I am not a big believer in root disk encapsulation with Veritas Volume Manager, now part of Symantec Storage Foundation. There have been a number of times when I have had to boot off the mirror disk, and had to completely de-encapsulate the mirror disk from Veritas Volume Manager to recover. 

Here is how to do it with Solaris. It is pretty similar for Linux as well.

Firstly, lets boot off the mirror disk and disable Veritas Volume Manager from starting.

Executing last command: boot vx-rootmirror -a -s

Boot device: /pci@83,4000/FJSV,ulsa@2,1/disk@0,0:a  File and args: -a -s

Enter filename [kernel/sparcv9/unix]:

Enter default directory for modules [/platform/FJSV,GPUZC-M/kernel /platform/sun4us/kernel /kernel /usr/kernel]:

Name of system file [etc/system]:  /dev/null

SunOS Release 5.10 Version Generic_127127-11 64-bit

Copyright 1983-2008 Sun Microsystems, Inc.  All rights reserved.

Use is subject to license terms.

root filesystem type [ufs]:

Enter physical name of root device

[/pci@83,4000/FJSV,ulsa@2,1/disk@0,0:a]:

Booting to milestone "milestone/single-user:default".

fjgi0:Using local MAC address

fjgi1:Using local MAC address

# example - in this case c0t0d0 corresponds to mirror disk

mount -F ufs -o remount,rw /dev/dsk/c0t0d0s0 /

/etc/system --- remove all vx lines

/etc/vfstab – go back to normal devices e.g. /dev/vx/c0t0d0 ..

# Now make sure Volume Manager does not start on the next boot:

touch /etc/vx/reconfig.d/state.d/install-db

# make sure you setup boot-device to boot of mirror from now on, very important for re-encapsulation step later

eeprom | grep dev

e.g. eeprom "boot-device=vx-rootmirror"

syc;sync;init 6

After the previous steps volume manager should not be running.

# vxdisk list

VxVM vxdisk ERROR V-5-1-684 IPC failure: Configuration daemon is not accessible

Now, re-install Volume manager

bash-3.00# vxinstall

  VxVM uses license keys to control access.  If you have a SPARCstorage

  Array (SSA) controller or a Sun Enterprise Network Array (SENA) controller 

  attached to your system, then VxVM will grant you a limited use license 

  automatically.  The SSA and/or SENA license grants you unrestricted use 

  of disks attached to an SSA or SENA controller, but disallows striping,

  RAID-5, and DMP on non-SSA and non-SENA disks.  If you are not running an

  SSA or SENA controller, then you must obtain a license key to operate.

  Licensing information:

    System host ID: 80f2a60a

    Host type: FJSV,GPUZC-M

    SPARCstorage Array or Sun Enterprise Network Array: No arrays found

Some licenses are already installed.  Do you wish to review them

[y,n,q,?] (default: y) Feb 23 22:16:56 ibsza3002 root[1501]: Starting agent n

Do you wish to enter another license key [y,n,q,?] (default: n) 

Do you want to setup a system wide default disk group?

[y,n,q,?] (default: y) Feb 23 22:17:16 ibsza3002 syseventd[353]:

n

Do you want to use enclosure based names for all disks ?

[y,n,q,?] (default: n) 

  The installation is successfully completed.

Check to see if Veritas can see your disks.

bash-3.00# vxdisk list

DEVICE       TYPE            DISK         GROUP        STATUS

c0t0d0s2     auto:sliced     -            -            online

c1t0d0s2     auto:sliced     -            -            online

Check to see if Veritas still thinks that it owns the disks.

vxdisk -o alldgs list

DEVICE       TYPE            DISK         GROUP        STATUS

c0t0d0s2     auto:sliced     -            (rootdg)     online

c1t0d0s2     auto:sliced     -            (rootdg)     online

If it does, make sure Veritas forgets about them completely.

bash-3.00# /etc/vx/bin/vxdiskunsetup -C c1t0d0

bash-3.00# /etc/vx/bin/vxdiskunsetup -C c0t0d0

Now follow the normal steps to re-encapsulate vx-rootmirror as your root disk and the other disk as your mirror disk.

