Getting Bigger Means Getting Hacked…
Posted by Stephen on
August 5, 2006
So over the last couple days, I’ve been dealing with restoring LaptopLifestyle, Futurelooks, and this Blog. Apparently, some script kiddies (aka Hackers) got into our Apache server and wreaked some havoc, altering our index and login files. Wayne was awesome in getting us going again, and Ewdi helped out with Futurelooks, getting our CMS back online (Thanks Guys!).
In order to ensure that Futurelooks remains up 100% of the time, I dropped some serious coin on another server that will house only Futurelooks and will be taking special steps to ensure that it is locked down tight. Since Futurelooks is my bread and butter, it gets what it needs to survive. $3000 later, and I’m an owner of a new DELL 1850 Dual XEON Server with a couple of SCSI drives. This should give a huge performance boost to Futurelooks and give it much needed stability and security.
In the meantime, I’ve patched everything up and made backups of everything. I was maybe 80% ready for this attack. Next time, I plan to be 100%. All in all, it was a good wake up call, and if I’m serious about my business, I should have solid equipment and a solid backup plan. Let this be a lesson for other web entrepreneurs to never cheap out on these two things.
It doesn’t matter how fast your hardware is, getting hacked is just a matter of the software being susceptible to attacks. That’s a LOT of money to spend on something that could have been done easily on your current server, simply by keeping the software up to date. Yeow!
Carl does make a good point….
That’s a good point, but in this case, you both should be worried…
The hacker came through Joomla. Since John had moved TTZ far away from the other little websites, only his Joomla sites went down. He did say once that TTZ is his meal ticket, and whatever TTZ wants. TTZ gets. Well, TTZ got a freeticket while his blogs and his Joomla sites got killed. Because Futurelooks was also on the server with my own Jomla sites, it got trashed too.
Since you both run Joomla sites as well, which is open source and vulnerable, I’d be praying it’s not you next. If HCW and TC are important to you, they shouldn’t be residing on a server with a bunch of sites that are at risk, 24/7. This hacker is well known for hacking into open source sites that use Joomla and its derivatives.
The new server will have bare minimum services installed for the requirements on Futurelooks CMS and supporting software and will be locked down tight, with very minimal access. This is how important Futurelooks is to me. What about you guys?
HCW is on its own server, with a basic Apache/MySQL/PHP install. I don’t even have FTP installed on it, because that can be susceptible to attacks. And I was realistic about my hardware needs, and only spent like $800 at Dell (bought a server with SATA and a Celeron, and replaced the Celeron with a Pentium Extreme).
My other server is where my Joomla sites are, and I always make sure to keep them all up to date, and each site is backed up nightly.
It’s not about how much you spend, it’s how you take care of the server. Dual Xeons for your site is overkill, probably for the next 2 years unless you come up with something like Digg.com… But then you’d be worth $200 million and wouldn’t be taking care of your own server anymore
A server is an investment that I would rather spend extra money now, and not have to pull an old server offline to replace it later. If you remember how many times we had issues with trying to fix my first server, this is my second chance and I won’t fuck that decision up this time with a cheap hack of a server.
It’s unlikely that I will grow out of this server. In addition to a ton of RAM, it will support up to 320 gig SCSI drives, and can run two Dual Core XEON’s if I’ll ever need it. I would not be surprised if this thing lasted me the next 5 years. I would not hesitate to spend on things that give me peace of mind and allow my business to run at its best possible performance, even if it is overkill.
Since the site is my lifeline, then it’s kind of like this. If you were on a sinking boat, and you had a choice between a life preserver that “Did the Job” and one that was “Overkill”, which one would you pick while you float around in the ocean?
Oh, and this price included my Redhat Enterprise License and taxes, and shipping. The server was only about $2000 in Canuck Bucks.
Yeah I dont need to worry about being hacked, eveything is backed up (files, mysql, etc) each night to a box that is right beside me, but it is a pain to get everything back up and running if you are hacked.
I’ve got something like that here, but I would really like to have something that was like an offsite mirror so I can just restore whether I’m at home or not. If all my stuff was here while I was overseas, I wouldn’t be able to restore my site till I got home, and that would suck.
Buying a nice server and keeping your “food site” is always a good decision. Unfortunately everyone learns the bad way, we swapped servers when our last machine couldn´t handle our traffic and wen´t down every 5 minutes.
Even thought the machine you bought is definitely bigger than your needs, at least you won´t need to upgrade it or change something in quite a long time. And that helps for your uptime, at least I don´t like to let my website down for even 2 minutes.