-- Variables to hold the start and end dates and the difference between them.
DECLARE @Start datetime;
DECLARE @End datetime;
DECLARE @Diff datetime;

-- Set the start and end date then calculates the difference.
SET @Start = '2000-01-01';
SET	@End = GETDATE();
SET @Diff = @End - @Start;

SELECT @Start [StartDate]
,    @End [EndDate]

-- The number of years between the two dates.
,    DATEDIFF(yy, 0, @Diff) [Years]

-- Add the difference in years to the start date to remove years from the result.
,    DATEDIFF(dd, DATEADD(yy, DATEDIFF(yy, 0, @Diff), @Start), @End) [Days]

-- Use of the DATEPART function to break down the remainder of the difference.
,    DATEPART(hour, @Diff) [Hours]
,    DATEPART(minute, @Diff) [Minutes]
,    DATEPART(second, @Diff) [Seconds]
,    DATEPART(ms, @Diff) [Milliseconds];

This then produces the following result.

I hope somebody finds that useful.

• What is the problem?
• So how do I go about fixing it then?
• Add a new user account with admin role
• Log in with new user account and dumb down the admin account
• Secure the admin account to deliberately make it harder for hacking attempts
• That’s all there is to do!

What is the problem?

WordPress prides itself on its 5 minute install allowing you to essentially upload the core files, create a database and then run a script to join the two together. Easy. But secure it isn’t…

A hacker with limited knowledge of WordPress knows that the login screen is generally found at the following path of http://blog.domain/wp-login.php and also that WordPress by default sets up an admin account during the installation stage. You would hope the first thing the user then does is logs in with the auto-generated details and changes the password to something memorable and hard to guess right? You would have thought so.

The problem is most people then rush on creating posts, adding plugins, changing themes and so on because good content equals a good blog that makes people want to come back yet at the same time anybody searching for <meta name="generator" content="WordPress 2.9.1" /> finds (at the time of writing this article) 5,780 results in Google of which many of them could be unprotected admin accounts or with very simple, easy to guess passwords that could be obtained with brute force.

So how do I go about fixing it then?

There is no magic wand process you can use to secure WordPress it all depends on the type of blog you have and how secure you want it. There are many guides already available such as Hardening WordPress from the WordPress codex and many blogs scattered around the internet but the easiest thing you can do is to deactivate the admin account and set up a harder to guess user account with the same permissions as an admin. Sounds so simple! Even if you do nothing else to your WordPress installation may I suggest that you at least do this because it will eliminate any security issues later on.

Add a new user account with admin role

Log in with your admin account and create a new user account by going to Users > Add New and setting up a new account with all your personal details. You are not able to use the same email address twice so you might have to edit your admin account and change the email address to a dummy one such as dumb-admin@blog.domain to free up your email address.

Log in with new user account and dumb down the admin account

Once you have added the account, log out of the admin account and log in with your new user account. Go to
Users > Authors & Users and click on the admin account to edit it. Locate the Role dropdown which is in the Name section and change it to subscriber and then save the changes.

Secure the admin account to deliberately make it harder for hacking attempts

To make it even harder to guess the password I suggest you go to http://www.passwords.org.uk/different-length.php and copy the 14 character generated password from this page and change the password to the admin account which of course you will be able to do with your new-found admin privileges!

That’s all there is to do!

You will now have a much more secure WordPress installation without getting bogged down with security and permissions. This should certainly be enough to get you started. Have fun blogging!

I decided to try out Amazon S3 which allows you to store files in “buckets” located in America and Ireland. Authentication is used to secure your data and it uses standards-based REST and SOAP interfaces to allow developers the ability to hook on to the service. They operate a “Pay For What You Use” pricing model of $0.15 a month per GB hosted which is about £0.09 a month. Currently all data transfer is free until 30th June 2010 but even after then it is only $0.10 a month per GB which is about £0.06 a month. The prices change after 50TB of data is being hosted but that is unlikely at present. If this trial is successful then I intend to roll it out across my other websites.

After I had set my account up I then installed Cockpit which is a GUI written in Java for viewing the contents of an Amazon S3 account. It is part of the JetS3t toolkit and is free so ideal for what I need. I used it to create a bucket called blog.ianroke.co.uk which will contain all the archived files for my website.

