RobPickering.com

Configure SSH2 Access for Updating WordPress

Rob Pickering — Thu, 03 May 2012 14:36:53 +0000

WordPress is one of the most popular blogging platforms on the Internet. One of the first things I do when I setup a new WordPress installation is harden it. You can read about a number of my suggestions in the article Secure Your WordPress Installation. However, one of the more complex activities I undertake is securing the upgrade facility so that it uses SSH for handling all of my site’s updates.

This is for Ubuntu 10.04 LTS:

Create a “wordpress” user that will be used to manage your site.

% sudo adduser wordpress

Add the following lines to your wp-config.php, I usually put mine right after the Language definition:

/**
 * Define Upgrade FTP Usernames and Passwords
*/
define('FTP_BASE', '/usr/local/sites/mysite/wordpress/');
define('FTP_CONTENT_DIR', '/usr/local/sites/mysite/wordpress/wp-content/')
;
define('FTP_PLUGIN_DIR ', '/usr/local/sites/mysite/wordpress/wp-content/plugins/');
define('FTP_PUBKEY', '/home/wordpress/.ssh/id_rsa.pub');
define('FTP_PRIKEY', '/home/wordpress/.ssh/id_rsa');
define('FTP_USER', 'wordpress');
define('FTP_PASS', '');
define('FTP_HOST', 'localhost');

Edit each of the variables for your installation.

Create an SSH public/private key pair for your wordpress user:

% sudo su - wordpress
% ssh-keygen

When prompted to enter a password, just hit return to create the private key without a password.

Add the public key to wordpress’ authorized_keys file:

% cp .ssh/id_rsa.pub .ssh/authorized_keys
% exit

Set permissions on the private key so Apache/WordPress can access it:

% sudo chgrp www-data /home/wordpress/.ssh
% sudo chmod 750 /home/wordpress/.ssh
% sudo chown www-data /home/wordpress/.ssh/id_rsa

Install php SSH2 libraries:

sudo apt-get install php5-dev
sudo apt-get install libssh2-1-dev
sudo apt-get install libssh2-php

Test to ensure PHP sees the new SSH2 library:

% php -m | grep ssh2

It should output “ssh2″

Restart Apache so it pulls in the new PHP libraries:

% sudo service apache2 restart

Now access your Plugins page, and when you add, update, or delete a plugin you should see a screen like this:

WordPress SSH Connection Information

You should only see this screen the first time you use this configuration. Select “SSH2″ from the Radio Buttons and “Proceed”.

You will now be using SSH access to/from your server to handle all updates.

iCloud setup with different iTunes and MobileMe Accounts

Rob Pickering — Sat, 15 Oct 2011 14:33:47 +0000

iCloud debuted Tuesday for all iOS 5.0 devices. On Friday, the iPhone 4S was released. You’d think that would be a banner week for us. However, there is disharmony afoot in our Apple-land.

The Issue

In 2001, iTunes was released. I quickly setup an iTunes account using my personal email address.
In 2002, .Mac was released. I quickly setup an account with a free email @mac.com.
In 2008, .Mac was renamed to MobileMe and my @mac.com account got a new domain and I now also had an @me.com address.

For 10 years, that hasn’t caused me a problem. I have purchased an amazing amount of content via iTunes: Music, Videos, Television Programs, Movies, Applications, and most recently, Books. I have synchronized all of my Contacts, Calendars, Notes, Mail Accounts, Bookmarks, Preferences, Keychains, and enabled “Find My iPhone” using my .Mac (later MobileMe) account.

I upgraded my MobileMe account to a Family Pack and included my wife, mother, father, and our au pair so they could reap the benefits of device synchronization.

My wife and I converged our iTunes accounts (basically re-buying everything she had purchased in her account) and we now both purchase and use the same account so we both can use the same content. I’m guessing most families do this.

When you first open your iPhone after installing iOS 5.0, you’ll see a screen like this, you’ll want to use iCloud.

iCloud is designed to be your Cloud synchronization service. The question of course is, “What do you want to synchronize?” Most folks will want to do the following:

Synchronize Contacts, Calendars, Reminders, Bookmarks, and Notes
Have a personal Photo Stream
Have a set of personal Documents and Data
Utilize iMesssage between family members (and others)
Utilize FaceTime between family members (and others)
Have a shared iTunes account for Music, Movies, Television, Books, and Applications

So, how do you do that? Easy really, this is Apple. Trust the iOS.

iCloud Login

When you see this panel, just sign it with your MobileMe account. If you don’t have a previous MobileMe account, then create a new one on this panel and sign it with that. Forget your iTunes account for the moment.

When you’ve completed the setup, you’ll have an iCloud account (providing you also did the conversion to iCloud from the MobileMe website). That account will control all of your personal data and keep it synchronized with all other iOS devices or OSX computers where you’ve enabled that same iCloud account.

What about iTunes?

If you restored your iPhone from a previous backup, then you’ll find your iTunes account is already setup and working. Apple maintained that setting, separate from the iCloud account. So, you can still share all of your iTunes purchased content with your family using that ID.

To verify that setting, go to Settings -> Store and verify the Apple ID at the bottom of the screen is your shared iTunes account. If it’s not, you can tap it, Sign Out, and sign in with the correct one.

You’ll then want to set Automatic Downloads for Music, Apps, and Books to match your preferences. If you have them enabled, then any of that content purchased with your iTunes account will be automatically downloaded to the device.

Finally, you will probably want to setup / check the settings for Messages and FaceTime (both should probably be your iCloud ID) and Music -> Home Sharing (your shared iTunes account).

You will now be in Apple synchronization and iCloud heaven.

Goodbye Steve and Thank You

Rob Pickering — Fri, 07 Oct 2011 13:43:31 +0000

Here’s to the crazy ones.

The misfits. The rebels. The troublemakers.
The round pegs in the square holes.
The ones who see things differently.
They’re not fond of rules.
And they have no respect for the status quo.

You can quote them, disagree with them, glorify or vilify them.
About the only thing you can’t do is ignore them.
Because they change things.
They push the human race forward.

While some may see them as the crazy ones.
We see genius.

Because the people who are crazy enough to think they can change the world,
are the ones who do.

– Steve Jobs, The Crazy Ones

It’s 7:00 a.m. in the morning, EST. My wife is taking our 6 month-old son to the Hospital for an Echocardiagram to see if the hole in his heart is shrinking, we pray so (and it is). She just called to tell me that Steve Jobs had passed away. That news hit me like a ton of bricks. She says to me, as she’s pulling into the hospital parking lot, “I just thought you would want to know.” She knows me so well.

I’m an Apple “Fan Boy”. I’ve been one since 1984. Growing up as a kid in the 80s I had lots of opportunities to join the “computer revolution”. There was the TI-99/4A, which was the first computer my parents purchased for me. There was the Atari ST, the Amiga 1000, and of course the IBM PC.

I really didn’t like my little Texas Intruments computer. I wrote some basic programs, they ran. It didn’t excite me. I played some text-based games. They didn’t capture my imagination. I quickly got bored with the system and it started collecting dust. My parents could see that I had an interest in computers, but I wasn’t satisfied with what was available.

Then one day I saw the advertisement for the Macintosh (the original 128K). It was georgous. It had a mouse. The display was built into the computer as a single unit. It was graphical.

I fell in love.

If you can fall in love with a computer, then I’m guilty of doing it over and over, all with Macintoshes. That day in 1984 when I saw the advertisement, I took it to my parents and I said “There, that’s the future of computing, that’s what I want.”

My feeling about the Macintosh was visceral, it was emotional. I knew in my gut that the computer displayed in front of me, all 9″, 512×342, black and white display of it, would change my life.

And it did…

Looking back on my life, I can see it reflected in Apple products. Many of those products designed and marketed by Steve Jobs. I have had an Apple product in my life, every day, since 1984. Those products have been with me at the best and worst times I’ve experienced. Thinking backwards through time to each of the Macintosh (and Apple) products, I can reflect on times long forgotten until now.

1984, Macintosh 128K, the year I started High School. My family purchased an original Macintosh 128K in 1984. I was 14 years old. It came with MacWrite and MacPaint and I couldn’t believe my luck to have it. This year was different, and not just because of the Macintosh, you see, we didn’t move. This was my 9th school and I was starting the 9th grade. For the first time in a long time, I got to stay with my friends as we went to a new school. I immediately began using my new computer to write documents for school and create graphics on the screen. My family purchased an ImageWriter dot-matrix printer so I could print out my creations. I ended up taking Typewriting in high school my Freshman year (1984). By the end of the year I was typing 60 words per minute and I never turned in another handwritten report again. Innovations: Graphical User Interface, Mouse, 3.5″ Floppy Drive with Auto Eject, software for “Publishing” that came with the computer (MacWrite and MacPaint).

1985, Steve Jobs leaves Apple Computer to found NeXT. NeXT Computer is to have a profound impact on my life as well.

1988, Macintosh Plus, the year I started college. My parents purchased this computer as a present for my graduation from High School, to take to college at Miami University. I used it to earn money as a Freshman, typing papers for $1 / page. I had the only Macintosh on my floor, there was one other Apple IIc, and a few IBM PCs. Innovations: first computer to have an external SCSI port, which launched a plethora of external devices and created a “standard interface” for expanding the system; first Macintosh to use SIMM (Single Inline Memory Module) RAM.

