Reclaim’s D.O.A. in Canada

Reclaim Hosting is happy to announce a new shared hosting server in a Digital Ocean’s Toronto-based data center. And while the Toronto data center has been around since 2015, it just got block storage in September. We named this server the pioneer political Canadian hardcore punk band D.O.A. With their first two albums Something Better Change (1980) and Hardcore ’81 (1981) you have arguably the earliest examples of the new punk style that would dominate the 1980s. D.O.A. political anthems like “Smash the State:”

Or “F**cked Up Ronnie” as an early instance of 1980s punks sonic war on Reagan:

In fact, the song has been updated for the times:

It’s pretty telling to hear both Henry Rollins and Keith Morris talk about the impact D.O.A. had on the emerging hardcore scene. 

I love Morris’s description of seeing D.O.A. open up for X in LA. 

So, it seems only fitting to christen Canada’s first Reclaim Hosting server as D.O.A. If any one would like us to move their sites to this new server for whatever reason just submit a support request and we’ll be sure to make it so. 

SSL Everywhere (Again)

It’s almost hard to believe it’s only been 2 years since Let’s Encrypt came out of beta and began providing SSL Certificates to the general public. I wrote a post at the time calling it a turning point for the web, but cPanel support was pretty much non-existent. Since then much has changed. Just 2 months after that post was written we began using a plugin that offered Let’s Encrypt support directly in cPanel for all users on Reclaim Hosting and announced general support for free SSL certificates. In August of 2016 we began employing ways of scripting the ability for domains to get certificates automatically using the plugin and hooks from our billing system and I wrote a post aptly titled SSL Everywhere where I wrote:

After testing over the past 2 weeks I’m pleased to announce that going forward every domain hosted by Reclaim Hosting will automatically be provisioned with a free and renewable SSL certificate by default.

Around that same time cPanel had also made strides to offer their own support for automatic certificate provisioning with a feature announced called AutoSSL. Initially AutoSSL only supported cPanel’s own certificates issued through Comodo but later Let’s Encrypt support was added. Rate Limits employed by both certificate providers made it difficult to truly promise SSL everywhere and one issue we found was that notifications were a real problem.

Normally receiving a notification that your domain was secure would be a good thing, however often we have found this can confuse a customer that thinks they might have been charged for something, or possibly that the email is spam, especially if they didn’t specifically issue a certificate themselves (and remember we were attempting to issue certificates for all users so that would often be the case). Our ideal scenario is one in which all domains have certificates but no one gets needless emails regarding the provisioning of them (success or failure). Our plugin offered such granular notification settings and at the time AutoSSL did not so given the conflict we decided to double down on the Let’s Encrypt plugin and disable the AutoSSL feature across the board to streamline things.

We have more recently found out that there is a key difference between what the AutoSSL feature can accomplish and the plugin we use cannot. AutoSSL can (and has in many cases) replace and renew certificates for expired domains. That is a good thing in that even if you had a self-signed certificate or previously paid for one and it had expired you’d get a new free one. What we didn’t know was that our plugin was not able to do this, so when we disabled cPanel’s AutoSSL feature we suddenly had a large number of domains with cPanel-issued certificates that the Let’s Encrypt plugin could not renew or replace leading to confusion with folks waking up and finding their sites didn’t work over https.

In the past we have pointed folks to our documentation on installing a Let’s Encrypt certificate but remember our goal was that no one was supposed to have to do that. SSL Everywhere was and still is the goal. We needed to fix this. I’ve reached out to the plugin developers who are now aware of the issue and have committed to working on a fix that could be released along with wildcard support in the next 2-3 months. But that’s a long time to continue fielding issues of certificates not renewing which can render a site inaccessible.