Next I converted the command line commands I were using here into scripts so that I could continue to tweak them while they were being scheduled. I created a blog_database_backup.sh and a blog_website_backup.sh script and I also created another script called s3_backup_refresh.sh that would refresh the synchronisation between my server and the Amazon S3 server. I wanted to run the database refresh every 15 minutes and the website refresh every hour so that at every 10 minutes past the hour I could run the synchronisation and be sure of a full and complete backup of the database and website had been done.

I made a few tweaks to the scripts while I was doing this too. I created an archive for the latest refreshed file, I also compressed the output from the database refresh which reduced the file size by 90% and I also archived all the archives into one large archive for each day. This kept the number of files down on the server and also on the Amazon S3 server because once this archive was created I deleted all the files that were put in the archive off my server as they were duplicated.

Here is an example of the sort of script I used. Hopefully the comments are self explanatory.

#!/bin/bash

# Set up some variables.
DATE=`date +"%Y%m%d"`
TIME=`date +"%H%M%S"`
DIR=/path/to/database_schema
FILE=database_schema_${DATE}

cd ${DIR}

# Create a dump of the blog database schema.
mysqldump -uUSER -pPASS DB > ${FILE}${TIME}.sql

# Create an archive of the database schema.
tar cf database_latest.tar ${FILE}${TIME}.sql

# Remove the compressed archive of the latest database schema.
# This avoids any file overwrite errors.
rm database_latest.tar.gz

# Compress the latest database schema.
gzip database_latest.tar

# Checks if a compressed archive has been created for the current day.
if [ -f ${FILE}.tar.gz ]; then
    # Uncompress the archive, add the latest archive created then compress again.
    gunzip ${FILE}.tar.gz
    tar rf ${FILE}.tar ${FILE}${TIME}.sql
    gzip ${FILE}.tar
else
    # Create a new archive and compress it.
    tar cf ${FILE}.tar ${FILE}${TIME}.sql
    gzip ${FILE}.tar
fi

# Remove the created database schema.
rm ${FILE}${TIME}.sql

I then downloaded S3Sync which is a script written in Ruby which provides an interface for me to communicate with my Amazon S3 account using the Shell command line on my server. I can then create scripts and schedule them to run as and when I require them.

# Sample syntax to synchronise data with Amazon S3
ruby s3sync.rb – r /SOMEFILES BUCKETNAME:PREFIX

I had a problem getting the s3sync.rb file to view the settings I had saved in s3config.yml. I had done everything correctly but in the end I only got it to work by making the following change.

#confpath = ["#{ENV['S3CONF']}", "#{ENV['HOME']}/.s3conf", "/etc/s3conf"]
confpath = ["./", "#{ENV['S3CONF']}", "#{ENV['HOME']}/.s3conf", "/etc/s3conf"]

I then needed to write a very simple script to synchronise the directories between my server and the Amazon S3 server which I then scheduled to run at 10 minutes past the hour every hour so that potentially the most amount of data I would loose is up to an hours worth which I can live with in worse case situations. The script I used to sync is below. Note that I used –delete to force S3Sync to do a comparison of the directories with the Amazon S3 version and delete files that are not present on my server anymore. I did this so that if I removed the files it was to be assumed that I have backed them up elsewhere so they are not required on the Amazon S3 server as well.

#!/bin/bash

cd ~/blog_backups/s3sync

ruby s3sync.rb --delete -r /path/to/database_schema blog.ianroke.co.uk:d

ruby s3sync.rb --delete -r /path/to/website_files blog.ianroke.co.uk:w

I hope this helps anybody who wants to do this sort of thing on their server. If you do use my examples then please let me know either by email or in the comments below.

Firebug

https://addons.mozilla.org/en-US/firefox/addon/1843

Firebug is a fantastic tool for web development because it allows you to dive into the code behind a webpage and allows you to very quickly inspect and even edit the code. You can make changes to the CSS on a webpage and see the change happening in real time. This allows you to try out changes before you commit them to a style sheet. If you are struggling with the CSS box model implementation then you can see visually how your margin and padding are represented on the page so you can make changes if required. There are many, many more things Firebug can do so if you are interested then check out the website. If you only ever install one add-on make sure it is this one if you are a webpage developer.

