server, and restrict all other access.
11) Track/Monitor/log all access to your application.
This data is required in the event of a compromise.

Before you scan, every time:

Here are a few things you can do before you scan your server to help prevent unnecessary failures, and to help you retain your certification through future scans.

1) Install and maintain a Firewall

While you can use either hardware or software, you absolutely need a firewall. Any ports that do not need to be open to the public (MySQL for example) should be closed. Any other restriction of access that can be done will only increase your security. Though this isn’t a requirement: I strongly recommend a BFD/LFD like script/daemon. They can be extremely useful in mitigating unnecessary compromises due to weak passwords.
If your application is spread across many servers, I recommend a hardware firewall for the sake of simplicity. The easier your network configuration is to define and maintain, the more likely it is that you won’t leave unintentional holes.

2) Update your software

Software updates do much more than just add new features: they almost always include security patches. In fact, most of the time minor version updates are nearly entirely security patches. Make sure all of your software is at the most recent version you can run. Just to be helpful, a list of software that you are probably running, that you should keep updated:
– Update cPanel/WHM and all of its Plugins
– Recompile Apache (You HAVE to be using 2.0 or newer, due to a recent unpatched exploit in older versions)
– Rebuild PHP: You must be running the latest version in your branch. If you’re running an application on PHP4, you should already be in the process of re-writing and testing to move to PHP5, but the latest version of 4 will pass a PCI scan.
– Update CMS Software (and plugins) should always be kept at the most recent version. “Upgrading breaks my plugin” is not an excuse not to upgrade, and is probably an indication that your plugin was insecure and/or doing something it shouldn’t have been.

3) Use Good Passwords

I cannot possibly put too much emphasis on the importance of always using a secure password. Use of insecure or default passwords are an extremely common cause of compromise. Good passwords should be at least 8 characters long, should never be based on a dictionary word, need to contain capital and lowercase letters, and at least one special character. For more detailed discussion of the importance of password strength, see this page.

4) Disable services you don’t use.

WHM/cPanel comes bundled with a bunch of software that many hosts use. If you aren’t using it, disable it through WHM, in the ‘Service Manager’, and make sure that the port that was open for it gets closed in your firewall.

4) WHM: Apache/SSL Tweaks, and Mod_userdir

Make sure that all of your Service SSL Certificates are current, and then force all cPanel/WHM/Webmail traffic to use the secure ports, rather than insecure ports.  Once that is complete, go into the ‘Apache Configuration’. With each setting you will see both a ‘Default’ setting and a ‘PCI Compliant’ setting (they are sometimes the same thing). Make sure all of those settings are moved to ‘PCI Compliant’. The other thing that most scanners complain about is cPanel’s use of Mod_userdir. Under ‘mod_userdir tweak’ in WHM, you will find a full description and you will be able to disable it.

5) Disable/Limit DNS recursion

DNS recursion allows your server to act as a resolver for other computers. This resolver cache can be ‘sniffed’ to allow would-be hackers and exploits to gain knowledge about the domains your server is resolving. For example: the domain of the bank you use, and other information about your application configuration. It’s best to disable or limit recursion as much as possible. If you are using BIND, adjust your name.conf to mimic these:

To disabled recursion:

BIND: Recursion disabled

Limited recursion:

BIND: Limited recursion

6) Add scanner IPs to the ignore list in your monitoring software (BFD/LFD)

Your scanner will be throwing a whole lot of traffic at your server. If you are using BFD or LFD, make sure you prevent your server from automatically blocking the scanning server’s ips. Do not explicitally allow the IPs, as that will circumvent the firewall entirely (which negates the closing of the ports), but make sure they are listed in your ignore list.

What to do when your first scan fails: Backporting, and false positives

The first scan you get will have failures, no matter how much preparation you do. We’ll start with the biggest cause: backporting.

In brief, backporting is where Operating Systems take only the security fixes from software updates, and apply them to existing versions of the software. Redhat does an amazing job of explaining backporting:

We use the term backporting to describe when we take a fix for a security flaw out of the most recent version of an upstream software package, and apply that fix to an older version of the package we distribute.

Backporting is common among vendors like Red Hat, and is essential to ensuring we can deploy automated updates to customers with minimal risk. Backporting will be a new concept for those more familiar with proprietary software updates.

For example, say your server has OpenSSH installed. When the folks at OpenSSH are alerted to security flaws, they fix them. At the same time, they may also push new features, but the feature updates may break things that you already have in place. Obviously, you want your server to be secure, but having the secondary impact of the feature updates is less than ideal. Enter backporting. RedHat would apply the fixes from the update, but leave the rest of the package alone.