We decided this week that a better short term solution was to turn the AutoSSL feature back on and have it issue certificates for any domains that did not have them or were expired. We would continue to have the Let’s Encrypt plugin exist but with the goal being that users would have a certificate from one or the other automatically and either way they would be renewed automatically. Unfortunately an attempt to ensure that users didn’t receive a bunch of notifications of this failed. cPanel provides an API call to change the setting and it returned the correct response so I didn’t think to check and make sure the setting was actually changed and it wasn’t. Long story short there, many users got emails for every certificate provisioned. But we’ve fixed that now so that the emails won’t be sent in the future and meanwhile the good news overall is that I think we’re much closer to the goal of SSL Everywhere, provisioned by default and renewed automatically with no work on the part of users.

We’ll continue to keep an eye on this in case the landscape changes (with technology it always does) and as always reach out if you have any questions or concerns!

Patching Meltdown and Spectre

Patching Meltdown and Spectre

Seems like every 1-2 years we get a major security scare in the form of a global exploit that effects server infrastructure in some fashion and requires a response. We’ve had Heartbleed, Poodle, Shellshock (who comes up with these names anyway?). 2018 didn’t wait long to bring us that gift in the form of Meltdown and Spectre. https://meltdownattack.com/ has a lot of great information about these two exploits but the short story is that rather than taking advantage of any particular software configuration, these exploits expose vulnerabilities in pretty much all modern CPUs. That means not only does this require patching for server admins like me at Reclaim Hosting and across the web, but every operating system from all computers including mobile devices and personal computers are vulnerable. The vulnerability takes advantage of exploits at the hardware as well as software layer to leak data into memory that can then be read by the attacker. It’s not a question of whether or not you are affected, you are affected.

Antivirus can’t block it either, only patching the underlying systems will resolve it and thankfully companies have been hard at work at getting these patches developed since long before the news became public. Intel became aware of the exploit last fall and many major companies have been under an NDA as they developed patches to secure their systems. Due to the complexity of this exploit however, we are still awaiting patches for some systems and now it is public (which will hopefully light a fire under certain groups to get these patches out).

Thankfully when we at Reclaim became aware of the issue last week CentOS, the distribution of Linux that powers over 90% of our server infrastructure and the only supported distribution for cPanel, was already releasing patches. We had to do some testing as well as await patches by Cloudlinux which is a third party that we use for our kernel software, but by Monday we felt confident the patches were safe and we set to work to patch our entire fleet. Normally with maintenance that involves downtime we like to give customers a heads up and with this kernel update requiring a reboot sites would indeed be offline for a few minutes, however we made the judgement call to rip the bandaid off and favor getting these patches in place as soon as possible rather than risk data being exposed as a result of the vulnerability. By 6PM Monday our entire infrastructure that runs cPanel and all CentOS servers were patched for these exploits with minimal downtime across the majority of our servers.

We have a small number of Ubuntu servers that we are still awaiting a production patch on and hope to receive that sometime this week. If you want to make sure you are secure, the best thing you can do is run all updates for your operating system and browser to make sure you’re running the absolute latest version. Due to the nature of the exploit there is no way to trace whether the vulnerability has been taken advantage of (it does not log any of its actions) so it’s particular important to be proactive. I’m proud of the capacity of Reclaim Hosting as a small operation to remain aware of these events and to stay on top of them in a timely manner.

Now can we take a nice long vacation from these major exploits? My spidey sense tells me that’s likely not to be the case as we come to rely more and more on computers and specifically internet-connected devices in our lives. It’s the new normal and the best security we can hope to have is proactive patching and awareness.

Using the Import/Export Tools in WordPress

Lately, I’ve been working with clients to move their website from WordPress.com to WordPress.org. With this request, I use the Import/Export tools to move the content from one site to the other. This tool bundles the content on the site into a .zip file which you can then move to another location. Disclaimer: It isn’t perfect, you only get the content of the site, so things like posts, pages, and settings on the site. The plugins, themes, and media arent’ included, so, if your site has a lot of media, or has a ton of plugins, this tool might not work for you. (I’m writing another post about a plugin that will move everything on the site for you so stay tuned).

