In reality, there are many tools to do this, and quite a few are free. I’ve set up Nagios in the past as it’s extremely comprehensive, but it’s also a bit of a nightmare to get your head around and takes a lot of time to get working in the way you want.

For the past six months or so, I’ve been using a fairly new server monitoring tool, Server Density, to handle my monitoring for me. And it excels at the task.

Install takes less than five minutes via a well documentated python script, and once that’s done and your basic config is in place, off it goes. Within minutes you can view the status of your server via the many on-screen charts and grids they have. You can choose to monitor CPU load, memory, processes, disk usage, network traffic, Apache and MySQL, and set custom alert thresholds against each. Then you choose to receive the alerts via email, text or even iPhone push. I use both the email and iPhone options to ensure I’m kept up-to-date. They even have a free iPhone application for you to view your server status on the go.

Over time, the tool will start to learn about your server to get a feel for it’s normal load levels. Once it’s done this it shows you clearly anything that falls outside of those levels via ‘anomaly’ tracking.

Boxed Ice, the company behind Server Density, are a relatively new outfit, set up by David Mytton who’s currently still at university(!). They were one of the winners of Seedcamp 2009, an investment program that sees 5 start-ups receiving investment.David posted a great article on the Boxed Ice blog about his experiences with this, which is well worth a read.

Since I’ve had Server Density installed, I no longer wonder whether I’m going to know how my servers are performing. And for the measly price of £7 per month it really is a no-brainer. A great tool and supporting start-ups? It gets my vote!

SmartInsights was created by Dr. Dave Chaffey, a leading author, consultant and trainer specialising in E-commerce and E-marketing education and guidance.

Optima’s work involves the management of all IT resource, creation and management of a heavy customised WordPress portal for the site. The company is also creating a piece of web software that performs analysis of user’s Google Analytics accounts, which Optima is responsible for planning and developing.

Exciting times ahead!

I’m a long time user of Google Apps for email, and an even longer time user of regular Gmail. As Google Apps (or a regular Gmail account) has a lot of storage space, it seems perfect for the job. I thought I’d see how easy it was to use one of these as an SMTP relay for any mail the server needed to send – and in this case – to send and store my backups.

With a lot of hunting around, I eventually pieced together a solution that worked from a few different sources. So in the interests of helping anyone who needs something similar, here’s how I did it. I’m on Ubuntu 8.04.3 LTS. I’m guessing later versions will be very similar (if not identical).

1. Set up Google Apps/Gmail accounts

I set up two – a ‘no-reply’ account I would use to send all email from the server, and a ‘backups’ account for receiving the backup emails.

2. Install and configure Postfix

There are many, many tutorials out there, and believe me a tried a few. Here’s one that actually worked. Well, mostly. The bit about tls_per_site:

smtp.gmail.com MUST
comp1.bob.com MUST
comp2.bob.com MUST
p>

..skip the p>bit – it’s malformed html.

Do also make sure that you follow the information about setting up the Equifax certificate rather than the Thawte one – Google changed this in September and the system will not work if you use the wrong certificate.

Secondly, after following these instructions through any attempt to send mail was met with the following entry in /var/log/mail.log:

postfix/smtp[7275]: connect to 127.0.0.1[127.0.0.1]:10024: Connection refused

After a lot of looking around, I finally tracked it down to the following line in the main Postfix config file, located in /etc/postfix/main.cf:

content_filter = amavis:[127.0.0.1]:10024

Seems that this is a spam content filter which wasn’t installed correctly. In my case, since all I’m sending is backups, I didn’t need it. Commenting out this line and reloading Postfix (sudo postfix reload) sorted this out for me – mails were now sent.

3. Set up the database backup system

Again, there are many examples of this out there. I used this one (requires PEAR for PHP), and adjusted it quickly to work on multiple databases. Make sure your backup location is writable by the server.

4. Schedule the backup via CRON

Dead simple – create a new CRON task for your user account:

crontab -e

and enter the following line (replacing the path to your backup script as appropriate):

@hourly /usr/bin/php -q /home/[yourhome]/bin/backup.php &> /dev/null

My script runs hourly. Adjust as you need.

