WordPress

Fucken’a

MMDAS PURAS MMDAS

The fucken site broke and I had no idea why.

Nginx seemed to be okay. PHP seemed to be okay. MariaDB had nothing to do with any of this. But anything PHP-based was throwing a fit and just didn’t work at all and of course logging in PHP is hit-or-miss.

After banging my head for two fucken nights I just backed everything up and nuked the server. Switched fron nginx back to Apache, downgraded to PHP 7.3 and kept MariaDB.

I’m just going to keep stuff on Debian Stable for the time being.


Update 2021-03-02_03-28

I’M STILL DEALING WITH THIS.

Fucken’a Read More »

Block attacker IP addresses, four ways

If you run WordPress you’ve seen these in your web server logs:

132.232.46.230 - - [29/Oct/2020:13:58:41 -0500] "POST /xmlrpc.php HTTP/1.1" 200 259 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_151)" "-"
132.232.46.230 - - [29/Oct/2020:13:58:44 -0500] "POST /xmlrpc.php HTTP/1.1" 200 259 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_151)" "-"
132.232.46.230 - - [29/Oct/2020:13:58:48 -0500] "POST /xmlrpc.php HTTP/1.1" 200 259 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_151)" "-"
132.232.46.230 - - [29/Oct/2020:13:58:52 -0500] "POST /xmlrpc.php HTTP/1.1" 200 259 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_151)" "-"
132.232.46.230 - - [29/Oct/2020:13:58:55 -0500] "POST /xmlrpc.php HTTP/1.1" 200 259 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_151)" "-"
132.232.46.230 - - [29/Oct/2020:13:58:58 -0500] "POST /xmlrpc.php HTTP/1.1" 200 259 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_151)" "-"

Fucken scanners just slamming xmlrpc.php looking for a way in. When this happens CPU usage just goes through the roof for as long as the scan lasts and it could be five minutes, could be six hours, could be all week; before it ends. The gods help you if you’re paying by CPU usage.

So you have to block access to the file. You could just block all access to XML-RPC but doing this will prevent the WP mobile app from working.

We’ll just block that specific IP address but we need to be quick about it; just do a quick one liner on the terminal before the OS just topples over and becomes completely unresponsive or worse.

iptables

This should work for any Linux distribution that has iptables out of the box which is basically all of them.

# iptables -I INPUT -s 132.232.46.230 -j DROP
  • -I: Insert the rule as the first rule to be applied in the INPUT chain. You could use -A (append) but the sooner we get rid of that traffic the less work the CPU has to do.
  • -s: Source address, in this case 132.232.46.230, which belongs to Tencent.
  • -j: jump to the DROP target. If you use the REJECT target you’re just creating more work for the CPU.

Documentation here but the Ubuntu how-to is far more useful in getting people started.

pf

As it is part of both FreeBSD and OpenBSD base installations it should be enabled in /etc/rc.conf but from reading the (almost useless) documentation and looking around the web You need to fuck around with pf.conf first, then you can manipulate the table. This is the first result on the web when you search for “pf block ip address”. So no one-liner that can save your life.

Edit /etc/pf.conf and add

table <badhosts> persist
block on fxp0 from <badhosts> to any
  • Create table named badhosts, and set it to be persistent in kernel memory
  • Block, on interface fxp0 (you’ll want to change this), traffic from rules in the badhosts table to any destination.

Once you have this you can manipulate the table from the command line with pfctl

# pfctl -t badhosts -T add 132.232.46.230
  • -t means pfctl will manipulate the badhosts table
  • -T will show statistics
  • add address 132.232.46.230 to the table

Fucken hell FreeBSD documentation is the fucken worst. Dryer than Melania Trump’s libido. Now, reading through the OpenBSD pf documentation it looks like you can do

# pfctl -t badhosts -T add 203.0.113.0/24

Which will create the badhosts table automatically without having to fuck around with /etc/pf.conf. Don’t know if this will work on FreeBSD though.

ipfw

It is part of the FreeBSD base installation so it does depend on ipfw being enabled in /etc/rc.conf but it looks like you can go

# ipfw add deny all from 132.232.46.230 to any
  • Add rule denying any and all fraffic from 132.232.46.230 to any destination

At least these rules are succint and easy to read. Whomever wrote the documentation seemed to pay more attention to usage at least.