Encapsulate root disk  (e.g. c0t0d0)

vxdiskadm – option 2 

Mirror root disk to other disk (e.g. c1t0d0)

vxdiskadm – option 6

Source: Volume Manager Root Disk Encapsulation Recovery on Setup Tips - Tips on setting up gadgets and software

bash-3.00# dladm show-dev

e1000g0         link: up        speed: 1000  Mbps       duplex: full

e1000g1         link: unknown   speed: 0     Mbps       duplex: half

e1000g2         link: unknown   speed: 0     Mbps       duplex: half

e1000g3         link: unknown   speed: 0     Mbps       duplex: half

e1000g4         link: up        speed: 1000  Mbps       duplex: full

e1000g5         link: unknown   speed: 0     Mbps       duplex: half

Source: Check Network Speed In Solaris 10 on Setup Tips - Tips on setting up gadgets and software

Here are some quick notes on how to order and install the free SSL certificates provided by VPS.NET on your server.

1. Create a self-signed certificate.

Install ssl-cert if it is not already installed

root@ns2:/tmp# aptitude install ssl-cert

NOTE: VPS.NET now require 2048 bit certificates. So, edit ssleay.cnf from1024 bits to 2048 bits.

root@ns2:/tmp# cat /usr/share/ssl-cert/ssleay.cnf

#

# SSLeay example configuration file.

#

RANDFILE                = /dev/urandom

[ req ]

default_bits            = 2048

Now create a self-signed certificate for your web server domain. It will prompt you for your server Host Name. For the example below it would be your web server domain. We use  mydomain.com as an example throughout this guide.

root@ns1:/tmp# make-ssl-cert /usr/share/ssl-cert/ssleay.cnf /etc/ssl/private/mydomain.com.crt

After running this command you will end up with your private key and self-signed certificate in the same file – mydomain.com.crt. You must split this into two separate files using an editor.

/etc/ssl/private/domain.com.key   // the part surrounded by —– BEGIN/END RSA PRIVATE KEY

/etc/ssl/private/domain.com.pem // the part surrounded by —– BEGIN/END CERTIFICATE

2. Create a Certificate Signing Request (CSR)

VPS.NET use Comodo as a trusted Certificate Authority (CA). You need to generate a certificate signing request (CSR) from the private key created in the previous step and send it to the VPS.NET help desk. They will in turn forward your request to the Comodo Certificate Authority.

Here is the example for the domain mydomain.com.

NOTE: The important thing is to use your domain name for the Common Name when prompted.

root@ns1:/tmp# openssl req -new -key /etc/ssl/private/mydomain.com.crt -out /etc/ssl/private/mydomain.com.csr

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [AU]:US

State or Province Name (full name) [Some-State]:Florida

Locality Name (eg, city) []:Burlington

Organization Name (eg, company) [Internet Widgits Pty Ltd]:My Company Name

Organizational Unit Name (eg, section) []:IT

Common Name (eg, YOUR name) []:mydomain.com

Email Address []:admin@mydomain.com

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:enter

An optional company name []:enter

3. Raise a VPS.NET Domain Name/SSL Support Ticket

The next step is to raise a “Domain Name/SSL Request” support ticket.

Make sure you include the following information in the Message part of the ticket  and also append the contents of the /etc/ssl/private/mydomain.com.csr file you created.

* Your Name: - Joe Blogs 

* Your Company: - mydomain.com 

* Contact Email address: admin@mydomain.com 

* Address 1: - 1 smith street 

* Address 2: -  

* Town: - BURLINGTON 

* County/Province: - FLORIDA 

* Postcode: - 12334 

* Country: - US

ip address: 174.127.111.29 

host: mydomain.com

Signing Request (CSR)

-----BEGIN CERTIFICATE REQUEST----- 

MIIB+DCCAWECAQAwgYMxCzAJBgNVBAYTAkhLMQswCQYDVQQIEwJOVDESMBAGA1UE

BxMJSG9uZyBLb25nMRIwEAYDVQQKEwlwbHNnby5jb20xCzAJBgNVBAsTAklUMRIw

EAYDVQQDE..