FireShot

https://addons.mozilla.org/en-US/firefox/addon/5648

FireShot allows you to take a picture of the current webpage and process it in a number of different ways including uploading to a another website, saved as it is or sent to an image processing program for further tweaks. This is very useful to produce screenshots of whole web pages for clients to view work in progress. Another add-on that comes highly recommended.

Web Developer toolbar

https://addons.mozilla.org/en-US/firefox/addon/60

The Web Developer toolbar has been around ever since I’ve been using Firefox, and while its usefulness has been overshadowed by Firebug in my opinion, it still packs a lot of really useful features to help you with web development. This comes highly recommended too.

Colorzilla

https://addons.mozilla.org/en-US/firefox/addon/271

Sometimes when you are browsing for inspiration you come across a colour that you would like to use. This add-on allows you to simply pick the colour as you would in a paint program and then utilise it in your own creations.

Delicious Bookmarks

https://addons.mozilla.org/en-US/firefox/addon/3615

If you have an account set up with Delicious like I have then you will agree with me when I say it is a very useful website for saving web pages to come back to later. You can tag pages and then sort by a specific tag which is extremely useful. This add-on makes it even easier to tag web pages and retrieve your bookmarks. There is also a toolbar added to Firefox with the option of seeing your bookmarks in a variety of different ways. Fantastic!

DownThemAll

https://addons.mozilla.org/en-US/firefox/addon/201

DownThemAll turns the already good download capabilities of Firefox into something even better. You can download single links to a designated folder with just one right-click, download multiple links/files off one page with the ability to filter out by customisable criteria and once the files are in the download manager you are able to specify when you want to download them and when you do download them it opens multiple connections so the only limit is your download speed not the speed of the network or web server which is worth the install alone. Comes highly recommended!

I hope those add-ons have wet your appetite for ways to make your life easier in Firefox. I have not touched the surface of what is available out there. What have you got in your arsenal that you can not live without? Please post your top tips in the comments.

These processes are:

1. Starting up a project
2. Initiating a project
3. Directing a project
4. Controlling a stage
5. Managing stage boundaries
6. Closing a project
7. Managing product delivery

Advantages of PRINCE2

PRINCE2 is a structured way to approach project management by the use of a framework that is in use all over the world. PRINCE2 describes best practices in how to coordinate people and their activities, how to design and supervise projects and how to realign projects that are starting to slip. Because PRINCE2 is fully scalable it means that the methodology can be used in multi million contracts and also very small and simple projects.

From a business perspective PRINCE2 provides a common and consistent approach with a controlled, organised start, middle and end with regular reviews of progress against the original project plan. There are also flexible decision points within the project with full management control of any deviations from the original plan. There is a good communication structure with the involvement of management and stakeholders at the correct times during the project and a means of capturing and sharing the lessons learned.

Disadvantages of PRINCE2

There is a lot of paperwork and documentation involved as would be required for large scale projects but they wouldn’t necessarily be useful or important in smaller scale projects. Also because various roles and responsibilities are involved there could also be a blame culture because everybody would blame everybody else if the project failed. As with most methodologies there is also the danger that it is too closely followed in a rigid way and not think about how it can be adapted to any particular project.

So why did I choose it?

I enjoy managing projects and expectations but felt I didn’t have the skills or understanding required to do it well. I had heard of PRINCE2 and PMP but when I investigated them further I found that PRINCE2 is more widely accepted in the UK. I am now able to apply the principles and processes of the methodology in my projects and as a result I have been able to complete more projects within the agreed time scales and without going over budget. I have also been able to take on more projects at any one time because I have a structured process that I can follow and tailor for each type of project to ensure that communication between sponsors and team members is maintained throughout the project lifecycle.

I am interested in what experiences you have with PRINCE2 or any other project methodology and how you found your experiences were with it compared to before you were certified. Please add your comments below.

My blog is hosted on a shared Unix server so the first thing I did was look in my server control panel which is cPanel at what was available in the way of backups. Backups of various shapes and sizes were available but I wanted a bit more control on what was backed up and when so I turned to SuperUser.com and asked the question ‘How do I compress a directory on a Unix web server and email it on a sheduled basis?’ and got an interesting response from Chealion which involved the use of Tar and Crontab to zip up an archive on a scheduled basis. This is more like it!

I then decided that I wanted to backup just my blog files including my uploaded content such as images and also make a backup of the MySQL database my blog is using so that I can remove them to another location offline. I can always extend this further if I need to in the future but this would allow me to get my blog back online very quickly.