1989, Macintosh SE/30, the year I switched my major from Manufacturing Engineering to Systems Analysis. While in college I got a job working in the School of Applied Science. The main reason I was hired is that there were a few Macintosh computers in the School and no one on the computing staff knew the platform. I did, so I got hired to help provide support. That money allowed me to purchase a Macintosh SE/30 my Sophomore year. Believe it or not, I used to use a “backpack” to haul that computer from my dorm room to meetings of the Miami Computer Users Group, which I helped found and served as Treasurer. My favorite game on the SE/30 was Shufflepuck Cafe. This was the last Macintosh, influenced by Steve Jobs, to be released for the next 5 years. The next Macintoshes will all look like their PC competition, embracing the “pizza box” type designs. Innovations: first Macintosh (the SE, which stood for “System Expansion”) to be able to have an Ethernet card.

1990, As a Systems Analysis major, I was able to get a job my Sophomore year in the computer labs. Most of the computers in the lab are terminals to our IBM Mainframe and our DEC VAX (running VMS). However, tucked over in the corner are 8 gleaming, black, magnesium NeXTcube workstations. These run BSD Unix and I quickly find myself spending hours and hours working on these systems and learning the NeXTSTEP operating system. These systems led to my passion around the Unix operating system and gave me the skill sets that I still use today.

1991, Macintosh IIcx, the first year living in my own apartment. My Junior year in College, I was really getting jealous of those Amiga and Atari ST people and their colorful graphics. So, I went out on a limb and purchased this computer. This was my first color capable computer and it was great! This was also the first computer I had owned with a separate monitor. Innovations: First computer case able to be modified (adding cards, replacing drives) without tools or screws, first to be able to be oriented in either a horizontal or vertical position.

1993, Powerbook 180c, the first year of my Masters program and my first laptop. My friends began to migrate away from the Atari ST platform in favor of the Macintosh (after running a Macintosh emulator on them just to play Shufflepuck Cafe). I was so happy each time one of them purchased a Macintosh, it brought us closer together as a group. My fondest memory of that time was when one of my close friends, Peter Murray, abandoned his IBM PC and purchased a Macintosh. We all looked at him and said, “Well, it’s about time”. Innovations: Palm-rest built into the keyboard with a trackball as a pointer. Try to find a laptop these days that doesn’t have the keyboard up near the top with an area for your palms to rest, now thank Apple.

1994, Macintosh Quadra 660av. This computer was special because we were still using dial-up modems to access computer networks at the University. The AV in this Macintosh referred to the Digital Audio Video (DAV) port that enabled one special product, the GeoPort Telecom Adapter. That little “pod” became my modem and I used it to have my Macintosh be our telephone answering machine at the house. I bought this computer because Apple had announced their move to PowerPC technology and while it came with a 68040 processor, we were promised an upgrade to the PowerPC. That upgrade never materialized for the “AV” model, as the upgrade card made available for the non-AV model Quadra systems conflicted with the DAV port. This was one of the few times I was furious with decisions Apple made, I felt betrayed and that I had been lied to by Apple with regards to the upgradability of this system. Innovations: video in and out made possible by the Digital Audio Video port.

1994, 10 Years after Apple announced the Macintosh, I was still a “Fan Boy”. So much so, that I even purchased my first non-Macintosh (non-printer) from Apple: the Newton MessagePad. Over the next few years I upgraded my Newton from the original, to the 110, and then to the 2100. It was my first Personal Digital Assistant (PDA) and I knew electronic organization was how I wanted to work and that it would further define me as a “Geek”. We’re still waiting for good handwriting recognition and with all of its flaws, I would say the Newton is still the best we’ve seen. This is also the year that John Scully leaves Apple Computer, to be replaced by Gil Amelio for the next 500 days.

I look back at this point and see that in 10 years of Macintosh, I’ve owned 7 different systems. One new system every 18 months or so. It helped over the last 6 years that I had a student discount on Apple hardware. Innovation was happening rapidly at this point in time. The Internet was beginning to explode. I was in the thick of things and I was about to get absorbed.

1995, Power Macintosh 6100/66 DOS Compatible. This was the year I was recruited to work at Cincinnati Bell Telephone developing Fuse Internet Access. My first “real job” outside of the University. I made having a Macintosh on my desk a contingency of my employment and they agreed (something I did quite often in my future positions). I was the first Macintosh user at Cincinnati Bell. This computer was purchased so I could have both Macintosh and Windows running side-by-side and provide me the most compatibility possible. Innovations: First computer to use the PowerPC RISC architecture, also two computers in one, two CPUs, two RAM banks, etc.

1995, Powerbook 5300CE/117. My second Macintosh laptop, I purchased this computer shortly after starting at Cincinnati Bell. My first PowerPC-powered Macintosh laptop. This system was ill-fated from Apple and many people reported multiple problems. Me? I actually never had an issue and when I found this system in my belongings 10 years later, the system still booted, the display still worked, and I sold it on eBay. Innovations: First line of portables to use the PowerPC processor, first to have an expansion bay (I had a Zip drive in mine), and a color Active-Matrix LCD screen.

1996, Powerbook Duo 2300c and the Duo Dock. This little combination, in my opinion, is one of the best ideas Apple ever realized. The Duo Dock was basically a huge laptop dock, with a monitor stand built over it. You’d insert the Duo into the dock and it would electronically pull it into the dock and latch it in place. The Dock could also have a separate 3.5″ Hard Disk drive installed and the computer could boot from either the internal or the “external” drives. You’d then push an Eject button on the dock and it would spit out the Duo. I loved this system, but ultimately, the Duo screen was too small for practical use. Innovation: An electronic docking station allowing use of the laptop as a full-blown desktop system.

1997, Power Macintosh 7300/180. This was the year all of my friends were on Macintoshes. They came from a variety of platforms, but by 1997, they were all Macintosh people. Innovation: “Outrigger” case design allowing for ease of maintenance.

Following this purchase came a light shining down on the Macintosh and Apple, Steve Jobs. On July 9th, 1997, Gil Amilio stepped down, and Steve Jobs stepped up. Steve immediately made several changes at Apple, the most notable being a call to end the failed Mac OS licensing to clone manufacturers, discontinuing the Newton (a pet project of John Scully), and then releasing the PowerMac G3 line of computers. He also rebranded the Macintosh to just “Mac”.

2000, Blueberry iMac G3 (sold 2001). Released on my birthday in 1998, the iMac ushered in a new era at Apple: Color. I purchased mine shortly after purchasing my first home, I can still see it sitting in my office by the window. I had been down on Apple for a couple of years, even flirting with abandoning the platform all-together, but this computer got me excited again. The iMac became the world’s best-selling single computer. Something Apple got a taste of, and didn’t look back. This was also the year that Apple unveiled Mac OSX in a Public Beta, the OS was based on NeXTSTEP, an OS with which I was very familiar. Innovations: All-in-One Computer, Slot-Loading CD-ROM Drive, and the end of the floppy drive.

2001, 667MHz 17″ PowerBook G4 “TiBook”. This was a tough year for me personally and professionally. I broke up with my girlfriend of several years, met someone new and had my heart broken, multiple times, by her. I ruptured a disc in my back, sold my house, lost my job, moved into an apartment, in that order. I wasn’t happy, but the highlight of my time was my “TiBook”. I also purchased my first iPod. Innovations: 1″ “thin”, revolutionizing laptop form factors and made out of Titanium.

2003, 1GHz 17″ PowerBook G4 “AlBook”. An upgrade to my previous TiBook, the old one having been sold to my mother. This year saw me finding a new job, re-establishing myself in a very different career (Director of Marketing), and traveling every other week to Chicago for work. I had no friends at the office and felt very isolated from everyone around me, I hated my job. In May, I lost my job again, but was able to turn around and find another immediately, at a significant pay cut. I was basically at rock bottom. However, I also met my first wife and things seemed to be turning around for me, as we got engaged later this year. I bought my second house and moved into it. Innovations: First PowerBook to have a DVD burning solution (SuperDrive), possibly the first laptop to burn DVDs period.

2004, 1.5GHz 15″ PowerBook G4 “AlBook”. I didn’t have this system that long. Lost it in the divorce after my 1 year marriage. I only miss the PowerBook, and my Great Dane. Otherwise, this was a life-changing event for me and led me to the love of my life.

2005, 1.42 GHz Mac mini. Purchased as a home computer this system became a home server. I loved the new “Bring Your Own Keyboard and Mouse” aspect of the mini. Then, on June 6th, Steve Jobs made one of the most significant announcements of his career: Apple would be migrating away from the Motorola PowerPC architecture and all future Macintoshes would run on Intel processors. I remember calling my parents, “Sell all of your Apple stock, get out!” I yelled. I couldn’t believe that Steve Jobs was eliminating one of the clear differentiators of the Macintosh platform. How could he abandon Motorola? Of course, he was right, and it was a move that would create a period of prosperity in the Macintosh line that had never been seen before. I learned then, “Never bet against Steve”. No longer would you have to “emulate” an Intel chip, now you would be able to binary compatible. Innovation: One of the, if not the, smallest desktop computers on the market. This little 2″ thick, 6.2″ square desktop system packed a SuperDrive, USB Ports, Firewire, Bluetooth, Wireless, Ethernet, and Video out.