...

...

-----END CERTIFICATE REQUEST-----

It only takes VPS.NET support an hour or so to order a certificate from Comodo. You will get a response like this from VPS.NET support.

I have created new SSL certificate for you. 

You will be emailed when your certificate is available to download. 

Certificate for: mydomain.com 

Your order number is: 38383838

Please look out for a confirmation email to admin@mydomain.com 

- you'll need to follow the instructions in the email to verify that the domain is yours. 

Once you have followed the instructions in your confirmation mail, 

you will be able to download your certificate by going to the retrieve certificate page 

(https://ssl.uk2.net/cgi-bin/retrieve-certificate.pl) 

and entering the hostname and order number above. 

Thanks. 

-- 

Best regards, 

-- 

x smith 

Support Engineer 

After you get this response, go and check your email. Comodo will have also sent you an email verification email. Ensure that you open and accept the link they send.

From: Comodo Security Services <docs@comodo.com>

Date: Sat, Nov 26, 2011 at 4:58 PM

Subject: ORDER #38383838 - Domain Control Validation for mydomain.com

To: "admin@mydomain.com" <admin@mydomain.com>

Domain Control Validation for mydomain.com

Dear admin@mydomain.com,

We have received a request to issue an SSL certificate for mydomain.com.

*** Please ignore this email if neither you nor a trusted colleague made this request for a certificate ***

Otherwise, please browse here and enter the following "validation code":

vCqBZKIkejje838jfj2ldlfe838j33jjd833O0a

Kind Regards,

Comodo Security Services on behalf of uk2.net

Finally go to (https://ssl.uk2.net/cgi-bin/retrieve-certificate.pl) and fill in the requested fields. You will then be able to download a zip file containing your certificates.

4. Install The Certificates On Your Server

FTP the zip file you downloaded  to your server and then unzip the contents to a temporary directory on your server.

root@ns2:/tmp# ls

mydomain.com-certificate.zip

root@ns2:/tmp# unzip mydomain.com-certificate.zip

Archive:  mydomain.com-certificate.zip

 extracting: AddTrustExternalCARoot.crt

 extracting: UTNAddTrustServerCA.crt

 extracting: PositiveSSLCA.crt

 extracting: mydomain_com.crt

Next copy in your original key and the mydomain_com.crt certificate you unzipped

root@ns2:/tmp# cp mydomain_com.crt /etc/ssl/localcerts/mydomain.com.pem

root@ns2:/tmp# cp /etc/ssl/private/mydomain.com.key /etc/ssl/localcerts/

You will also need to add the comodo certificate chain bundle to your webserver configuration. This file is created by combining the other certificates you were given in the zip file. There are some notes on comodo support on how to make your certificate chain bundle, but here is the basic step.

root@ns2:/tmp# cat PositiveSSLCA.crt UTNAddTrustServerCA.crt AddTrustExternalCARoot.crt > mydomain.com.ca-bundle

Finally we need to ensure our apache webserver configuration is setup correctly to point to the new certificates.

vi /etc/apache2/sites-available/mydomain.com

<VirtualHost *:443>

    ServerName mydomain.com

    ....

    ....

    SSLEngine on

    SSLCertificateFile        /etc/ssl/localcerts/mydomain.com.pem

    SSLCertificateKeyFile     /etc/ssl/localcerts/mydomain.com.key

    SSLCertificateChainFile   /etc/ssl/localcerts/mydomain.com.ca-bundle

As a final step restart apache.

5. Check Your Certificate Installation

If your certificate install did not work you will still be presented with an untrusted certificate warning when you browse to the secure address of your domain

i.e. https : //www. mydomain. com

If everything worked fine. Then you will no longer see any warning messages.

You can also verify the certificate information in your browser by right clicking the web page and selecting view page info.