As I’m writing to the clients with instructions on how to set up their site using these tools, I started looking for a tutorial that would walk them through the process. And can you believe it, there are no tutorials that show the process from start to finish? So I wanted to take the time to write the process down. This article will showcase the import/export tools within WordPress (.com and .org) the process is essentially the same for both, they just look a little different.

But wait, there are two versions of WordPress? Yes, there are, but they are run in different ways.  WordPress, in a nutshell, is an open-source content management software (if you want to look at a more in-depth explanation you can read about it here).  Automattic Inc. helps develop and maintain this software. We offer this software at Reclaim and users can install an instance on their domain, in fact, you’re reading this post on a WordPress installation.

WordPress.com is Automattic Inc.’s hosting company that runs the WordPress software explicitly. They offer free accounts with subdomains like meredithfierro.wordpress.com for free or users can purchase a domain. Then users can opt-in to pay a monthly fee to get full use of the software, like you would if you installed WordPress on your domain through your hosting company.


WordPress.com

Export:

The first thing you’ll want to do is export all of the content. Also, take note of the plugins and theme the site is using (this will save time on the other side).

  1.  Click ‘Settings’ under ‘Configure’ 
  2. Click ‘Export,’ under the ‘Site Tools’ section:
  3. From here you can choose the amount of content you’d like to export, or you can export the entire content on the website. When you’ve decided what to export, click ‘Export’: 
  4. WordPress begins to package the content together. When it finishes, a banner should appear at the top of the screen. Click ‘Download’: 

Read more

Look a(nother) Ghost

Since May of 2014 I have been playing on and off with the blogging platform Ghost. It has been an on again off again affair, and I have never left WordPress for it, but rather use it as a test bed for exploring how Reclaim might host applications outside the LAMP stack—an ongoing theme for us over the last 3 or 4 years. So, I have been marking my progress with running Ghost both here on the bava as well as on my Ghost blog. I talked about the idea of this as the Next Generation Sandbox, experimented with getting Ghost running on AWS using Bitnami, feeble terminal work, setting up key pairs in AWS, moving to Reclaim’s container-based setup for a kind of multi-site Ghost, setting up mail for Ghost, and most recently using Cloudron to setup Ghost.

Seven posts over three years about (and on) Ghost is not that much in the end (running out of punny titles), but reading over them whiling writing this I realized there’s a lot of learning wrapped up in trying to figure out AWS, Bitnami images, command line, Docker containers, and Cloudron. All stuff I have been trying to focus on more an more, so this side site in many ways lives up to its subtitle: “Letters from the Cloud.” And I came back to it recently because while I blogged about setting up Ghost through Cloudron back in September, my Ghost instance on Reclaim had been terminated when we decided to no longer offer it through Reclaim Hosting. Given my Ghost blogging had been dormant for a while, I totally forgot I was hosting it through Reclaim and it vanished. Luckily I blogged everything on Ghost through the bava, so nothing was lost, and I had backups of all images, etc. So, I used the occasion of things finally slowing down at Reclaim Hosting and my being under the weather to finally get BavaGhost back online, and now it is!

Read more

RH Youtube

After filming bits and pieces of Workshop of One’s Own, plus Reclaim Hosting’s upcoming marketing campaign, Reclaim Video, it has only seemed natural to revamp Reclaim’s Youtube Channel as well. You may remember seeing episodes from Tim’s Reclaim your Domain video series— it’s my hope that we’ll be bringing these back & adding to them over the next few months. I’d love a larger video presence in our community support documentation and DoOO admin documentation, so continuing this video series seems like the perfect place to start.

View GIF

Current Playlists:

+ Reclaim Your Domain: An introductory video series that walks you through all the steps of getting an account on Reclaim Hosting and immersing yourself in the tools available to build out your domain on the web.