2006, 17-inch Early 2006 MacBook Pro. This year saw me moving forward with my career again. I took the job I still hold today and again made a Macintosh a contingency of my employment. The result was this system which I held for 3 years. Innovation: The first MacBook Pro, meaning the first Macintosh laptop to run on Intel processors.

June 28, 2007, 6:00 p.m., The iPhone, I woke up at 5:00 a.m. in the morning and drove to the Kenwood Towne Centre to stand in-line to get the iPhone, I had taken the day off from work. I was the 22nd person in line. I stood in that line the entire day, because, since I had seen the original Macintosh, I hadn’t been this excited about an Apple product in my life. I knew it would be revolutionary and I wanted to be a part of it. I was interviewed by a local news station. I saw lots and lots of people I knew, we all shared a common understanding that we were part of something special. When my turn came, I got to high-5 Apple Store Employees, I was cheered and celebrated as I went to the counter, in the back of the store, to purchase my iPhone. It was everything Apple has ever meant to me, and I would have paid them double for the privilege of purchasing that device. If you’ve never owned an Apple product, you cannot understand. If you do, then, well, you understand. Since this time, I’ve had every iPhone model released (iPhone 3, iPhone 3G, iPhone 4, (just ordered my iPhone 4S). They are all better than the previous version, but that original iPhone still has a special place in my heart. This is the first picture ever taken of my son, it was taken on an iPhone 4.

2007, Late 2007 2.2 GHz Macbook. This was also the year I met my future wife. Shortly after meeting me and seeing my passion for Apple products, Deb purchased her first Macintosh, a white MacBook. So, technically, it wasn’t mine, yet it is another fond Apple memory associated with a life event.

2007, mid-2007 2.0 GHz Mac mini. Rounding out the year, I upgraded the Mac mini from PowerPC to Intel. This system went well with my new Apple TV though the Apple TV was a bit of a disappointment (at least until next year).

2008, iPhone 3G. Deb and I were married on 08/08/08. There were no major computer purchases that occurred this year. Deb converted to the iPhone 3G and I upgraded my original iPhone to the iPhone 3G as well. I had rolled out iPhones at the office as an officially supported phone and that spelled the end of Blackberry at our company. iPhones today outnumber Blackberries 3:1 in our company. Additionally, I upgraded the Apple TV to the new 160GB version (which I still have) shortly after Steve Jobs announced the new “Take Two” software upgrades. The combination of 160GB of content and being able to purchase that content directly from the Apple TV is what enabled Deb and I to “cut the cord”.

2009, Early 2009 Mac mini. Deb and I had decided to “cut the cord” in late 2008, we cancelled the cable television service and we did not have satellite. We had embarked on a full year of watching television and movies solely via the Internet (XBox 360 for Netflix, AppleTV for everything else). I used our new-found wealth as an excuse to upgrade the Mac mini again and it continued to be the center piece of our entertainment network along with our Apple TV. That experiment actually worked, as we saved enough money to purchase both this new Mac mini and the upgraded Apple TV in the prior year.

2009, 17-inch Early 2009 MacBook Pro. Our company is on a 3-year refresh cycle and as such I got a new Macintosh in 2009, holding my previous system for 3 years. Both Deb and I upgraded to the iPhone 3GS. Innovation: the first Unibody construction laptop. The entire “base” unit was milled from a single block of aluminum.

2010, Apple TV 2. We ended our “cut the cord” in mid-2009 when it was clear that we missed some of the benefits of broadcast television, specifically News and live Sports. Both Deb and I also upgraded to the iPhone 4.

2011, Late 2010 13-inch 2.13 GHz MacBook Air. This was Deb’s computer, she upgraded her aging MacBook to the new MacBook Air (2 months before the mid-2011 MacBook Airs were released) this year. We will both also upgrade to to the iPhone 4S that was just announced last week. In a pretty significant change for me, I’m moving to Verizon with my service.

2012, ???, I don’t know what my next machine will be, but I can guarantee it will be a Macintosh. I’m also looking forward to what Steve did with the iPhone 5, because it will probably be the last iPhone that he helped to design.

Not covered elsewhere in this article are a plethora of other Apple devices I’ve had over the years. I still own a Bondai Blue Clamshell iBook and a Macintosh G4 Cube. I’ve had iPod Shuffles (both kinds) and iPod nanos, but not a Touch. Two original iPads (one 3G, one WiFi), and two iPad 2s (one 3G, one WiFi). An AirPort Extreme Base station and two different Time Capsules. Magic mice, wireless keyboards, and a Magic trackpad. I have read the words, “Designed by Apple in California” more times than I can remember, and every time I read that phrase, I knew I was going to be pleased.

Rest in peace, Steve. You will be remembered and missed.

Here are some other goodbyes to Steve Jobs from around the Internet:

Here are some powerful examples of Steve Jobs in action:

Secure your WordPress Installation

Rob Pickering — Wed, 18 May 2011 01:00:22 +0000

WordPress is an extremely popular web platform with about 7% of all websites running WordPress. That large a population means that attackers have a rich environment to exploit your installation. There have been historical attacks and worms written specifically to target WordPress. Even highly visible bloggers weren’t immune to the attacks. However, there are some simple actions you can take to ensure your WordPress installation is as safe as possible.

Backups

I shouldn’t have to say this, but if you are not creating backups of your WordPress site, then you will eventually lose it. This isn’t me being melodramatic. It’s a fact. Something will occur and you’ll find that you cannot recover or repair the damage to your installation and without backups you’ll lose all of your hard work. When looking for a backup solution you need to consider several points:

Does the solution backup configuration files in addition to your database?
Does the solution offer the ability to store your backups off site?
Does the solution allow for backing up non-WordPress database tables? This is important if you’ve installed services beyond WordPress (like Mint)

So, if you are not backing up your WordPress installation here are a few solutions.

BackupBuddy – I’ve used several backup solutions for WordPress and I believe that BackupBuddy is one of, if not the, best. Other than a small problem where the license always looks invalid when your site is running SSL, it works great. The only drawback is that scheduled backups will only run if someone visits your site. $45 for 2 sites.
VaultPress – I’ve used this one too, but was not impressed when it came to actually recovering an installation. However, they are new and I’m sure will improve. They almost have to, as this is a service from Automatic the same people that power WordPress.com and wrote Akismet. The most impressive part of VaultPress is that it is running constantly and does incremental backups on files as they change in your installation. $15 / month for the basic backup solution.
Automatic WordPress Backup – I used this for a period of time, but eventually stopped, don’t really remember why. It requires that you use Amazon S3 for storage, which is actually a good idea (BackupBuddy supports S3 and RackSpace Cloud Storage too) to have offsite backups. This plugin is free.

Now that you have safe, secure, backups, what else can you do?

Basic Security

Basic security principles always apply. Your WordPress installation is primarily secured in one way: a password. The admin password is the gateway to all of your content and capabilities in WordPress. A secure password is paramount to having a secure installation, so be sure to select a strong password.

Upgrades

Upgrades are probably the single most important aspect of running a secure WordPress installation. You need to make sure you are keeping your base WordPress installation up to date and that all of your Plugins are at the most recent level. The main reason that authors post updates is to correct bugs. Bugs are the main way that attackers are able to exploit websites and WordPress is no different. If an attacker is going to be successful at breaching your installation, it will most likely be through the WordPress Core or through a Plugin. Keep everything current.

Configuration

The configuration of your WordPress installation is probably the next most significant security step you can take. The official WordPress Codex on Hardening WordPress discusses several good security measures you can take. There is lots of good advice in that article, however, that advice is confined to a 7 steps:

Upgrade when available
Backup the site and the database
Verify permissions on key files
Secure key files (like wp-admin and wp-config) separately from the rest of your site
Run SSL for Administration
Obscure your site’s settings
Logging and Monitoring

I’ll talk about several of these areas and how I apply them to my site in a bit.

Plugins

Plugins are a double-edged sword. On the one hand, they are easy to install, easy to maintain, and would seem to make maintaining the security of your blog easy; on the other hand, they are written by other people, and thus you are revealing the inner workings of your site to a piece of software, that itself could pose a security threat.

That said, I use several Plugins on my blog to assist me with understanding what are potential areas of improvement I could make. Those are:

Akismet: Block spam comments.
Block Bad Queries (BBQ): This is actually now 5G Firewall, but I still have the original loaded.
Conditional CAPTCHA for WordPress: Another way to help block spam from your site.
Exploit Scanner: A manual scan process that will determine if there are exploits that have been installed within your site (does give LOTs of false positives).
Secure WordPress: Takes corrective action for several common issues, user selectable.
WordPress File Monitor: Monitors and emails you on all changes to files on your blog, this one is HIGHLY recommended.
WordPress Ultimate Security: Assigns you a “Grade” for various areas of your security (I get 81 of 97).
WP Security Scan: Checks for several common issues with WordPress security (table prefix, WP version hiding, DB errors off, ID META tag removed, admin user changed, .htaccess file for wp-admin).