However, the updates need to be tracked somehow, so RedHat updates the package number. PCI scanners don’t track the package version numbers for all operating systems, so the scan will indicate that the software is not the appropriate version.

Disputes

Your scanner will have a process in place for how they want disputes submitted. Each failure must be disputed individually, which can be frustrating and time consuming. Just make sure you’re paying attention to the details, and you’ll get through it fine. If you run into trouble, or have questions you can’t find an answer for, ask your Hosting provider. They should be willing to help you out.

So now you know

PCI compliance doesn’t have to leave you sleepless for nights on end, nor does it have to cause you significant headaches. It won’t be easy, but it’s worth it.

One more thing:

Never manually upgrade OpenSSL on a cPanel server.

Never manually upgrade OpenSSH on a cPanel server.

Resources/Sources/Further Reading:

• http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard
• http://en.wikipedia.org/wiki/Payment_Card_Industry_Security_Standards_Council
• https://www.pcisecuritystandards.org/
• http://www.pcicomplianceguide.org
• http://www.defendyourdollars.org/2005/02/states_with_not.html
• http://docs.cpanel.net/twiki/bin/view/AllDocumentation/PCIComplianceInfo/
• http://www.cpanel.net/videos/common-pci-compliance-issues-with-linux/
• http://usa.visa.com/merchants/new_acceptance/how_it_works.html

#1: I am a simple creature.

#2: I don’t wear white socks.*

Long sock season: Labor day to Memorial Day

With those established, it shouldn’t seem like too much of a leap to understand why I do a thing every Monday that I call #MisMatchedMonday.

Around 9 months ago, I realized that I absolutely had to do something to help me not hate Mondays. I was incredibly unhappy at work, and fought every day to get out of bed. Mondays, though, were worst of all. One Monday I realized that I’d never matched and folded my clean socks, which meant I had a pile of unmatched socks. I started digging around in the pile and realized I didn’t want to wear matched socks. I wanted to wear fun, funky, MISMATCHED socks. It was perfect.

#MismatchedMonday

All day I walked around with a grin on my face, and nothing got me down. Tuesday I went back to fun, funky, matched socks, but the grin continued all week, and it was quickly decided: Every Monday was #MismatchedMonday.

#MisMatchedMonday

These days I have almost no problem getting out of bed on Mondays.

I only recently committed myself to taking pictures every Monday, and sharing with the #MismatchedMonday hashtag, but it’s become an integral part of my week. I love the rolled eyes from the family, and the look of exasperation from the boyfriend. I love showing the people at work, and leaving them speechless. But it’s been entirely for me.

Last week, with the amazing weather I wore sandals instead of shoes, which meant no socks. A buddy of mine walked up and asked about this weeks’ #MismatchedMonday and was dismayed to find my feet sockless. I realized in that moment, that #MismatchedMonday has become bigger than just me, and that I could add another reason for me to love it:

It helps make other people happy.

Be happy

That makes me happier than wearing mismatched socks on Mondays ever could, and ensures: I will wear mismatched socks on Mondays, and share them with all of you, until the sky falls on my head.

<3

EDIT: Alright, let’s keep this going. :D   http://www.flickr.com/groups/mismatchedmonday/

* Unless I’m working out. But even then, only after all of my colorful short socks are dirty.

I’ll have another week to tie up my loose ends in this spot, and then it’s back to the phones and helpdesk. I’m sure I’ll tire of it shortly, but I welcome the challenges.

Ani suggested we set up a cage match for the department heads, and let them fight over who gets me. Think we could make some money on that one?

Double the women = way cooler.

Comments are wide open on this one. What do you guys think?

I wasn’t entirely wrong, but it sure wasn’t as easy as I’d expected it to be. Mostly for two small reasons.

The setup

I decided I wanted to try some local development for this project, on my laptop. A google search revealed: the easiest way I found was using a piece of software called MAMP. It installs PHPmyAdmin, MySQL, and Apache, and has an easy interface to help you set everything up.

I followed these directions in order to install WordPress on my laptop, and started on these in order to get MultiSite set up. I got to step five before I encountered my first error.

The error

The second part of Step 5 is to add the lines that the network installation gives you to the wp-config.php. I did that, added the .htaccess lines. I then went back to my install to log in, and was faced with the giant error:

After a lot of troubleshooting and attempting to duplicate the error on my VPS, I figured out that WordPress Multisite is completely incompatible with InnoDB, and my MAMP install was set InnoDB by default.