+ Support Guides: An archive of support guides that will be embedded within our documentation.

+ Getting Started with WordPress: WordPress-specific support guides.

+ Workshop of One’s Own: Recorded talks from the Workshop of One’s Own event. We’re hoping these will look a little more advanced after our Spring ’18 workshop. 🙂

Read more

Colgate University Training

How is it already the end of November..? I wanted to set aside time this morning to write about my experience at Colgate University a few weeks back before I turn around and it’s suddenly 2018! After the Reclaim trip to NYC, Jim and I traveled to Hamilton, NY for a two-day training session with members of the Learning and Applied Innovation Team and IT Department. But before getting into the content summary– you can’t talk about Colgate without first mentioning the campus. There’s a reason it makes the list of most beautiful college campuses in the states; it really is stunning. My photos throughout this post will hardly do it justice, but I’m including them anyway. 🙂

On day one, Jim and I met early with folks over coffee & bagels. Jim then began the first block by speaking on how DoOO came to be and how it has transformed over the last few years. I’ve heard this talk a handful of times now, so I was able to see past the initial content and focus on how I would approach a similar talk with my own twist. I’ve been shadowing Jim over the last year or so with the idea that I’ll eventually be able to give these talks & trainings on my own, so it felt good to find the headspace to think through some of that.

Next, Jim and I moved into an overview of the Domain of One’s Own platform, bringing everyone up to speed on how WHM, WHMCS, and WordPress work together. Jim gave an introduction to the system, separating out the ‘need to know’ items from the ‘you’ll never really use this’ functions. From there I gave a more detailed outline of WHMCS & WHM and began to walk through the platforms in depth before lunch. We picked up where we left off after grabbing a bite to eat with more hands-on practice in WHM/WHMCS. Similar to one of my sessions during Workshop of One’s Own, we worked through common support troubleshooting fixes, user FAQ’s, and approaching support tickets. We also talked through setting up site syndication, domain transfers and even touched briefly on SPLOTs. And just like that, day one had come and gone.

We spent the bulk of day two feeling out the needs and curiosities of those in the room, focusing heavily that morning on relevant ways to use WordPress, Omeka, Scalar & Drupal. It was cool to watch the team brainstorm and think through ways that their community could take advantage of these tools. I love using slavery.georgetown.edu as an example of an integrated domain for this sort of discussion. Georgetown takes a controversial topic and faces it head-on using WordPress for the main domain and Omeka for the archive. They also embed a historical timeline using Timeline JS, so that’s always a great piece to show as well. We also used Keys to Directing as a great Scalar example, Making Modern America for an Omeka Archival site, and Andréa Levi Smith’s course website for showing how DoOO can be used in the classroom.

Andréa’s site was a great segway into where we spent the majority of our time that afternoon: SPLOTs! Her site was built off a template created by Alan Levine called SPLOTPoint. I wrote more about the excitement of the Colgate Team + SPLOTs here, but it was fun to feed off their ideas and play around with these templates in real time. And as Jim discusses here, we found that one of our most valuable moments of the workshop was narrating our thought process of familiarizing ourselves with these templates on the spot. I had never worked directly with the templates that Alan had created, so I was the perfect guinea pig. 🙂

left: SPLOTPoint template; right: Big Picture Calling Card template

I installed the SPLOTPoint template on the big screen (on this example domain) while everyone followed along on their own computers. After tweaking settings and customizing that for a few minutes, we moved onto another SPLOT created by Alan called Big Picture Calling Card (on this example domain). I was asked to narrate my thought process for finding settings/making customizations on the theme & template which led to an hour-long discussion on the future and potential of Domains at Colgate.