What I Do…

My personal blog, the one you’re reading, employs all of the advice in Hardening WordPress.

I secure my wp-admin area using a .htaccess file that locks it down by IP address, that looks like:

order deny,allow
allow from 123.45.67.89/24
allow from mydomain.com
deny from all

I use the above plugins to evaluate the security on my site and provide me information of areas I can improve.

Finally, I utilize a strong password, unique to only my blog.

Additional Resources

There is a great article, I believe, at Smashing Magazine that outlines 10 Useful WordPress Security Tweaks, I took several of these points and put them to use on my site.

13 Steps to a Better WordPress Install, most help you protect key files on your site, per the instructions in the WordPress Codex.

35 Security Plugins, of which I use 5, see above.

Conclusion

Securing WordPress effectively may seem like a daunting task. Take things one step at a time and begin layering each of your techniques on top of one another. Make changes slowly, so you can ensure that everything is working properly before taking the next step.

Drop me a line in the Comments if you have any questions.

B&N NOOK Color – Your $250 Android Tablet

Rob Pickering — Sat, 09 Apr 2011 15:33:12 +0000

This article is about the NOOK Color and how to convert it from a stock device, make modifications to enable additional features, and finally convert it into a full-blown Android tablet (running either Android 2.3 (Gingerbread) or Android 3.0 (Honeycomb)).

The other day I was lamenting to my best friend how I really wanted to try out Android, but I wasn’t willing to pay $400-$800 to get an unlocked Android phone, nor was I willing to commit to a contract with any of the phone carriers. I already pay AT&T too much money for my iPhone!

I started looking around for something decently powered, that would also run Android. That’s when I stumbled upon the Barnes & Noble NOOK Color. Out of the box, this unit runs Android, but a horribly crippled version of Android that will not allow you to load applications, change many settings, or even fully utilize the hardware that ships with the unit. However, that’s to be expected when you’re buying an eReader. It’s supposed to read books and the NOOK Color does that just fine.

Stock NOOK Color

The stock NOOK Color is just as you’d buy at a Barnes & Noble store. Out of the box, Barnes & Noble lists many features, all of which are appealing enough to justify the purchase of the device.

Physical Specifications:

Height: 8.1 inches
Width: 5.0 inches
Depth: 0.48 inches
Weight: 15.8 ounces
Wi-Fi (802.11 b/g/n)
8GB Internal Storage
microSD Card Slot – up to 32GB
8 hour battery life (while reading w/o wireless enabled)
Charges in 3 hours from wall socket

Color Touchscreen:

Backlit, reduced glare, 7 inch VividView™ Color Touchscreen
16 million colors
1024 x 600 resolution (169 pixels per inch)

Audio/Video Support:

Built-in Mono Speaker
3.5mm Stereo Headphone Jack
Plays MP3 and AAC Audio Files
Plays MP4 Video Files

Document Support:

EPUB (including Non or Adobe DRM)
PDF
Other documents: XLS, DOC, PPT, PPS, TXT, DOCM, XLSM, PPTM, PPSX, PPSM, DOCX, XLX, PPTX
Graphics: JPG, GIF, PNG, BMP
Not Supported: LIT, AMZ (Amazon), LRZ/LRX (Sony)

Included Software Extras:

Pandora internet radio
Games: Chess & Sudoku
Crossword Puzzles
Media Gallery (for photos and videos)

That’s a pretty impressive set of capabilities for a device that’s under $250. If you just used it out of the box the way Barnes & Noble intended, then you’d have a pretty flexible and powerful device on your hands. The Wi-Fi only Kindle 3, by comparison, is $100 cheaper but only has a 6″, Black & White screen, not nearly the wide selection of document formats, and cannot play videos.

I hack devices to make them do things better than they did before. So, what is really under that hood? The guys at Android Tablets have provided the real specs here. They include:

PCB: Foxconn ML1 S 94V-0
CPU Processor: ARM Cortex A8-based Ti OMAP 3621 @ 800 MHz (same processor as Droid 2 and Droid X)
GPU Processor: PowerVR SGX530 Graphics Rendering: Open GLES1.1/2.0 Hardware Scaling: 854×480 scaled to 1024×600 Video Formats: .3GP, .MP4, .3G2 ** Video Codecs: H.263, H.264, MPEG-4, ON2 VP7 ** Image Formats: JPEG, GIF, PNG, BMP ** (same GPU as Droid 2 and Droid X)
RAM: 512MB Hynix H8MBX00U0MER-0EM MCM (Stacked Chips 2x256MB each die mDDR)
Internal Flash: 8GB Sandisk SDIN4C1-8g
Removable Flash: 32GB via microSDHC
Radio: Chip ID Ti wl1271 (kernel reports wl1273) Chip supports bluetooth transmit/recieve and fm radio functions through the same antenna, but is not enabled in software drivers. Connectivity: 802.11b/g/n Security: WEP/WPA/WPA2/802.1x Mode: Infrastructure
Display: 7″ 1024×600 IPS Display w\VividView Cypress Semiconductor TTSP Gen 3 (TMA340) Touchscreen , kernel driver , reference LG Display LD070WS1 (SL)(02) LED Backlight Pixels per Inch: 169 Aspect Ratio: 16:9 Colors: 16 Million Viewing Angle: 178° (same as HTC 7 Surround and HTC 7 Mozart)
Audio: Ti TLV320DAC3100 Codec 3.5mm Headset Jack (TRS 3-Pole) – no mic input Single Rear Speaker PWM Headphone Amp Headphone Detection Mic Amp and ADC (Mic input not available) Audio Formats: .3GP, .3G2, .MP4, .AMR, .MP3, .MID, .XMF, .MXMF, .RTTL, .OTA, .IMY, .WAV, .OGG, .ACC ** Audio Codecs: ACC, ACC+, AMR, MP3, MIDI, LPCM **
Power Management: Texas Instruments TPS65921 PMIC Integrated Power Management IC with 3 DC/DC’s, 4 LDO’s, USB HS Transceiver
Battery: “Barnes & Noble” labeled 3.7V 4000mAh 14.8Wh Li-ion battery Battery Life: ~8 hours
Physical Specifications Dimensions: 8.1″ (205mm) L x 5″ (127mm) W x 0.48″ (12.2mm) D Weight: ~15.8oz (~422g)
Micro-B USB 2.0 High-Speed
Accelerometer
Input Virtual QWERTY Keyboard On-Screen Soft-Keys ** ‘n’ Home button Power\Lock button Volume Up\Down buttons

Yea, you read that right. This is as powerful as the Droid 2 / Droid X and it has Bluetooth and an FM Radio! Now before you get too excited, we’ll talk about Bluetooth later, but I’ve yet to uncover any mods that allow the FM receiver to work. Also, note that the 802.11n wireless only appears to operate at 2.5GHz, not at 5 GHz.

But, you’re not here reading about what you already can do, you’re here to find out how to get it to be a fully functional Android tablet. I’ve been doing just that to my NOOK Color and have found there are three different levels of Android-ness you can achieve, all with varying degrees of capabilities and usefulness, weighed against your ability to get the NOOK Color back to factory defaults in case there’s a problem and you have to have warranty support (like the screen dies). This article is going to show you the easiest method of getting your NOOK Color to run a full-blown Android Operating System and it happens to be the method that is easiest to revert back to a stock NOOK Color. The other methods I will probably explain in a future article.

Now, follow me after the break as I show you the easiest way to bend your NOOK Color (NC) to your Android will.

Bootable SD Card (Android 3.0 – Honeycomb)

One of the most useful features of the NOOK Color is that it is programmed in hardware to first check the microSD card slot for a bootable operating system, making the NC almost impossible to totally brick. That capability makes this method of converting the NC to a full Android tablet the easiest to undo. I’m going to show you how to make a bootable microSD card, insert it into the NOOK Color, boot into the Android OS, play with your full tablet, then pull the card and restore the tablet to normal.

These steps are for a Macintosh user (and some will work on Linux), you can certainly find lots of support for Windows if you’re interested, Google is your friend.

Get a minimum of a 4GB microSD card
Download NookHoney (Android 3.0 (Honeycomb) for NOOK Color) here
Unzip the NookHoney Zip file
Write the image to the card**
Insert the card in the NOOK
Power cycle the NOOK

You’re now running Android 3.0 (Honeycomb) on your NOOK Color. If you want to return to the stock NOOK Color:

Power off the NOOK Color
Remove the microSD Card
Power on the NOOK Color

** Okay, so I’m a little vague on Step 4 in the first set of instructions.

On a Macintosh, the instructions for writing an image to an SD card are:

Open Terminal (found in Applications -> Utilities)

Run diskutil:

sudo diskutil list

That should show you output similar to:

/dev/disk0
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *320.1 GB   disk0
   1:                        EFI                         209.7 MB   disk0s1
   2:                  Apple_HFS Macintosh HD            319.7 GB   disk0s2
/dev/disk2
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:                            boot                   *4.0 GB     disk2

So, in the above list, I know that

/dev/disk0

is my internal hard drive, so

/dev/disk2

must be my SD card. Make a note of the drive name.