Source: VPS.NET SSL Certificate Installation On Ubuntu on Setup Tips - Tips on setting up gadgets and software

When you first invoke the crontab command in Ubuntu you are prompted for the default editor. If someone has already set this to nano and you are a vim-person this can be very annoying.

To change it to vim use the select-editor command

root@ns1:/etc# select-editor

Select an editor.  To change later, run 'select-editor'.

  1. /bin/nano        <---- easiest

  2. /usr/bin/vim.basic

  3. /usr/bin/vim.tiny

Choose 1-3 [1]: 2

Source: Setting Ubuntu Default Crontab Editor on Setup Tips - Tips on setting up gadgets and software

Memcached on Ubuntu has actually two components. A standalone program running on your server and a  client PHP extension. To be honest I noticed no increase in performance using memcached with the W3 Total Cache plugin.

root@ns1:~# aptitude install memcached

The following NEW packages will be installed:

  memcached

First we need to install the PEAR framework. This is a distribution system for handling reusable PHP components.

root@ns1:~# aptitude install php-pear

The following NEW packages will be installed:

  php-pear php5-cli{a}

Now we can install the PHP component using PEAR.  Type YES to all options prompted.

root@ns1:~# pecl install memcache

...

Installing '/usr/lib/php5/20090626/memcache.so'

install ok: channel://pecl.php.net/memcache-2.2.6

configuration option "php_ini" is not set to php.ini location

You should add "extension=memcache.so" to php.ini

root@ns1:/etc/php5/fpm/conf.d# cat /etc/php5/fpm/conf.d/memcache.ini

; uncomment the next line to enable the module

extension=memcache.so

[memcache]

memcache.dbpath="/var/lib/memcache"

memcache.maxreclevel=0

memcache.maxfiles=0

memcache.archivememlim=0

memcache.maxfilesize=0

memcache.maxratio=0

Now let’s verify

root@ns1:/etc/php5/fpm/conf.d# pgrep -fl memcached

27823 /usr/bin/memcached -m 64 -p 11211 -u memcache -l 127.0.0.1

root@ns1:/etc/php5/fpm/conf.d# netstat -an | grep 11211

tcp        0      0 127.0.0.1:11211         0.0.0.0:*               LISTEN

udp        0      0 127.0.0.1:11211         0.0.0.0:*

Configuration Files

/etc/memcached.conf

- you can increase the amount of memory in the memcache pool in this file. The default is 64M, which should be sufficient.

Log Files

/var/log/memcached.log

Source: Install Memcached on Ubuntu on Setup Tips - Tips on setting up gadgets and software

Want to know if you iPhone is still under warranty. Just go to this site and enter your iPhone serial number.  https://selfsolve.apple.com/agreementWarrantyDynamic.do

To find you iPhone serial number go to  Settings->General->Serial Number.

Source: Check iPhone Warranty Online on Setup Tips - Tips on setting up gadgets and software

I just wasted several hours debugging a an issue of my own creation.

In WC3 Total Cache I enabled the following CDN setting

Set cookie domain to www.myservrname.com
If using subdomain for CDN functionality, this setting helps prevent new users from sending cookies in requests to the CDN subdomain.

This resulted in the servername being set in the top of the wp-config.php file.

<?php
define(‘COOKIE_DOMAIN’, ‘www.myservname.com); // Added by W3 Total Cache

The end result was I could not login to any of the other domains hosted on my WPMU environment.

The fix was to remove the cookie from wp-config.php and restart my server.

Hopefully I have saved you some time in the future – don’t enable this option on a WPMU blog.

Source: WPMU W3 Total Cache Can Not Login on Setup Tips - Tips on setting up gadgets and software

This post is continuing from Part 1 of our series on how to setup a FreeBSD Web Server.

If you ordered a number of IP address then you might want to set them up as individual jails. One for your DNS server, one for you backend server and the rest as individual webserver IP addresses (I call them frontend servers). I know you can do this in apache with virtual servers but using jails makes it more secure and gives you more flexibility. 