Creating the folder structure

I wanted to keep the database backup schema separate from the blog website files so I created the following structure on my web server. I didn’t need anything more than this because I intend to suffix the date and time to the filename.

Backing up the files

Compressing files using Tar is very simple. I just want to zip up all the files in my blog directory and save it with the date/time suffixed. The code below will give a filename of something like ‘blog_backups_website_files_YYYYmmddHHMMSS.tgz’.

tar czf "/path/to/blog_backups/website_files/blog_backups_website_files_`date +%Y%m%d%H%M%S`.tgz" /path/to/ianroke.co.uk/blog

Backing up the database

Backing up in MySQL is done with mysqldump which is a bit trickier to configure. I have to pass the username, password and the database name then give it somewhere to dump the output to. The code below gives you an idea of what is required. This bit was tricky because the database was automatically generated by cPanel so finding out the generated details was required first.

mysqldump -uUSERNAME -pPASSWORD DATABASE > "/path/to/blog_backups/database_schema/blog_backup_database_schema_`date +%Y%m%d%H%M%S`.sql"

Scheduling it to run periodically

Luckily cPanel has a cron section so I was able to quickly set up these tasks. For the purpose of testing it I wanted to set them to run every minute so I set it as such:

After committing changes I waited and nothing happened. Strange. I fired up my email to find that I was getting the following issue. After escaping the % characters and moving the quote marks it worked.

Great! Now what?

Now I have got it working I now need to decide how often I need to run backups. Cron has a great idea where you can specify every X so */2 means every X that is divisible by 2 so for example hours 2, 4, 6, 8, 10 and so on. I think for now I will put the website files at */6 which means every six hours it will backup all the files which is more than enough for the busiest of blogs and for the database backup I will put it at */2 so every two hours to make sure that I get all updates, comments, pings, trackbacks, etc. If there was a catastrophic failure then to loose 2 hours of database activity is not the end of the world in the grand scheme of things.

Next steps?

I would like to automate the process of moving the backup files to an offsite backup solution so I am not relying on logging in and moving the files myself. Has anybody had any experience of this? Could you post in the comments any ideas you might have? Cheers.

Next I loaded up Microsoft Project 2010 and entered the high level task I am going to use which in this case is the ‘Starting up a project’ stage.

Next I want to add a subtask which will be the start of my list of activities assigned to the ‘Starting up a project’ task.

To make this task a subtask of the line above click on the icon on the ribbon. I then added the other activities in the same way.

Now I have added my activities as subtasks I can now start to assign durations to them. These can obviously be changed but for now the typical rule is whatever you estimate then 100%.

You can see that it has underlined the Finish date of the task because I have subtasks that require more time. Some of the subtasks are done in a specific order so I am now going to add the number of the preceding task in the Predecessors cell which will move the tasks around on the Gantt chart.

I could also add resources and so on but I will leave it there for a simple introduction to adding tasks and subtasks to a project file in Project 2010. You will see that it has moved the entries around but the Finish date of the original task is still the same as before. You could enter in a new date or click on the task and click on the Auto Schedule button on the ribbon or use Ctrl + Shift + A on the keyboard. Now we can see that our project stage is due to end on 24/12/2009.

I hope that interests somebody. Entering new tasks and subtasks in Project 2010 seems a little more intuitive than with previous versions but only time will tell.

Recently Microsoft announced on their Project Team blog that the public beta of Project 2010 was available for download. They have also produced a website where they call this version of Project the most significant release in a decade.

I have downloaded the public beta to play around with and I will be blogging more on what I find out. In the mean time Microsoft have posted a large number of videos on their YouTube channel which you might find interesting or check out their videos on Project 2010 below.

Project Professional 2010 Overview

What Partners Like about Microsoft Project 2010

Project Server 2003 to Project Server 2007 Migration Best Practices

More videos are available on the video showcase section of their website.

A short while ago I went to log in to my old blog to find that I couldn’t. After more investigation I found the database was corrupted so a fresh install was required.

I am not too upset by this because I let my old blog slip a bit but this time round things will be different. No really they will.

I hope you stick with me because I have a few interesting posts lined up. Save my RSS feed in your favourite news reader and it will be updated soon.

Cheers, Ian.