Unmount the microSD card:
```
sudo diskutil unmountDisk /dev/disk2
```
Write the image to the card (assumes nookhoney04.img is in your current directory):
```
dd if=nookhoney04.img of=/dev/rdisk2 bs=1m 
```

That’s it! Take the microSD card out of your card reader, power down your Color NOOK, place the microSD card in the Color NOOK, power it on. You should see it boot into Android 3.0 (Honeycomb).

Installing Marketplace

The above instructions only get you so far. For one, you won’t have access to the Android Marketplace.

To load Android Marketplace, as well as the default Google Applications (Gmail, Google Talk, Google Maps and Contact Sync for Gmail), you’ll have to do some additional work; however, this is time well spent.

Load Android Software Development Kit

Why do you need to load the Android SDK? Because, buried inside the SDK is a great little program called ADB. ADB is the Android Debug Bridge and it allows you to access your Android device from your computer. Through ADB you’ll be able to:

Install Applications (also called “side loading”)
Access a shell on your Android device
Copy files to and from the Android device

To install the Android SDK and get ADB functional (from NOOK Devs):

Download the Android SDK from http://developer.android.com/sdk/index.html

Unzip it and move it where needed

unzip Downloads/android-sdk_r09-mac_86.zip -d ~/bin

Open Terminal.app (found under /Applications/Utilities)

Edit ~/.profile and append

export PATH=~/bin/android-sdk_r09-mac_86/platform-tools:~/bin/android-sdk_r09-mac_86/tools:$PATH

Load your new .profile
```
source .profile
```
Run Android SDK Manager
```
android
```
Download the Android SDK Tools from within the Android SDK Manager
Ensure that your rooted NOOKcolor is plugged in
Run the following command in terminal (this tells the Android SDK what USB driver to use for the NC):
```
mkdir -p ~/.android
echo 0x2080 > ~/.android/adb_usb.ini
```
Restart the ADB Server:

adb kill-server
adb start-server

List the devices attached to your computer:
```
adb devices
```

The above command should show output similar to:

List of devices attached
[YOUR NOOKCOLOR SN]	device

At this point you now have a working ADB for your NOOK Color. This will allow you to complete the final step of installing the Android Marketplace and the standard Google Apps.

Download the Honey GApps from AddictiveTips
Unzip the HoneyGApps file
```
unzip HoneyGApps.v2.zip
```
Use Terminal to change into the directory where you unzipped the above file

Execute the commands found in the HoneyGAppsInstall.cmd file:

adb shell mount -o rw,remount -t ext2 /dev/block/mmcblk1p2 /system
adb push Vending.apk /system/app
adb push GoogleServicesFramework.apk /system/app
adb push Gmail.apk /system/app
adb push Maps.apk /system/app
adb push Talk.apk /system/app
adb push GoogleContactsSyncAdapter.apk /system/app
adb shell chmod 6755 /system/app/Vending.apk
adb shell chmod 6755 /system/app/GoogleServicesFramework.apk
adb shell chmod 6755 /system/app/Gmail.apk
adb shell chmod 6755 /system/app/Maps.apk
adb shell chmod 6755 /system/app/Talk.apk
adb shell chmod 6755 /system/app/GoogleContactsSyncAdapter.apk
adb reboot

After your NOOK Color reboots, you should now have the Android Marketplace as well as the standard Google Apps.

You now have a fully functional Android 3.0 7″ Tablet. Congratulations!

Root your NOOK Color

One last process you should probably undertake. This is called “rooting” and is the process to allow you to gain Superuser privileges on your NOOK Color. This is required for all manner of shenanigans on your new Android tablet.

Download su_fixed.zip from this thread at XDA Developers
Install the new su program via ADB (so your NOOK Color has to be plugged into your computer):
```
# adb remount
# adb push su /system/xbin
# adb shell chmod 4755 /system/xbin/su
```
Install SuperUser from the Android Marketplace

You should now be able to grant root privleges to programs running on your NOOK Color. The easiest way to test this is to download a Terminal application for your NOOK Color and then when you have a shell prompt issue the su command.

I’ll be writing some additional articles on the NOOK Color, so stay tuned.

My Son has Down Syndrome

Rob Pickering — Sat, 02 Apr 2011 21:34:43 +0000

On March 25th, 2011 at 2:38 p.m. in the afternoon, during an emergency Caesarean section, my son, Robert Alan Pickering III (Trip for short) was born. The pediatrician that tended to my son after he was born came into the Labor and Recovery room to give me the great news that my wife was fine and that my son was “clinically fine”. I wasn’t able to be with my wife and son at his birth, because my wife had to be put under a general anesthesia, and I was told I was not allowed in the operating room as a result.

The pediatrician then said to me words that I will never forget, “But I have some bad news, your son appears to have Down syndrome.” I steadied myself next to the bed, the nurse and pediatrician thought I was going to collapse, good luck catching me if I did. I didn’t. I asked how he knew, he stated that he had observed several of the physical characteristics consistent with Down syndrome.

My son is beautiful and the joy of my life. This will be the only post here on my main blog about the journey that he, my wife, and I will be taking. If you’d like to read more about it, you can, on my new blog: My Son has Down Syndrome. There isn’t much there at this time, but I wanted to post this as close to his birth day as possible. This blog will continue to be focused on technology and the other passions in my life, but I now have a new passion and I hope you join me there as well.

Thanks for reading this.

-Rob

April Fools! Your blog backup is incomplete.

Rob Pickering — Fri, 01 Apr 2011 20:49:09 +0000

My first VaultPress backup was completed at 7:03pm, Fri, February 25. I felt safe. I had been playing with various WordPress backup solutions, including AWB, BackupBuddy (I purchased it), but wasn’t happy with any of them. AWB only ran when I manually ran it, or else I had to build a cron-job on my Unix host to run it. BackupBuddy only ran if someone accessed the site. Then I found VaultPress and requested a “Golden Ticket” to the Beta. I even Tweeted them to see if I could get my “Golden Ticket” a little earlier:

robpickering

(Rob Pickering)

Now patiently awaiting my @VaultPress "Golden Ticket" #wordpress #vaultpress

On 25-2-2011 19:53:57 from Kiwi

It worked! VaultPress let me know my “Golden Ticket” was on the way:

vaultpress

(VaultPress)

@robpickering We've bumped you to the front of the queue. Check your inbox and thanks for the tweet! :)

On 25-2-2011 21:58:27 from CoTweet in reply to Rob Pickering

I registered my account, paid my monthly fee ($15), installed the plugin, and thanked VaultPress:

robpickering

(Rob Pickering)

@vaultpress Thanks VaultPress folks! Got my Golden Ticket, all setup, and backup processing, EXCELLENT experience so far...

On 25-2-2011 23:37:03 from Kiwi in reply to VaultPress

Backups

Backing up with VaultPress appears to work wonderfully. It’s completely automated and it backs up every time you make changes to your blog. That generates a LOT of backups. Since February 25th, VaultPress has made 743 backups of my blog. Unfortunately, their interface only shows 24 at a time, so I have to cycle back through 31 pages of entries to find the original backups I took (@VaultPress, it’d be nice to get a better pagination system).

Every backup looks like this:

It’s very comforting to see, “Backed up your entire blog”. You feel secure that if anything happens, everything you have on your WordPress site will be recoverable.

Unfortunately, that line is very misleading.

Recovery

Backups without Recovery are like Compression without Decompression, completely useless.

On March 28th, 2011, I decided to setup a new blog. Since WordPress 3.1 includes the WordPress Multi-User environment, I decided to enable a WordPress Network and have both blogs hosted in my single instance. Boy was that a mistake. I’m not going to tell the story here, but basically, if you have two completely different domain names, WPMU still doesn’t really support them both running on the same instance of WordPress. I completely dorked this blog, at a time where I really didn’t have any time to dork a blog up.

Never fear, I have VaultPress! So, I just blew away my WordPress installation, dropped the database table, and began to recover.

Always test Recovery before relying on a Backup system!

I cannot stress the above enough. VaultPress does an amazing job of automating your backups. Recovery, however, is dismal. Here’s your first indication of an issue: Recovery isn’t an option, on any screen. The closest thing to a Recovery option is:

So, you can download your data. But how do I use what they download to me? How do I actually recover? The answer is found under Support, in the Frequently Asked Questions:

Okay, so there’s no automated Recovery. I’m okay with that. How difficult could it be, their Backup capabilities are stellar! In fact, VaultPress provides instructions for each of the archive files they provide to you. Each of them basically says the same thing, here’s the Uploads directory instructions, though Plugins, Themes, and Database are basically the same:

One moment… Are they kidding? Manually download everything to your computer, then upload it all back to your WordPress site? Re-install WordPress itself manually? This isn’t sounding great … and it isn’t.

The Issues with VaultPress

The single biggest issue I have with VaultPress is that I believe they are currently misleading their customers. You CANNOT perform a complete recovery of your WordPress site using their service; therefore, “your entire blog” is NOT backed up. Unfortunately, they give you the impression that it is fully backed up. I’m fine with manual processes for Recovery, but when I’m finished with the Recovery, I want everything back and functioning, that’s not the case with VaultPress.