I prefer to use what is referred to as a “complete” jail in FreeBSD that is similar in concept to a Solaris 10 zone. Maybe some of the FreeBSD developers work for Sun (now Oracle). Who knows! Some people create what is termed “service” jails that are just for one service or application e.g. apache. This would give you added security benefits but is a lot of work.

First we need to allow for ping and other raw socket services to work in jails /etc/sysctl.conf setting.  You can skip this step if you want more security and don’t need ping.

hk# echo ‘security.jail.allow_raw_sockets=1′ >> /etc/sysctl.conf

Now enable ezjails to start on server boot up.

hk# echo ‘ezjail_enable=”YES”‘ >> /etc/rc.conf

Now set up some default configuration for the jails

hk# cd /usr/local/etc/
hk# cp ezjail.conf.sample ezjail.conf

Edit /usr/local/etc/ezjail.conf  and uncomment the following.

ezjail_jaildir=/usr/jails
ezjail_jailtemplate=${ezjail_jaildir}/newjail
ezjail_jailbase=${ezjail_jaildir}/basejail
ezjail_sourcetree=/usr/src
ezjail_uglyperlhack=”YES”
ezjail_mount_enable=”YES”
ezjail_devfs_enable=”YES”
ezjail_procfs_enable=”YES”
ezjail_fdescfs_enable=”YES”
ezjail_ftphost=ftp6.freebsd.org

Jails are like a mini version of the operating system. So a very time consuming step we need to do is create a full root file system.

hk# cp /usr/share/examples/cvsup/standard-supfile /root/supfile
hk# vi /root/supfile

Go to the FreeBSD handbook and select the closest CVS server to your server to download the source tree from, and then add this CVS server to /root/supfile.

*default host=cvsup6.FreeBSD.org

Now tell csup to download the latest source tree for the current release.

hk# cd /usr/src
hk# csup /root/supfile

Go and get a cup of coffee as this will take a long time.

Next we build a complete operating system for for the jail. This will create the base jail which has the binaries shared by all jails.

/usr/jails/basejail/

hk# ezjail-admin update –b

Now go and get another cup of coffee.

The next step is to create a standard configuration for a jail such as /etc/resolv.conf, /etc/nsswitch.conf and /etc/make.conf

hk# cd /usr/jails/flavours/
hk# cp -R example standard
hk# cd standard
hk# mkdir PORTS

Edit etc/nsswitch.conf and remove all references to NIS. You don’t need it.

group: files
hosts: files dns
networks: files
passwd: files
shells: files
services: files
protocols: files
rpc: files

Edit etc/make.conf and append the following lines

NO_X=true
NO_X11=true
WITHOUT_X11=true
NO_NIS=true
WITHOUT_NIS=true
# Recompile apache to get this working
SUEXEC_DOCROOT=”/home”

OPTIONAL:

You can setup to use google’s DNS servers or the opendns.org DNS servers here also

vi etc/resolv.conf

nameserver 8.8.8.8
nameserver 8.8.8.4

Now setup your jail ip addresses in your main /etc/hosts file and also in /etc/rc.conf

/etc/hosts

192.168.1.51 ns5.ftmon.org
192.168.1.52 backend1.ftmon.org
192.168.1.53 frontend1.ftmon.org
192.168.1.54 frontend2.ftmon.org

/etc/rc.conf

ifconfig_em0_alias0=”inet 192.168.1.51 netmask 255.255.255.0″
ifconfig_em0_alias1=”inet 192.168.1.52 netmask 255.255.255.0″
ifconfig_em0_alias2=”inet 192.168.1.53 netmask 255.255.255.0″
ifconfig_em0_alias2=”inet 192.168.1.54 netmask 255.255.255.0″

At this point you can reboot or plumb up the interfaces manually

hk# ifconfig em0 192.168.1.51 netmask 255.255.255.0 alias
hk# ifconfig em0 192.168.1.52 netmask 255.255.255.0 alias
hk# ifconfig em0 192.168.1.53 netmask 255.255.255.0 alias
hk# ifconfig em0 192.168.1.54 netmask 255.255.255.0 alias