And that’s it. Hourly backups taken to a secure ‘offsite’ location with bags of storage space. Just what I was looking for.

I switched from running Windows on my laptop four years ago and using Ubuntu linux instead and even though I’ve since switched to a Mac as my day-to-day machine, once I’d got to grips with the terminal and the sheer power of it, it’s pretty difficult to go back. At the same time I switched from using Windows as a hosting platform (something I’d had a good deal of experience with), to a dedicated server running red hat linux. Over the last four years I’ve got very used to having root access to a range of servers running various linux distributions – these being used to host the range of sites and web applications belonging to the companies I’ve been involved in.

When it came to getting some hosting for myself then, it had to be linux. But I really didn’t want to have to pay the price for a full dedicated server, so I looked around for some linux based shared hosting. Now obviously there’s loads of it. But the more I looked, even though the price was good, I found it difficult to find out just what you got for your money.

I need PHP5 and mySQL as a base, and that’s not a problem – most hosting companies do that. But they restrict how many databases you have, or the size of those databases. And in terms of PHP because you don’t have control over the PHP install in itself you’ve no guarantee that they’ll have the extensions that you need, and on most of the sites they don’t tell you what actually is included. It’s a frustrating experience – chances are you’re going to end up with a system that doesn’t do quite what you need it to. And that wasn’t an option to me.

So, at this point I’d almost resigned myself to paying for a dedicated machine, but before I did I thought I’d just have a quick look to see how prices for Virtual Private Server (VPS) or Grid hosting were doing these days. On a dedicated server if your hard drive fails, there’s a power outage or any other machine problem you (and your clients) are offline instantly until it’s fixed. With cloud technology, your content is distributed over many machines ensuring that you don’t have a single point of failure, while offering you all the other benefits of a dedicated server.

Previously when I’ve looked at this sort of hosting it’s been cost-prohibitive, and I fully expected it still to be the case. But then I stumbled across VPS.net. Owned by the UK2 Group (who also operate UK2.net, which has been running for more than ten years now), VPS.net is a complete cloud based offering.

First of all you pick your number of nodes, each being a self contained chunk of processing power, memory and hard drive space. The more you buy the cheaper each costs, but I started with two nodes for the price of £28 a month. Once you’ve signed up, you’re taken into an easy-to-use administration console. Here you simply ‘build’ your server by assigning a certain amount of nodes to it and picking an operating system, or choose from a dizzying array of turn-key installs offering everything from a basic LAMP (Linux, Apache, MySQL, PHP) stack to an Asterix internet telephony server. And that’s it. Within a minute or so you get root access to your new machine, and you’re ready to go.

To say I was amazed is a slight understatement. But then I realised that you could at any point add or remove nodes on an existing server via simple admin interface with only a minute or so of downtime, and you can even purchase additional nodes on a day basis just in case you’ve got something big coming up. You can grab a snapshot backup at any stage too, and should you ever need to, replacing the live machine with a backup takes around two minutes in the tests I’ve done so far. Very, very impressive stuff.

I’ve been using VPS.net for a month or so now, and aside from some issues they had with their SAN a couple of weeks ago that slowed things down a little, the quality, speed, support and general service has been great. So much so that I can’t quite imagine going back to a dedicated server, even this soon.

If you’re considering hosting and you want all the power of a dedicated server but also the security, resilience and scaleability of a VPS cloud, and all for a very reasonable cost you should definitely check them out – they come highly recommended.

Virtual Private Server (VPS) Cloud Hosting – VPS.net

Now that the dust has settled on the attack, I think it brings an important message to light – just how secure is all of the information we trust to online services such as google mail, google apps and of course social networking sites such as Facebook and MySpace?

Of course, we already know that we should use different passwords for each account that we use online, but in reality, how many of us actually do that? Creating secure passwords isn’t difficult of course, there are a range of sites out there that do exactly that for you such as www.goodpassword.com, and if you use Firefox you can even get a plugin that does this for you – SecurePassword Generator. The problem of course comes in attempting to remember them all – and this is the reason that so many people just end up using the same password for everything.