Still, fuck FreeBSD.

Windows

Super easy now that PowerShell is built into Windows itself:

PS C:\WINDOWS\system32> New-NetFirewallRule -DisplayName "Block traffic from 132.232.46.230" -Direction Inbound -LocalPort Any -Protocol Any - Action Block -RemoteAddress 132.232.46.230
  • -DisplayName: The human-readable name of the firewall rule
  • -Direction: Can be Outbound or Inbound. We want Inbound obviously.
  • -LocalPort: Going with any ports because fuck crackers.
  • -Protocol: Same, block all port
  • -Action: Block traffic
  • -RemoteAddress: Specifying only 132.232.46.230

The documentation for the commandlet is super nice. No, I’m not typing ‘cmdlet’.

The old way involved so, so manny clicks. PowerShell makes it easy.


Now all of the previous bits of code cease to have any effect after a system reboot so if you want the rules to be permanent… don’t. Blackhats will just scan from different hosts and different networks so blocking an IP address permanently is just unproductive.

A better solution is to use fail2ban:

There is also CrowdSec but I haven’t personally used them.

This post came to be cos I spent 30+ minutes trying to figure out how to block traffic on a FreeBSD host and their documentation is just… inscrutable. Should you ask for help in their forums you’ll just get told to RTFM.

You end up going in circles, consuming yourself in rage and frustration which does not feel nice. Rage-posting is where it’sat.

Block attacker IP addresses, four ways Read More »

I want a drink and it’s not even 0700 yet

On this here blog I use a few things to help secure everything down and avoid issues, namely, nginx location blocks disallowing access to resources, fail2ban tracking nginx logs to prevent people hammering server or trying to do improper things, and the “Limit Login Attempts” WP plugin.

A combination of all these broke access with the wordpress mobile app. Ended up having to disable the wordpress fail2ban jail and altering some of the nginx directives.

This is going to be a pain in the ass to debug cos the wordpress app doesn’t have any kind of proper error messaging, urgh.

I want a drink and it’s not even 0700 yet Read More »

Flickr, interrupted

Flickr deprecated its support of the MetaWeblogAPI back in 2014 but it’s been working okay so far so I never thought of updating the thing since it was working Just Fine™ and I wasn’t going to start fucken about with this. I’m okay with the state of the thing as it is right now but it’s probably time to start looking at other solutions. Since I—

And then stuff at work went to shit while I was typing this, so I’m getting this from where I left off.

Don’t remember where I was at. I’ll pick up later. Shit to do.

Flickr, interrupted Read More »

Press This

WordPress removed the “Press This” bookmarklet because:

  • WordPress developers are fucking idiots.
  • WordPress developers fucking hate you, the user.

Most of the links I put up on this site were usually through the bookmarklet. “We just want to increase security”, they say, then break the functionality without a proper equivalent in place.

They’re probably friends with Firefox developers, who also like to break with the past without regard to their users.

But what do users know, right? Developers always know better.

Press This Read More »

HTTPS

I done went and got SSL on this here site by way of Let’s Encrypt. It was pretty easy.

Not so easy was the run up to get it installed:

  • Update Debian with latest packages
  • Realize Debian is now on oldstable (jessie)
  • Update Debian to stable (squeeze)
  • BREAK EVERYTHING
  • Kinda-sorta fix it (aptitute still suicides on forking)
  • Run $ sudo certbot --nginx and marvel at how far we’ve come along

The last time I tries setting up SSL was a total pain in the ass, and it only got me a self-signed certificate that all of the browsers kept complaining about.