And verify

hk# ifconfig -a
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=9b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM>
        ether 08:00:27:ab:01:fd
        inet 192.168.1.50 netmask 0xffffff00 broadcast 192.168.1.255
        inet 192.168.1.51 netmask 0xffffff00 broadcast 192.168.1.255
        inet 192.168.1.52 netmask 0xffffff00 broadcast 192.168.1.255
        inet 192.168.1.53 netmask 0xffffff00 broadcast 192.168.1.255
        inet 192.168.1.54 netmask 0xffffff00 broadcast 192.168.1.255

Now let’s create the jails

hk# ezjail-admin create -f standard ns5.ftmon.org 192.168.1.51
hk# ezjail-admin create -f standard backend1.ftmon.org 192.168.1.52
hk# ezjail-admin create -f standard frontend1.ftmon.org 192.168.1.53
hk# ezjail-admin create -f standard frontend2.ftmon.org 192.168.1.53

NOTE:

Warning: Some services already seem to be listening on all IP, (including 192.168.1.53)
This may cause some confusion, here they are:
root sshd 772 4 tcp4 *:22 *:*
root syslogd 490 7 udp4 *:514 *:*

If you get this error when creating jails then make sure that syslog and sshd only bind to the main IP not the jail ips.

/etc/rc.conf

syslogd_flags=”-ss”
inetd_flags=”-wW -C 60 -a 192.168.1.50″

/etc/ssh/sshd_config

ListenAddress 192.168.1.50

To allow for packages to be installed within each jail, I like to reference to the main operating tree packages list for space efficiency.

hk# cd /usr/jails/basejail/usr
hk# ln -s /PORTS ports

Then for each jail fstab add a link to the main operating systems /usr/ports

hk# vi /etc/fstab.ns5_ftmon_org
hk# vi /etc/fstab.frontend1_ftmon_org
hk# vi /etc/fstab.frontend2_ftmon_org
hk# vi /etc/fstab.backend1_ftmon_org

/usr/ports /usr/jails/ns5.ftmon.org/PORTS nullfs ro 0 0

 

You can start up your jails at this point or do a sanity reboot to see if they come up.

hk# /usr/local/etc/rc.d/ezjail.sh  start
ezjailConfiguring jails:.
Starting jails: ns5.ftmon.org frontend2.ftmon.org frontend1.ftmon.org backend1.ftmon.org.

To check the status of your jails, use the jls command.

hk# jls
   JID  IP Address      Hostname                      Path
     1  192.168.1.51    ns5.ftmon.org                 /usr/jails/ns5.ftmon.org
     2  192.168.1.53    frontend2.ftmon.org           /usr/jails/frontend2.ftmon.org
     3  192.168.1.53    frontend1.ftmon.org           /usr/jails/frontend1.ftmon.org
     4  192.168.1.52    backend1.ftmon.org            /usr/jails/backend1.ftmon.org

To connect to a jails use the jexec command.

hk# jexec 1 /bin/sh -o vi
# hostname
ns5.ftmon.org

That’s it.  The next part will be compiling packages in the jails and setting up a webserver.

Source: Setup A FreeBSD Web Server–Part 2–Jails on Setup Tips - Tips on setting up gadgets and software

When you get your raw freebsd srever from your hosting provider, you will usually find it is very out of date and not very secure. Our very first step is to lock down our server.

1. Secure Access To Your Server

The first thing I like to do is restrict ssh access from the internet to be only available from a singe non root user account. You will be amazed when you check your logs how many people try to break into your server via the front ssh door, and root, admin and webmaster are the accounts most people use. So pick something obscure but easy to rember e.g. red1978

useradd red1978

- when asked to Invite red1978 into other groups, select the wheel group this will give red1978 access to “su” to root.

spike# grep wheel /etc/group

wheel:*:0:root,red1978

Now  red1978 is the only account that can “su – root” and enter the root password to become root.

