Categories
Fixing Stuff Samuel Technology

quick note on setting up offsite sftp backups

So this is just a quick post, essentially notes from setting up offsite backups using SFTP (formally FTP, but upgrading for security).

1.) Open a port in your rourter to all SSH connections to pass through (Wan > virtual server/port forwarding)
2.) Pick a non standard SSH port to limit your networks exposure to unwanted connection requests
3.) Connection to your local machine, in my case a Freenas machine and turn on SSH and allow tcp port forwarding (this option allows for the FTP connection to piggy back on your SSH connection, allowing the SFTP connection)
4.) If FTP connections are not turned on yet on your Freenas machine, turn those on
5.) Test your SSH connection using putty on your local network (use your ip, and port # then connect with your username/password)
6.) Test your SFTP connection using flash fxp or filezilla (again enter in your IP/hostname and proper port then user/pass)

If everything goes as follows locally, the next step is to test the connections from an external network. Again if all goes according to plan then the last step is to connect manually from the host machine you will be downloading files from.

**This last step is important. You need to do this in order to “save the keys” from the external machine. If you notice when you first made the SFTP connection through flash fxp it asked if you wanted to “save the key” for the server as it was new.

Categories
Fixing Stuff Samuel

limiting wordpress logins via IP server wide in WHM

This post is just for my own future use so please excuse the lack of polish. The goal here was to lock down all the wordpress sites on our server for 2 main reaonns:

1.) Our Server was working way harder than it needed to, and this was in a great deal due to the fact that several popular wordpress sites we have on the serve were constantly getting bombarded with bad login requests
2.) This greatly increases the security of your wp-admin section

How to do this:

-login to WHM/cpanel
-navigate to Service Configuration > Apache Configuration > Post VirtualHost Include
-Select “All Versions” of apache
-Add the following code snippet:


# Restrict wp-login

Order deny,allow
Deny from all
Allow from 0.0.0.0.0.0 (replace with your IP address)
ErrorDocument 403 "Not allowed from your IP."

Hit update to save

Categories
Fixing Stuff Samuel

installing SSL cert in google chrome

If you are like me and ran into an issue where you trust an SSL certy (because you issued it on your server) and you want to add a permanent exception to chrome to avoid the annoying SSL warning then you can do the following:

You can permanently install the certificate and then Chrome will trust it. Click on the green padlock, click connection, then certificate information, click details tab, then copy to file. This will export the certificate to a file. Then you can double click and add it to your local store.

cert will be located at:

C:\Users\user-name\AppData\Local\Google\Chrome\Application\41.0.2272.118\file-name

Categories
Fixing Stuff Samuel

Health Insurance

With the Obama care law recently coming into question through a supreme court challenge, it got me thinking on the subject. Specifically, wondering  if there is a better way to achieve affordable health care coverage for poor Americans/All Americans.

Assumptions:
Obama care is the law of the land – so this is an attempt to present a better plan. This is important to note because its assuming that Obama Care is upheld as legal, so this is trying to outline a better system, restrained by the fact that some type of system must be in place since this  law has  been passed. It does not assume we can “throw out” the idea of insurance coverage for poor/under privileged Americans since that is what was voted in place with the Obama Care law.

The goal for this outline is to:
Provide more affordable coverage for All Americans.
Keep the free market involved in the equation so that cost come down instead of rise.
Set every Amercian up so that a catastrophic health incident or accident will not completely derail their life.
Lower the cost of entitlements for the government as a whole.

The Plan:

Currently Obama Care is projected to cover 12 million Americans that were previously un-insured. What if instead of traditional insurance Obama care had opted for this:

-The government would open health savings accounts for every American older than 26 years of age that qualified (lets assume 12 million qualified).

-The government would additionally offer this HSA type of insurance account to everyone when they are born up until they turn 26

-The government would put 2,500$ in the HSA account at the beginning of each year for anyone under 26, and anyone above 26 who qualified (Un-insured).

-The government would negotiate the monthly “premiums” with insurance companies. Lets assume they could get close to what I currently pay ($108/month). So people would be on the hook for $108/month. *This only applies after you turn 26, before you turn 26 the monthly premiums are taken care of.

-The government would let people keep any excess funds they did not spend in their HSA accounts (essentially the accounts could roll over every year just like any normal HSA). Once people turned 65 they would then have access to this account (just like an IRA).

-If people spent all of their $2,500 every year on health related issues, insurance would cover the tab 100% after 2,500.

-Anyone who makes enough money to fund their own accounts by the time they turn 26, can claim their account and transition it into an HSA in their name. This will allow them to get a tax credit of slightly more (how right now people get $3,200 tax write off right now if we fund our own HSA). So lets just say its the same, $3,200 (as an extra incentive to fund your own account, once you change the account into your name you would be allowed to convert your HSA account to one that allows stock market investment).

-if you don’t make enough money you can still qualify to extend your HSA account through the government and get the $ 2,500 a year….. you could maybe have to reapply every 5 years for life, if you never end up making enough money to get off of the government’s plan.  If you do make enough money, then you move to your own HSA because you can take a bigger tax write off.

Costs:

To Offer these accounts for the 12 million un-insured that Obama Care covers would cost the government 30 billion dollars per year. A large number but its pretty trivial if you implement changes to social security or make a small tax increase to cover it (lets raise 30 billion + 100 million to pay for workers to administer the system). So instead of putting all kinds of new regulations in place and overturning the entire health insurance system we would fix the issue of 12 million uninsured people that need help + on top of insurance we would be establishing a retirement account for all of these people at the same time……

*Need to find out how many people in the US currently under 26 for accurate costs on this aspect*

For everyone under 26 this is an especially attractive option. Currently we allow people to get social security once they turn 65, but this plan is backwards. We don’t set people up for success, we try to help them just enough to get by. Instead of continuing social security we could phase it out into this new system (or have some kind of combination). The retirement account would be massive by the time someone turned 65 if they had put 2,500 in it every year, plus after they turn 26 most people would be able to take the account over for themselves, add more money to it, and invest it in the stock marketing compounding their returns.

If you factor the savings of phasing out social security, with the savings of how much cheaper this plan is than Obama Care (projected 1.2 trillion cost over the next decade for Obama care to insure 12 million Americans who previously had no insurance). This plan would be 361 billion over that same life span.

Special notes:

*These HSA accounts would not allow stock market investing.
*banks would be limited to more strict investing standards on these accounts (so that huge stock market fluxations issue would not affect these accounts)

Categories
Fixing Stuff Samuel

Limit wordpress logins via IP address

So we had a little case of someone (or some bot) really hammering us trying to get into some of our wordpress powered sites.  This is a handy trick to allow you to limit logins to wp-login on an entire server by IP address.  You can also achieve this same thing through .htaccess, but this global version is just way easier/quicker to update and manage.  Here is how to do it:

 

Login to cpanel and navigate to:

WHM -> Service Configuration -> Apache Configuration -> Include Editor -> Post Virtual Host Include -> All Versions

Then add the IPs in with “Allow from” at the end AT the end of the file (but before </Files>)  Should look like:

# Restrict wp-login
<Files wp-login.php>
Order deny,allow
Deny from all
Allow from IPAddress
Allow from IP Address
ErrorDocument 403 “Not allowed from your IP.”
</Files>

The benefits of this are:

1.) Your WP site is a lot more secure from brute force/script attacks

2.) You will actually notice a small (or in some cases dramatic) decrease on your server load.  When we implemented this change on our server that was effected by these attacks we saw our server load in WHM decrease to less than 1 and stay there.