Missing Pieces

During my Recovery, here are the things I found missing and had to rely on old backups with AWB and BackupBuddy to recover:

wp-config.php – This is the heart and soul of your WordPress installation. VaultPress doesn’t back it up, so you better have a copy somewhere else.
Anything in your WordPress directory that you put there – I had installed Mint on my Blog for statistics, none of it was backed up. I also had a rather long and complex .htaccess file in my WordPress root, gone. Sitemaps and Google authentication files, also gone. Don’t rely on VaultPress for these files.
Uploads – You’d think everything in this directory would be backed up, but it doesn’t appear so. I’m not sure if VaultPress is purposefully filtering the files in the Uploads directory, but I know that all of my BackupBuddy backups were skipped. Additionally, several directories I had installed in this folder were also not available in my backup.
Database tables – More critical, potentially, than the data in wp-content is the data in your database tables. Unfortunately, it appears VaultPress is also filtering what database tables it backs up. After installing all of the tables back into my database (also hand-editing several due to errors in the import) I found several of my Plugin tables were missing completely, so they had to be reconfigured.

VaultPress does give you an indication that it isn’t actually backing up everything, because it only offers downloads for: Plugins, Themes, Database, and Uploads, most of which are in the wp-content folder. However, my experience showed that not all of the files / data available in those areas is actually backed up either. Very disappointing.

Recommendation

If you want an automated, partial, backup of your data and you’re okay with missing database tables and some data in the directories not being backed up…nevermind. Just pass by VaultPress and look into something else.

Update – 20110402

I just tried to cancel my VaultPress subscription. You can’t. They only offer the ability to upgrade to “Premium” (includes security scanning for only 166% more money than the backup alone ($40 total)). You have to email support@vaultpress.com to cancel your subscription.

How to become a Certified IPv6 Technician – Part Two

Rob Pickering — Wed, 02 Mar 2011 02:39:34 +0000

Internet Protocol version 6 (IPv6) is the “new” Internet addressing protocol created by the Internet Engineering Task Force (IETF) to deal with the exhaustion of the current IPv4 address space. In Part One of this article I gave you some background in IPv6 and documented your path from IPv6 Certified Newb to Enthusiast. In Part Two we’ll finish the Hurricane Electric IPv6 Certification process and you’ll be end up being a Sage.

Administrator

The IPv6 Administrator not only runs a valid IPv6 addressed web site, but also a valid IPv6 addressed mail server. For this certification, you’re going to have to configure a mail server that resolves via IPv6 DNS, can be connected to over IPv6, and will properly receive email. Apple OS X 10.6 (Snow Leopard) includes a Postfix mail server, which I’ll walk you through configuring. This is not an extensive tutorial on configuring your Macintosh to run Postfix and be an Internet mail server. I’m only going to show you how to make it respond properly, receive email, start and stop it. You SHOULD NOT leave this up and running all of the time, in fact, I’m not even going to show you how to get it to auto-load at system startup (though you can). You should already have your Macintosh with a ping6-able IPv6 address and resolving via DNS.

Configure Postfix

Postfix is a SMTP Mail Transfer Agent (MTA) that attempts to be fast, easy to administer, and secure. Postfix is shipped in a configuration that does not allow it to talk on the public Internet, so the configuration will have to be adjusted. Additionally, we’ll have to enable Postfix to listen to your IPv6 address. To minimize the risks, I’m going to configure Postfix to only respond to its IPv6 address.

The Postfix configuration file is found at /etc/postfix/main.cf. You should be able to open this file with any Plain Text editor, TextWrangler is a good (and free) one. For this configuration example my IPv6 host is going to be ipv6.example.com, and therefore my domain is example.com.

Set your host name on the myhostname variable:

#myhostname = virtual.domain.tld
myhostname = ipv6.example.com

Set your domain name:

#mydomain = domain.tld
mydomain = example.com

Set Postfix to listen on all interfaces:

#inet_interfaces = $myhostname, localhost
inet_interfaces = all

Enable only IPv6 as the Internet protocol in use with inet_protocols:

# inet_protocols = ipv6        # (enable IPv6 only)
inet_protocols = ipv6

Configure Postfix to recognize various forms of your server as local, using the mydestination variable:

#mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain

You should be able to leave everything else as the default, save the file.

Start Postfix (from Terminal):

sudo postfix start

To stop Postfix use:

sudo postfix stop

Test that your mail server is responding by using Terminal and issuing the command:

telnet localhost 25

You should see output similar to (note the IPv6 use of ::1 for localhost):

Walkabout:~ pickerin$ telnet localhost 25
Trying ::1...
Connected to localhost.
Escape character is '^]'.
220 ipv6.example.com ESMTP Postfix

Type quit to exit:

quit
221 2.0.0 Bye

You now have a working SMTP mail server.

Configure a MX Record

In order to have a properly configured mail server, you should have a Mail Exchanger (MX) record defined for your domain. Hurricane Electric Free DNS to the rescue! Edit your domain and add a new MX record that points your domain to your host address.

Domain MX Record

You should be ready to complete this certification by filling in the Hurricane Electric test box with your email address. Oh wait! What is it?

Your E-Mail Address

You have an account on your Macintosh and that account has a short name. The short name is rarely used, but to determine your email address you’re going to have to find it. The best instructions I’ve found are here. Once you have your short name, the rest is easy. Your email address is: shortname@example.com.

Now you can have Hurricane Electric’s Administrator test send you an email with a code in it. Your mail should deliver to the /var/mail/shortname file on your Macintosh. Read that file and your code should be in there. Congratulations, you’re now an IPv6 Administrator.

Make sure to take the Administrator Technical Test under Additional Tests in the left navigation. I’ll warn you now, the Administrator Technical Test is non-trivial for a beginner to IPv6. You get 11 questions and if you miss one, it will tell you which question you missed and allow you to take the test again (you won’t pass based on percentage). However, each version of the test scrambles up the questions and the data in the question, and all of the answers will be reset. So, pay attention. I was struggling with one of the answers (hint coming) and found I was missing questions I had already answered correctly once, just because I wasn’t paying attention to the answer I was selecting.

The one question I had difficulty with on the Administrator test was, “On Redhat, CentOS, and Fedora Core systems that don’t accept ::/0 as the IPv6 default route, which of the following should you use instead?” I finally found the answer in the Hurricane Electric forums here. The reason is that 2000::/3 is the Global Unicast address space, so 2000::/3 is basically (not exactly) the 0.0.0.0/0 space we use today in IPv4 default routes. Here’s hoping the RedHat variants fix this.

Professional

The IPv6 Professional certification completes the setup of your IPv6 network. You now have to ensure that your mail server has a valid rDNS (Reverse DNS or PTR record) that works in IPv6.

The first step is to add a Reverse Zone to your Free DNS account. The IP block you will be adding is the /64 you were assigned as part of your Tunnelbroker service.

Add rDNS Zone

Once the zone is added to your account, you should be able to add a new PTR record.

Add PTR Record

The record you are adding should be the local IPv6 address of your Macintosh and the forward DNS FQDN you assigned to that IP address.

Have Hurricane Electric check it, congratulations you’re now an IPv6 Professional.

Make sure to take the Professional Technical Test under Additional Tests in the left navigation. This test is even harder, as expected, than the Administrator test. There are now 22 questions you’ll have to answer and they will stretch your knowledge of IPv6 even further.

Guru

The IPv6 Guru is all about cleaning up the DNS resolution of your IPv6 implementation, and making sure it supports native IPv6 users. To become a Guru you need to verify that the name servers for your domain have AAAA records and those name servers need to be able to respond to queries made via IPv6. If you’re running your own DNS servers, then you just need to make sure that your DNS implementation supports IPv6 queries, bind them to the appropriate IPv6 interface, and let it rip. Even better, if you’re hosting your DNS with Hurricane Electric’s Free DNS, then you’re done. The Guru certification tasks have already been accomplished for you. Just be sure to remove the host portion of the address that Hurricane Electric pre-fills on their form or the tests will fail (mine did). Congratulations, you’re now an IPv6 Guru!

Make sure to take the Guru Technical Test under Additional Tests in the left navigation. This exam is 20 questions long and I found this reference very helpful.

Sage

The IPv6 Sage is the highest certification level that Hurricane Electric is currently providing. To become a Sage you need to make sure that the IPv6 glue records for your domain are present at your Domain Name Registrar. This is probably the hardest task you’ll face, because you cannot run your own Domain Name Registrar. You will be at the mercy of whatever Registrar you currently have your domain name registered with, and obviously, if they do not support IPv6 Glue Records, then you’re out of luck without transferring your domain to someone who does (at a cost). SixXS provides a list of Domain Name Registrars who support IPv6 Glue Records and how to get them.

The good news is that if you’ve pointed your domain name to Hurricane Electric’s Free DNS, then they have already provide IPv6 Glue Records for most of their DNS servers. I say most because this test constantly failed for me, even though I was using HE’s DNS servers. I then remembered that when I set up my domain, they have one DNS server (ns1.he.net) that was in an IPv4 “compatibility mode”.

ns1.he.net Warning

So, off to my Registrar and I removed ns1.he.net from the DNS servers that were authoritative for my domain. That did the trick and I was a Sage. Now you are too!

Make sure to take the Sage Technical Test under Additional Tests in the left navigation. There are only 9 questions on this exam and they are very straight forward, you shouldn’t have an issue. Congratulations, you’ve now completed the Hurricane Electric IPv6 Certification Program and you are a Certified IPv6 Sage!