We are still not quite secure because people can still ssh as root from outside.

edit /etc/ssh/sshd_config

and change the corresponding lines to the following

AllowUsers red1978

PermitRootLogin no

For the change to take effect run the following

/etc/rc.d/sshd reload

NOTE: Be very careful here and don’t log out of your current session

if sshd won’t start you might have an error in the configuration file, see below

spike# /etc/rc.d/sshd start

Starting sshd.

/etc/ssh/sshd_config: line 45: Bad configuration option: AuthUsers <— should be AllowUsers

/etc/ssh/sshd_config: terminating, 1 bad configuration options

To verify check your log

/var/log/messages

Jan 4 13:54:22 spike sshd[32339]: error: PAM: authentication error for illegal user red1978 from 192.168.1.42

2. Upgrade Your OS to the latest version

Follow the steps on the freebsd.org website to update your operating system to the latest version.  You will set the instructions in the release notes for the latest release.

It goes something like this.

# freebsd-update upgrade -r X.x-RELEASE

During this process, FreeBSD Update may ask the user to help by merging some configuration files or by confirming that the automatically performed merging was done correctly.

# freebsd-update install

The system must be rebooted with the newly installed kernel before continuing.

# shutdown -r now

After rebooting, freebsd-update needs to be run again to install the new userland components:

# freebsd-update install

At this point, users of systems being upgraded from FreeBSD 7.4-RELEASE or earlier will be prompted by freebsd-update to rebuild all third-party applications (e.g., ports installed from the ports tree) due to updates in system libraries.

After updating installed third-party applications (and again, only if freebsd-update printed a message indicating that this was necessary), run freebsd-update again so that it can delete the old (no longer used) system libraries:

# freebsd-update install

Finally, reboot into x.x-RELEASE:

# shutdown -r now

3. Upgrade port snapshot database

It is really important that you keep up with the latest patches to software. So lets set this up.

Next build /var/db/portsnap database. This will take a long time depending on your host internet connection speed (50MB). The manual says you can disconnect from the internet and this will continue.

spike# portsnap fetch

Looking up portsnap.FreeBSD.org mirrors… 4 mirrors found.

Fetching public key from portsnap2.FreeBSD.org… done.

Fetching snapshot tag from portsnap2.FreeBSD.org… done.

Fetching snapshot metadata… done.

Fetching snapshot generated at Fri Jan 4 09:34:18 XXX 2008:

a9579afcd7adc26b4946d0ac331d0f1d4c3330ec8cf540 77% of 50 MB 131 kBps 01m26s

…

..

Since this is the first time we need to extract the ports directory structure. This will also take a long time to run.

spike# mkdir /usr/ports

spike# portsnap extract

If you do a ls /usr/ports you will see a lot of package snapshots have been installed. It’s not the packages themselves just Makefiles and information on where to retrieve the sources for the packages from.

4. Install some basic packages

First it is important to make sure that no graphics libraries are compiled into your packages where possible. Since you are building a server not a desktop. To do this add the following lines to /etc/make.  There are also a number of other options included that should be disabled.

NO_X=true
WITHOUT_X11=true
NO_BLUETOOTH=  true    # do not build Bluetooth related stuff
NO_FORTRAN=    true    # do not build g77 and related libraries
NO_GDB=        true    # do not build GDB
NO_GPIB=       true    # do not build GPIB support
NO_I4B=        true    # do not build isdn4bsd package
NO_LPR=        true    # do not build lpr and related programs
NO_NIS=        true    # do not build NIS support and related programs
NO_SHAREDOCS=  true    # do not build the 4.4BSD legacy docs
NO_VINUM=      true    # do not build Vinum utilities
NO_ATM=        true    # do not build ATM related programs and libraries
NO_GAMES=      true    # do not build games (games/ subdir)
NO_PROFILE=    true    # Avoid compiling profiled libraries

screen

screen is a must have as it make take hours to compile packages if you have not upgraded them in a while. The benefit of screen is that your work session will stay running if you lose your connection to your server while compiling.

hk# whereis screen
screen: /usr/ports/sysutils/screen
hk# cd /usr/ports/sysutils/screen
hk# make install

portmaster

portmaster handles package dependencies really nicely.

hk# whereis portmaster
portmaster: /usr/ports/ports-mgmt/portmaster
hk# cd /usr/ports/ports-mgmt/portmaster
hk# make install

ezjail

We will talk about jails in the next step. This package makes them easier to manage.

spike# whereis ezjail
ezjail: /usr/ports/sysutils/ezjail
spike# cd /usr/ports/sysutils/ezjail/
spike# make install

In the next  part we will setup jails.