The fix

So, to make this install work with MutliSite, I did this:

All in phpMyAdmin (which is installed by default with MAMP):
* I exported the database to an .sql file on my laptop.
* I dropped all of the tables in the database that I’d created for the WordPress install.

In your favorite text editor (or sed if you’re feeling adventurous)
* I opened the .sql file and changed all of the engine definitions for each table.
The line will look like this: ENGINE=InnoDB; Change it so they all say: ENGINE=MyISAM

Then, back in phpMyAdmin:
* Import the .sql file into your database.

That should fix the “Error Establishing Database Connection” error on your MultiSite install.

Fixing the default engine

The last thing I did, to prevent having to deal with this again, was change the default engine type in my local MySQL install using a combination of these and these instructions.
Summarized here:

Remember: This is assuming you’re running MAMP, on your Mac. Not a linux server.

First, enter MySQL

/Applications/MAMP/Library/bin/mysql --host=localhost -uroot -proot


Then, to see what your current default it set to the information_schema db.
USE information_schema;
SELECT * FROM information_schema.engines;

You’ll see something that looks like this:

mysql> SELECT * FROM information_schema.engines;
+--------------------+---------+----------------------------------------------------------------+--------------+------+------------+
| ENGINE | SUPPORT | COMMENT | TRANSACTIONS | XA | SAVEPOINTS |
+--------------------+---------+----------------------------------------------------------------+--------------+------+------------+
| FEDERATED | NO | Federated MySQL storage engine | NULL | NULL | NULL |
| MRG_MYISAM | YES | Collection of identical MyISAM tables | NO | NO | NO |
| MyISAM | YES | MyISAM storage engine | NO | NO | NO |
| BLACKHOLE | YES | /dev/null storage engine (anything you write to it disappears) | NO | NO | NO |
| CSV | YES | CSV storage engine | NO | NO | NO |
| MEMORY | YES | Hash based, stored in memory, useful for temporary tables | NO | NO | NO |
| ARCHIVE | YES | Archive storage engine | NO | NO | NO |
| InnoDB | DEFAULT | Supports transactions, row-level locking, and foreign keys | YES | YES | YES |
| PERFORMANCE_SCHEMA | YES | Performance Schema | NO | NO | NO |
+--------------------+---------+----------------------------------------------------------------+--------------+------+------------+
9 rows in set (0.00 sec)

To change it, use the following:
SET GLOBAL storage_engine = MyISAM;

You won’t be able to see the changes reflected until you ‘exit’ and log back in (and I have no idea why that is) but as far as I can tell that’s just a technicality.

mysql> EXIT
Bye
Elita:~ root# /Applications/MAMP/Library/bin/mysql --host=localhost -uroot -proot
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 204
Server version: 5.5.9 Source distribution
Copyright (c) 2000, 2010, Oracle and/or its affiliates. All rights reserved
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> SELECT * FROM information_schema.engines;
+--------------------+---------+----------------------------------------------------------------+--------------+------+------------+
| ENGINE | SUPPORT | COMMENT | TRANSACTIONS | XA | SAVEPOINTS |
+--------------------+---------+----------------------------------------------------------------+--------------+------+------------+
| FEDERATED | NO | Federated MySQL storage engine | NULL | NULL | NULL |
| MRG_MYISAM | YES | Collection of identical MyISAM tables | NO | NO | NO |
| MyISAM | DEFAULT | MyISAM storage engine | NO | NO | NO |
| BLACKHOLE | YES | /dev/null storage engine (anything you write to it disappears) | NO | NO | NO |
| CSV | YES | CSV storage engine | NO | NO | NO |
| MEMORY | YES | Hash based, stored in memory, useful for temporary tables | NO | NO | NO |
| ARCHIVE | YES | Archive storage engine | NO | NO | NO |
| InnoDB | YES | Supports transactions, row-level locking, and foreign keys | YES | YES | YES |
| PERFORMANCE_SCHEMA | YES | Performance Schema | NO | NO | NO |
+--------------------+---------+----------------------------------------------------------------+--------------+------+------------+
9 rows in set (0.00 sec)

Hope this helps someone else avoid this level of frustration!

Most techs don’t deal well with emotions. The longer I’m in this industry, the more I’m convinced that a lot of us are boarder-line alcoholics because we both don’t know how to deal with our stress levels, and don’t know how to deal with our emotions. (That’s probably true for a lot of professions, but this one I know for sure.) And my eyes are wet. So I’m gonna write it out.