What’s Next?

After taking the Sage Technical Test you should have 900 points listed on your badge. You may also see that other people have 1,500. How’d they do that?

For starters you can get a Free T-Shirt! Hurricane Electric allows you to request an IPv6 Sage T-Shirt, if you validate your address and select a T-Shirt size. You’ll find this “test” by clicking the Update Info link under Account Menu. If you do so, you’ll net an additional 100 points!

There are also daily tests you can perform with your environment to earn the additional 500 points. The tests are all performed from your IPv6 connected host:

Submit an IPv6 Traceroute – Use traceroute6 FQDN to an IPv6 host, copy and paste the results (1 point)
Submit an IPv6 Dig AAA – Using dig AAAA FQDN, copy and paste the results (1 point)
Submit an IPv6 Dig PTR – Using dig -x IPv6Addr, copy and paste the results (1 point)
Submit an IPv6 Ping – Use ping6 to verify an IPv6 host is online, copy and paste the results (1 point)
Submit an IPv6 Whois – Submit a whois -h whois.arin.net IPv6Addr for an IPv6 IP Address (or range), copy and paste the results (1 point)

So, 100 days of running the tests (we call these “Dailies” in WoW) will get you to the 1500 point cap. 100 days seems like a lot, but it only takes seconds to run the tests and you’ll have the 500 points in no time!

My Sage Certificate

More IPv6 Please

A great primer for IPv6 can be found at SixXS.

How to become a Certified IPv6 Technician – Part One

Rob Pickering — Mon, 28 Feb 2011 01:28:29 +0000

Internet Protocol version 6 (IPv6) is the “new” Internet addressing protocol created by the Internet Engineering Task Force (IETF) to deal with the exhaustion of the current IPv4 address space. What does that mean to you and I? Ultimately, it means very little. The transition from IPv4 to IPv6 has been going on, very slowly, for the last 13 years. However, something rather significant occurred on February 1, 2011, the last IPv4 blocks were allocated from IANA to the Regional Internet Registries (RIR) around the world. That means there are no more Internet Protocol version 4 addresses left to allocate to those authorities. So, when they’ve been allocated out, they’re gone forever.

This badge will track the total available IPv4 addresses at each registry:

Over the next several years, you will start to utilize IPv6, so now is the time to start to expose yourself to the IPv6 world. There is a fantastic resource found at Hurricane Electric for doing just that, an IPv6 Certification. In this article, I’m going to walk you through becoming an IPv6 Enthusiast, in my next article I will walk you through going from Enthusiast to a Sage, the top Certification that Hurricane Electric currently provides.

Newb

The first step to becoming a certified Newb (sorry just too funny) is signing up for a free account at Hurricane Electric. You’re going to eventually, probably, use their Tunnelbroker IPv6 service to enable you to talk on the IPv6 Internet, so go register for an account now. Once you have an account, you can access the IPv6 Certification program offered at Hurricane Electric. An IPv6 Newb is someone that can pass an initial IPv6 quiz. All of the answers to the quiz can be found in the IPv6 Primer. The only tricky question was one that asked about differentiating different address formats, and the Primer didn’t cover IPv6 addressing that well. So, here’s a hint: IPv6 addresses are Hexadecimal; they can only contain characters 0-9 and A-F.

If you pass the short quiz, congratulations, you’re now a certified IPv6 Newb.

Explorer

Taking the next step, you’re going to actually begin using IPv6 on your local computer. Chances are you cannot natively run IPv6 on the Internet. That would require your ISP to provide you with routable IPv6 space. However, that doesn’t mean you cannot talk on the Internet using IPv6, you just have to Tunnel it.

In order to get your IPv6 Explorer certification, you’re going to have to access a web page at Hurricane Electric over IPv6. To do this you’re going to have to tunnel IPv6 inside of IPv4. Fortunately, if you’re running a Macintosh and OS X, you’re in luck. Just download Miredo for OS X. Once you have it installed and enabled, you’ll be running IPv6 using the Teredo Tunneling Protocol. If you’re on Unix, you can download Miredo for your platform as well. For Windows, you probably already have a Teredo interface running, just check under the preferences for your network interface and set it to “Obtain an IPv6 address automatically”.

You should now be able to access IPv6-only websites, specifically the test page.
If the test page shows your IPv6 address, congratulations, you’re now a certified IPv6 Explorer.

If you wish, you can also test your IPv6 setup by using Jason Fesler’s excellent IPv6 Readiness Test.
Or surf Google via IPv6 here.
Finally, a nice resource to always quickly check your IPv6 address is here.

Make sure to take the Explorer Technical Test under Additional Tests in the left navigation if you want extra points.

Enthusiast

The IPv6 Enthusiast is someone who is beginning to have a solid understanding of this new protocol. For this certification, you’re going to have to enable a website that is reachable via IPv6. Hopefully, you’re on a Macintosh, as that’s the only example I’m going to walk through, though you shouldn’t have much of a problem getting any Unix/Linux variant working properly.

There are three ways you can accomplish this stage, and how you do it will depend on what you have:

An IPv6 Web Hosting Service such as webhosting.att.com (you may also host at Host Virtual for $10 a month)
If you have an IPv6-tunnel-capable Router (like an AirPort Extreme) you can build a tunnel and host on your Mac
It will probably work to just host on your Mac using your IPv6 Tunnel Address

For all of these options, you’re also going to need to have a DNS domain you can control. Because you’re going to have to serve up a AAAA DNS record for your website.

I decided to tunnel IPv6 on my AirPort Extreme so that my local computers could run dual-stack IPv4 and IPv6 without needing individual tunnels. Here’s how (it was super easy). First, access your AirPort Extreme (works on Time Capsule as well) using the AirPort Utility on your Macintosh.

AirPort Extreme IPv6 Tunnel

Select the Advanced tab, the IPv6 configuration pane, and select Tunnel as the IPv6 Mode.

Now, create an IPv6 Tunnel at Hurricane Electric using their Tunnelbroker service. You’ll provide them the IPv4 address that your AirPort Extreme uses to access the Internet, as the origination point of your IPv6 tunnel, HE will provide you back a bunch of information about your tunnel.

Configure your AirPort Extreme

Configure your AirPort Extreme using the following information from Hurricane Electric:

Set the AirPort Extreme Remote IPv4 Address to be the Tunnelbroker Server IPv4 address
Set the AirPort Extreme WAN IPv6 Address to be the Tunnelbroker Client IPv6 address (remove /64 from the end)
Set the AirPort Extreme IPv6 Default Route to be the Tunnelbroker Server IPv6 address (remove /64 from the end)
Set the AirPort Extreme LAN IPv6 Address to be the Tunnelbroker Routed /64 (remove /64 from the end)

Update your AirPort Extreme and it should reboot, when it comes back you should have an IPv6 Tunnel running to Hurricane Electric.

For some reason my AirPort Extreme constantly reports an IPv6 Tunnel Error. However, I’ve tested the heck out of it, and it works fine, so if you have this problem and everything is working, don’t worry about it.

Secure your IPv6 Installation

You also want to secure your IPv6 installation and enable Web Server access. While you may have a Firewall today, that Firewall is either going to block ALL IPv6 traffic (by preventing Protocol 41 from passing) or NONE, so you need to have an IPv6 Firewall. Fortunately, Apple provided one in the AirPort Extreme. First, make sure you have Block incoming IPv6 connections enabled on this pane, then select the IPv6 Firewall pane. Under Exceptions click the plus ( + ) sign to add an exception to the Firewall.

Allow HTTP access through IPv6

Create the exception for HTTP using the following settings:

Set the Description to anything you want, I used Web Server
Set the IPv6 Address to your Macintosh’s IPv6 address (go to http://www.whatismyipv6.net/ to find it, or check your TCP/IP settings under the Network Preference Pane
Allow Specific TCP and UDP ports
Enter 80 under TCP Port(s) to enable HTTP traffic to your server

Configure your Macintosh

This is easy, you know, because it’s a Macintosh, and because it’s IPv6. Just make sure that Configure IPv6 is set to Automatically. Chances are this is already done, in which case you should see your newly acquired IPv6 Address on this screen.

Configure Macintosh for IPv6

To verify that your IPv6 address is working on the Internet, you can use Hurricane Electric’s Looking Glass. It should auto-fill with your current IPv6 address.

Hurricane Electric Looking Glass

Select Ping and just make sure your IPv6 address is in the text field before clicking Probe. Your output should look something like this:

Hurricane Electric Ping Output

If you get valid responses, congratulations, your Macintosh is on the IPv6 Internet.

Configure your Web Server

Let’s get your Macintosh serving a web page. Fortunately, this is as simple as checking a box. Go to System Preferences, select the Sharing Preference Pane, and check the Web Sharing checkbox.

Enable Web Sharing

Next, you’ll have to configure forward IPv6 DNS (known as a AAAA Record) for your web server. Hurricane Electric will allow you to host your domain name’s DNS on their servers. Setting up the NS records for your domain is beyond the scope of this article, and it’s long enough, but once you’ve pointed your domain to he.net, you’ll be able to setup a AAAA record for your website name pointing to the IPv6 address of your Macintosh. To add your domain hosting at HE use the Free DNS link at Hurricane Electric, then add your domain using the Add a new domain link in the left navigation.