This trip was valuable to me personally for many reasons. I felt more confident during the technical training portions of the workshop, compared to scenarios where I’ve shadowed Jim in the past. I also felt capable of carrying my own weight and truly tag-teaming the workshop with Jim, as opposed to interjecting every now and again. Jim also offered his critiques, strategies, and advice for talking at great lengths about Domain of One’s Own (a skill he, no doubt, naturally found) so that was immensely helpful as well. And lastly, I discovered a passion for SPLOTs. I was able to see the true potential of installatron templates during the discussions over those two days, and am very much looking forward to their future in Domain of One’s Own and beyond.

Workshop of One’s Own: Spring ’18 Dates

After the success of our first Workshop of One’s Own a few weeks ago, I’m happy to report that we will be hosting another Domain of One’s Own Admin workshop this coming Spring. If you’re new to this discussion, Workshop of One’s Own is a two-day, intensive dive into supporting Domain of One’s Own on campus. This workshop is meant primarily for folks that are administering this project on the ground floor, working with & supporting their communities directly.

For our first workshop, we reached out to folks personally that we knew would not only benefit from the training, but would help us work out beginner’s kinks. Now that we’ve found our groove, Reclaim Hosting would like to open the Spring workshop to the entire Domain of One’s Own community. This event is different than anything we’ve done in the past because it offers very focused, one-on-one training with all Reclaim team members for two full days. For that reason, we will be capping attendance at 10 slots. Attendees come to the table with a variety of strengths, skillsets, and experiences that make for informative and well-rounded sessions. So whether you’re new to the DoOO game or a seasoned player, Workshop of One’s Own has something to offer for everyone. Our plan is to continue offering these workshops each semester while we feel there is still a need, so if spaces fill up before you’ve had a chance to register for Spring ’18, do not fret!

With this announcement, we’re also releasing our new Workshop website, located at workshop.reclaimhosting.com. You’ll always be able to find information here about our latest/upcoming Domain of One’s Own workshops, along with details and FAQs about the event. For those of you who are familiar with this location being home to DoOO Admin docs, those can now be found at workshop.reclaimhosting.com/documentation. All links for individual tutorials are the same.

Quick Facts about Spring ’18 Workshop:

When: March 15 & 16, 2018
Where: Reclaim Hosting’s coworking space in Fredericksburg, Virginia
Cost: $900 per registrant
Slots: 10 spaces given on a first come, first serve basis

Topics Discussed in Depth:

• Conceptualizing WHMCS, WHM, cPanel, SSO
• User FAQs
• Strategies for Supporting DoOO
• Site Migrations & Domain Transfers
• Understanding Installatron
• Hands-on tutorials for WHMCS & WHM
• WordPress Multisite
• Security & Site Hacks
• Graduating Exit Strategies
• Cloudlinux
• DNS
• cPanel/WHM & WHMCS APIs

Ready to rumble? Reserve your space for the Spring ’18 Workshop.

Directories for Domains: a Community Approach

Many of us in a certain subgenre of edtech have been working for a long time to try and use RSS to syndicate and aggregate posts from individual blogs into community sites. These sites are sometimes referred to as planet sites, mother blogs, aggregator sites, syndication hubs, etc. A good example of this is ds106, where posts are not only syndicated into the Blog Flow, but also the assignment bank—making for a richer, more targeted contextualization of student posts. Over the last seven years ds106 has syndicated more the 75,000 posts, providing a point of creative contact—if you will.

The syndication and aggregation for ds106 is all handled by FeedWordPress, which can grab the RSS feed of just about any publishing platform that exposes one. In order to simplify things, we’re using a Gravity Form to help automate the sign-up process. It’s far from a perfect setup, but it has been working fairly well for almost seven years now. In fact, it has been a template for other site aggregators, including the first Community directory site that Martha Burtis and Tim Owens built around UMW Domains in 2014 (which is no longer in use).   Read more

Fixing a Database Connection Error

When the site throws the error: Error establishing a database connection, this usually means there is miscommunication between the database and the files in the file manager. What I like to do from here is open up the Files and Tables section in Installatron.

You’re  going to compare the four sections in red to the database file in the File manager.  Read more