Jay was an amazing mentor when I first hired in. I knew almost nothing about Linux (which is crazy to think about). All I had was customer service, and even that waned when I got so frustrated at not knowing what I needed to know. Jay took very good care of me in those first few months. He talked me through fixing so much, and fed me information as quickly as I could gobble it up. … and he wasn’t even in training yet.

As he and I both worked up through the ranks, and worked together to make this company better than it thought it could be, we started taking trips to get coffee. It was a small thing, but it ended up being one of the defining moments of our weeks: coffee together. We bitched, we problem solved, we discussed, we congratulated.

More than that, though, we supported. If there was a question to which I didn’t have an answer, Jay was my man.

I have been touched by Jay’s kindness, his genuine-ness, and his enthusiasm. Even though he and I do not interact as much as we did when we were in the same building, I am scared that without him in my day-to-day life I will fall short of what I can achieve. Now that he’s moving on to bigger and better things, I’m wondering how many people will fall short because he’s not around as much.

To avoid it negatively affecting people, I am going to hold myself to a higher standard: I will be as kind, genuine, and enthusiastic as Jay has always been to me, to everyone I encounter every day.

<3 you Jay. Let’s coffee soon.

DJ (David James) or deeje.

…okay fine. I may be a bit biased. But he’s still pretty damn cute. Last night was the first night he’s stayed with me. He was awesome, as expected. In November (at ~2 months old) he took his first family road trip with us to Texas. He only fussed the entire time was to tell us something was wrong. Wet, hungry, hot. Other than that he would just hang out, sleep, watch the sky go by, or play with his ma.

Sleepy nephew

He’s 7 months old, and last night was the first time I’d watched him. I haven’t babysat someone who couldn’t almost completely care for themselves since I was a teenager, so I wanted to wait until he wasn’t quite so breakable.

Super breakable.

He was perfect (except for being stubborn about going to sleep, even though he was being rocked to sleep).

Mister "I don't wanna sleep."

HOWEVER, I am the kind of Aunt to not have planned ahead someplace for the most-adorable-nephew-ever to sleep. So what do I do?! IMPROVISE!

BABY IN A BASKET

So adorable.

This morning when my sister and my brother opened the bedroom door to retrieve the nephew my brother’s first question? “…where’s the baby?”

He survived, and continues to be adorable.

Evidence of the continued adorableness

Hopefully next time both his mom and I remember his Pack-n-Play. He’s almost too big for that basket already.

Cake
1 18.25 oz pkg yellow cake mix
1 pkg vanilla pudding mix
4 eggs
1.5 C strawberry mix

for the strawberry mix
1 pkg frozen strawberries, thawed
.75 C water
Put this through the blender

For the glaze:
the rest of the strawberry mix
1C sugar
1/2 tsp vanilla

mix cake ingredients, pour into bundt pan prepped with Pam for baking. Bake at 325 for an hour. While that’s baking, cook the glaze on medium until reduced, the entire hour (gentle boil for the last 5 minutes).

Stab cake repeatedly once out of the oven with a skewer. Spoon on the warm glaze. Enjoy!

7:39:25 PM Ariel: It’s simple, and with no oil, relatively healthy too
7:39:28 PM me: So simple, and so awesome.
7:40:26 PM Ariel: I took a rum cake recipe I had, and just played with it until it worked
7:40:57 PM me: Can you do essentially the same thing with all fruits for the glaze?
7:41:03 PM Ariel: As one of my friends is allergic to alcohol, and as such I had to figure out something to do for her birthday that’d be awesome
7:41:23 PM Ariel: Yep. Normally I use peaches, but you could probably try cherries too, or raspberries
7:42:14 PM me: my mom has a thing for cherries. the boyfriend has a thing for mangos. Both of those came to mind. :D
7:42:42 PM Ariel: *nods* Mango would probably work quite well
7:43:06 PM me: that’s what I’m thinking.
8:15:20 PM Ariel: Apple and pear, probably not. It has to be a more liquidy fruit, although if spiked with apple cider it might work
8:16:11 PM me: That makes sense. I was thinking of replacing the water with mango juice, too, with the mango idea.
8:16:32 PM Ariel: *nods* Yep. Bolthouse farms mango lemonade maybe?
8:16:44 PM me: oooooh, that’s a good idea!
8:16:57 PM Ariel: I could drink that stuff by the gallon :D

This is what our trip will look like (so far).  This week Zeus gets an oil change. And a good deep cleaning.