To get around this, why not try using a secure password manager to hold all of your information. I personally use the excellent 1Password to secure my information on my mac and across to my iPhone, but if you’re on windows there are some great alternatives such as the open-source KeePass. Both of these tools (and many others) allow you to secure all of your security info such as usernames, passwords and other private data while still keeping it very much to hand. There’s really no reason to resort to the one password for everything route.

Of course, this is only part of the problem. The main cause of the security breach at Twitter was that the employee concerned had used a hotmail account as his ’secondary’ email account – the account to which google mail send password reminders if you get locked out of your mail account. In this case, due to Hotmail’s policy of removing accounts after several months of activity, the hacker was able to guess at the employee’s hotmail email address, discover that it was in fact now removed, and simply set it up as a new account again. Once he’s done that it was a simple case of sending the google mail password reminder to this account and he was in. Frightening, eh?

Personally, I think in this case Hotmail has to shoulder some of the burden. Email accounts are, whether we like it or not, unique entities that we use to authorise a great deal of our online lives. Simply removing these after a period of inactivity and allowing someone else to set them up again is not a good idea at all and should absolutely not be allowed.

But of course, it’s not the only problem. The internet was not created to be used in the way that it now is, and that does cause a lot of issues. We will continue to have issues of this nature until we have a single point of authorisation for all our internet activity. While there is some movement toward this (OpenID as an example), even if we did somehow manage to get this used across the web we’d still have an issue similar to the ‘using one password for everything’ if someone managed to break into our openid account.

So, is there a solution? Well there is, but it relies upon two things that will most likely never happen.

1. A single point of authentication should be created, and allowing amendments to this should be strictly controlled. I’m thinking in line with the sort of security used for registering SSL certificates here – multiple points of certification to absolutely ensure beyond reasonable doubt that the person attempting to change details is the person that has the authority over the account.
2. All internet sites use the above method of authentication.

Not just unlikely – this will absolutely never happen. And even if it did, you still have issues. Unless the organisation responsible for the accounts uses a physical method similar to banks (card reader), you’re still likely to have accounts broken into. And implementing a physical method just makes it more difficult for people to use internet services – there would be a lot of people against that.

So in the meantime, we have to make do the best we can. We must ensure we don’t use the same password or username, don’t use the same old security questions (and I’m thinking mother’s maiden name here) and try to secure our data in the best way that we can. Thankfully as internet use increases, more and more tools that enable us to manage the myriad of identities we have appear. We just need to make sure we use them!

Reference material:

TechCrunch article on the Twitter Breach

Cnet News article

and many, many more…

As it turns out, many people have had the same thoughts – there’s a whole load of resources at there on the web on how you can do just that. Here’s just a couple of the resources I used:

Using WordPress as a CMS

101 Techniques for a powerful CMS using Wordpress

As my first venture into this, I set about the redesign of my own site – www.optimasolutions.co.uk, and what you’re looking at now is the result so far.

Are there problems? Definitely. I’ll try to put some of those into a future post if I get time. But the end result is that it’s remarkably easy to get a site up and running with WordPress as a backend, and the advantages it brings are huge – you have an instant resource available to you in the plugin library to do pretty much everything you need, from automatically generating xml sitemaps and submitting them to all search engines, to automating your SEO, to, well, pretty much anything you can think of.

Initial experiment a resounding success then – I look forward to seeing what WordPress can really do when I become more familiar as time goes on.

The system is developed in PHP and runs on a mySQL database, and allows clients to create custom, tiered assessments to run on their staff. They can then benchmark staff against each other in a range of dashboards, put targets against them, etc. It’s a nice piece of software and I was proud of it at the time.

Sadly, the economic climate took its toll on the company and it went into liquidation in April this year, but it has some good clients and like I said, it’s a nice piece of software, so I’ve been in the process of acquiring the rights to it from the liquidators since April. And now it’s sealed.

Optima Solutions IT Limited now has the rights to continue to support existing clients, to continue to develop the software and to sell it to new clients. I’m going to do some work on both the application and website in the next month or so to promote the change of ownership, but in the meantime anyone interested in an on-demand skills assessment platform should take a look at www.skillstrak.com.

More on this soon.