Source: Setup A Freebsd Server– Part 1– Lock It Down on Setup Tips - Tips on setting up gadgets and software

One my other blogs started displaying blank pages whenever I accessed it. There was nothing I could do to recover it. I couldn’t even gain Admin access. I suspected it was a bad plugin or (Gasp) that I was hacked.  Here is what I did to recover it. It took me hours to do the first recovery. It is much much quicker once you know how. Hopefully it will help others to recover in less time.

I went to look for a working backup only to discover that backups had been failing to work (Since fixed – Phew).  So my basic plan of attack was to reinstall WordPress from scratch, that way I could be sure that any hacked files  or bad plugins were removed. The next major strep was to selectively restore wordpress database tables and graphics files.

Here are the steps

1. Backup your wordpress database
   You can do this from your web host control panel or if you have shell access with the following command.

   mysqldump --user=username --pasword=password –lock-all-tables database > blog.sql
   where username, password and databases are the values you used when you originally created wp-config.php  when creating your blog.

2. Make a backup of your blog files
   Download these using your web host control panel or just tar the file up.
   e.g. if your blog is located at blog then in command shell type the following
   tar –cvf /var/tmp/blog.tar blog
3. Completely remove your wordpress database and files
   Since you have a backup of your database and wordpess files this is now OK to do.
4. Create a new empty blog database & then install a fresh copy of wordpress from scratch
   Since we don’t know if the problem is in the database, or in the plugins, or actually hacked wordpress files, we need to re-install from scratch
5. Copy in the plugins you need to wp-content/plugins 
   It is important only copy the plugins you absolutely need and trust. I have seen cases of famous free plugins doing bad things in the background on your blog, like putting in link backs to their site in your blog roll. Make sure you download all plugins again. Don’t copy plugins from the corrupt install.
6. Setup the same permalink structure
   Ensure you have the same permalink and general configuration as your original blog.
7. Activate all the plugins that you used in the previous blog
   Activate and configure your plugins as closely as possible to what you had in your original blog.
8. Copy back image files
   For this step you need to search through your blog.tar for all the directories containing .jpg .png .gif files and restore them
   e.g in my case the following directories and their contents.
   wp-content/uploads
   wp-content/plugs/wp-o-matic/cache
   
9. Prepare to restore your posts and other tables
   Make a copy of your blog.sql backup – e.g. newblog.sql
   Edit newblog.sql and remove entries except those pertaining to the following tables:
   wp_postmeta
   wp_posts
   wp_term_relationship
   wp_term_taxonomy
   wp_terms
   wp_userdata
   wp_users
   wp_wpo_campaign
   wp_wpo_campaign_categoy
   wp_wpo_campaign_feed
   wp_wpo_campaign_post
   wp_wpo_campaign_word
   Depending on your install there may be other tables you may wish to restore.
   NOTE: wp_options may contain the original problem. So it is important not to restore it.  Regardless you would have populated it  anyway when you setup your permalink structure and configured your re-installed plugins.
10. Import your old posts and wordpress data into your new blog
    mysql –D database –u username –ppassword < newblog.sql
11. Clean up your blog
    You should see all your posts being restored. There may be other plugin related tables you absolutely need to restore. Before you do restore them make sure you do a dump of your mysql database, just in case you need to roll back.

I hope this helps you get out of a mess. It saved me once. If you have questions or want me to assist you in a recovery I don’t mind helping for free, depending on my schedule of course.

Source: Recovering A Broken WordPress Blog Without A Backup Copy on Setup Tips - Tips on setting up gadgets and software