Yay for one thing taken off the bucket list. As an aside, I changed the permalink structure cos long URLs that use a date/time format are annoying and hard to remember. I got the idea for switching from here. I hear it plays hell with your SEO but I don’t particularly care about it here. Everyday at work I suffer from URLs that mean one thing for one person but something entirely different for someone else depending what they are doing.

Annoying as fuck, let me tell you.

Now I just need to figure out a plugin that will let me type stuff into the WP editor in markdown/commonmark, and not make the plugins kill themselves.

HTTPS Read More »

Big Spam dump!

Large collection of default spam-comments from a slimy SEO tool.

This morning, I woke up to find that someone who was new to the tool (or unclear on the concept) had left a spam with all of the default comment messages in it, dumping the full database of anodyne comments intended to fool both the spam-filter and the human operator into thinking that the sender had read the post and was replying to it.

This should be helpful in blocking future spam.

Big Spam dump! Read More »

WordPress 2.7

Logré actualizar sin que Gengo la hiciera de tos. Aquí esta lo que hice:

  1. Respalde archivos y base de datos.
  2. Desactive todos los plugins excepto Gengo.
  3. Actualice.
  4. Re-configure Gengo y aplique los cambios.
  5. Limpie el cache del navegador.
  6. Mire el sitio. Funcionó.

Si no funciona, trata moviendole a las opciones de Lenguage, pero recuerda de limpiar el cache del navegador cada vez que lo hagas. Gengo le da una galleta al navegador para que recuerde las cosas.

WordPress 2.7 en sí se mira bastante mono. La interfaz para escribir entradas es mucho mejor, razón suficiente para hacer el brinco.

WordPress 2.7 Read More »

WordPress 2.7

Managed to upgrade without having Gengo bitch out. Here’s what I did:

  1. Backed up both DB and files.
  2. Deactivated all plugins except Gengo
  3. Upgraded
  4. Re-configured Gengo settings and applied changes.
  5. Cleared browser cache.
  6. Viewed site. It worked.

If it doesn’t work, try playing around with the Language settings but remember to clear your browser cache every time you do this. Gengo gives a cookie to your browser to make it remember stuff.

WordPress 2.7 itself is pretty good. The writing interface is much better, reason alone to make the jump.

WordPress 2.7 Read More »

Estimado Gengo

Por favor apresúrate en madurar, por que haz demostrado lo que una plataforma bloguera multi-lenguaje es capaz de hacer cuando se implementa apropiadamente. No puedo comenzar a imaginar lo que mi vida en WordPress seria sin haber perdido incontables horas en restaurar bases de datos jodidas cuando no te gusta el nuevo plugin en el directorio de plugins y haces berrinche tenerte alrededor para dejarme bloguear en dos idiomas sin muchos inconvenientes.

Atentamente,
nullrend

Estimado Gengo Read More »

Dear Gengo

Please hurry up in maturing, for you have shown what a truly multilingual blogging platform is able to do when implemented properly. I cannot begin to imagine what my WordPress life would be without having sunk countless hours in restoring fucked up databases when you don’t like the new plugin in the plugins directory and throw a tantrum having you around to let me blog in two languages without too much hassle.

Regards,
nullrend

Dear Gengo Read More »

Finally

The good people at Día Siete are releasing the magazine in PDF files. Hopefully they’ll release old editions as well.

They’re also changing the format of the site, going from a simple advertisement space for the magazine’s contents into a space with its own additional content that is not in the magazine! If it all looks a bit familiar it’s because they’re using WP 2.5.1, w00t

They’re good, and getting better.

Finally Read More »

Finalmente

La buena gente de Día Siete están soltando la revista en archivos PDF. Ojala y en una de esas se animen a soltar las ediciones previas.

También se encuentran cambiando el formato del sitio, pasando de un simple espacio publicitario del contenido de la revista a un espacio con contenido agregado que no viene en la revista! Si de repente se ve un poco familiar el asunto es por que están usando WP 2.5.1, w00t.

Van bien, y mejorando.

Finalmente Read More »