Hurricane Electric Add Domain

Select a host name for your web server, then add it to your domain using HE’s hosting service by clicking the Edit Zone button for your newly added domain. Once there, add a AAAA record for your new host name pointing to the IP address that your Macintosh was assigned above, and you’re finished.

Hurricane Electric AAAA Record

You now have a valid IPv6 DNS record for your IPv6 connected Macintosh and a valid HTTP server! We’re just about done. Now is a good time to test that everything is working properly, using Hurricane Electric’s IPv6 Port Scanner. You should see, at a minimum, that Port 80 (HTTP) is open (in my screen shot, I’ve skipped ahead and you’ll also see Port 25 (SMTP) is open):

Hurricane Electric Port Scan

If your Port Scan checks out and HE can see your web server port, you’re ready to take the Certification Test and place the special file name that HE provides in your /Library/WebServer/Documents directory. If HE is successful in pulling the file, congratulations you’re now a Certified IPv6 Enthusiast !

Make sure to take the Enthusiast Technical Test under Additional Tests in the left navigation.

Administrator

Update – 20110228

Sam Bowne (@sambowne) has created a similar list of instructions for Microsoft Windows users, you can get those here.

What I Learned about Time Machine backups from timedog

Rob Pickering — Sat, 26 Feb 2011 01:59:06 +0000

I love Time Machine. For years and years backups were something I was supposed to do, but never found the time to do. Backups were difficult, you had to purchase backup software, find a drive, set them up, and then either manually execute your backup (which is what I did for years) or figure out how to automate them.

Enter Time Machine

With the launch of Mac OS X 10.5 (“Leopard”), Apple included this brand new Backup system. But, this article isn’t about Time Machine. Perhaps I’ll do one of those at some point. This article is about what I just learned about TIme Machine. I’m backing up a lot of stuff I shouldn’t be…

As I’m writing this article, Time Machine is up in my Menu Bar happily spinning. When I click on it, this is what it says:

Time Machine Preparing Backup

After a few minutes, that menu changes to this:

Time Machine Backing Up

What?!? 2100 files? 920MB? What changed? What is Time Machine backing up? That’s a lot of data!

Enter timedog

timedog is a Perl script written by J.D. Smith which does an amazing job just cataloging your Time Machine backup and determining what changed. The benefit here is that you can find stuff that’s being backed up, that you don’t really want backed up, and then exclude those items from your Time Machine backup.

I’m going to show you how to run the script, then how to interpret the results, and finally how to customize Time Machine to stop backing up things that you really don’t care about, which will give you more storage room to backup the things you do.

Running timedog

The first step is to download and install the Perl script. You can get timedog here.
I cannot really improve on the official instructions for running timedog, so here they are from the official site:

Usage

Open Terminal (in /Applications/Utilities)

cd /Volumes/Time\ Machine/Backups.backupdb/[Computer Name]

Note Time Machine may be different on your system.

Replace [Computer Name] with the name of your computer (see System Preferences => Sharing).

/path/to/timedog -d 5 -l

For instance, if you unzipped timedog to your Desktop, the path would be ~/Desktop/timedog

The example above uses the options -d 5 -l which will summarize the changes up to five directory levels deep, and hide rows that pertain to symbolic links. These links are often meaningless and can safely be ignored.

Once you’ve run the script on your Time Machine backup directory, you’ll get output similar to the following (this is mine from earlier today):

Walkabout:Walkabout pickerin$ timedog -d 5 -l
==> Comparing TM backup 2011-02-25-090631 to 2011-02-24-154335
    Depth: 5 directories
    2.9KB->    3.3KB        /.Backup.log
       0B->     527B        /.com.apple.TMCheckpoint
    1.9KB->    1.9KB        /.exclusions.plist
     182B->     182B        /Macintosh HD/Applications/World of Warcraft/WoW.mfil
  306.1KB->  499.8KB    [5] /Macintosh HD/Applications/World of Warcraft/Cache/ADB/
  193.1KB->  380.9KB    [8] /Macintosh HD/Applications/World of Warcraft/Cache/WDB/
     578B->     578B    [2] /Macintosh HD/Applications/World of Warcraft/Data/enUS/
     408B->     408B    [1] /Macintosh HD/Applications/World of Warcraft/Data/Interface/
   15.9MB->   16.1MB [1195] /Macintosh HD/Applications/World of Warcraft/Interface/AddOns/
    1.8KB->    4.2KB        /Macintosh HD/Applications/World of Warcraft/Logs/connection.log
   17.7KB->   17.7KB        /Macintosh HD/Applications/World of Warcraft/Logs/FrameXML.log
     450B->     450B        /Macintosh HD/Applications/World of Warcraft/Logs/GlueXML.log
    2.6KB->    2.6KB        /Macintosh HD/Applications/World of Warcraft/Logs/gx.log
   27.3KB->   28.1KB        /Macintosh HD/Applications/World of Warcraft/Logs/Launcher.log
    2.9KB->    5.8KB        /Macintosh HD/Applications/World of Warcraft/Logs/Sound.log
   52.7KB->   58.9KB    [6] /Macintosh HD/Applications/World of Warcraft/Logs/
    1.6KB->    1.6KB        /Macintosh HD/Applications/World of Warcraft/WTF/Config.wtf
     494B->     493B        /Macintosh HD/Applications/World of Warcraft/WTF/Launcher.WTF
   24.8MB->   24.6MB  [180] /Macintosh HD/Applications/World of Warcraft/WTF/Account/
   13.0KB->   13.0KB        /Macintosh HD/Users/pickerin/.bash_history
   50.5MB->   50.5MB        /Macintosh HD/Users/pickerin/.dropbox/dropbox.db
   50.5MB->   50.5MB    [1] /Macintosh HD/Users/pickerin/.dropbox/
   24.0KB->   24.0KB        /Macintosh HD/Users/pickerin/Desktop/.DS_Store
    .... ->   24.4MB        /Macintosh HD/Users/pickerin/Desktop/WCS7_0cg.pdf
   24.0KB->   24.4MB    [2] /Macintosh HD/Users/pickerin/Desktop/
   87.2KB->   87.2KB    [8] /Macintosh HD/Users/pickerin/Documents/Dropbox/
  285.6MB->  286.8MB [41005] /Macintosh HD/Users/pickerin/Documents/Microsoft User Data/
   77.6MB->   78.9MB   [89] /Macintosh HD/Users/pickerin/Library/Application Support/
   29.4KB->   51.5MB  [129] /Macintosh HD/Users/pickerin/Library/Arq/
    3.8MB->    3.8MB    [1] /Macintosh HD/Users/pickerin/Library/Cookies/
     425B->     425B    [1] /Macintosh HD/Users/pickerin/Library/LaunchAgents/
    1.3MB->    1.8MB  [135] /Macintosh HD/Users/pickerin/Library/Mail/
    5.9MB->    5.9MB   [57] /Macintosh HD/Users/pickerin/Library/Preferences/
    1.5MB->    1.5MB   [11] /Macintosh HD/Users/pickerin/Library/Safari/
    4.2MB->  289.0MB   [21] /Macintosh HD/Users/pickerin/Music/iTunes/
==> Total Backup: 42898 changed files/directories, 835.86MB

Wow, that’s a lot of changed files. Yes, I play World of Warcraft. However, as I look through the output of timedog, I immediately see some files I really don’t need to backup:

/Macintosh HD/Applications/World of Warcraft/Interface/AddOns/ — 307MB (AddOns are updated a lot and can be re-downloaded)
/Macintosh HD/Applications/World of Warcraft/Data/ — 26GB (this directory is the bulk of the App and changes with patches)
/Macintosh HD/Users/pickerin/Documents/Microsoft User Data/ — 3GB (really don’t need these backed up in my use of Outlook)
/Macintosh HD/Users/pickerin/Documents/Dropbox/ — 1.1GB (Dropbox is stored at Dropbox, I don’t need to back it up)
/Macintosh HD/Users/pickerin/Library/Arq/ — 27GB (Arq is an online backup tool, the Caches.noindex directory is all of this)

So, these files amount to around 57.5GB of storage on disk. That means 57GB of my Time Machine disk, assuming they’re only backed up once. So, let’s configure Time Machine to stop backing those up.

Configure Time Machine Exclusions

To exclude items from your Time Machine backup, first run the Time Machine Preference Pane from System Preferences, then click the Options… button.

Time Machine Preference Pane

Now, click the small plus sign ( + ) in the lower left corner and begin selecting the directories / files you wish to exclude from your backups. Here’s a screen shot of mine after I added the above directories (I also had previously set my Time Machine to exclude my Virtual Machine directory):

Time Machine Exclusions

When you’re done adding directories/files, just click the Done button. Your next backup will exclude these files, I’m not sure if that means it will delete the files already in your Time Machine backups, or if it will just stop backing them up going forward. I’ll check my backup drive the next time it runs and let you know. At least they won’t be taking up space going forward! Confirmed: Once you choose to exclude items from your Time Machine Backup, Time Machine will remove them from ALL VERSIONS of your backups, so they will be completely removed from your Time Machine backup volume.