Author: dpepper

Overview

A flaw in OpenSSH, discovered and reported by Qualys on Jan. 14, 2016, could potentially allow an information leak (CVE-2016-0777) or buffer overflow (CVE-2016-0778) via the OpenSSH client. Specifically, an undocumented feature called roaming, introduced in OpenSSH version 5.4, can be exploited to expose a client’s private SSH key.

Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks are common threats that every publicly accessible web server faces. The purpose of such attacks, in the simplest terms, is to flood a server with connections, overloading it and preventing from accepting legitimate traffic.

In addition to being able to manage traffic from a specific country or a list of countries, CSF allows you to manage access by country to specific ports. This can be useful if you need to ensure that a particular service is available globally (such as your web server on port 80) but want to restrict international access to services such as WHM/cPanel, SSH, or FTP.

One of the most-requested features on cPanel servers is the ability to manage and filter traffic at a country level. With the ConfigServer Firewall (CSF) plugin in WebHost Manager, you can do exactly that.

One of the most-requested features on cPanel servers is the ability to manage and filter traffic at a country level. With the ConfigServer Firewall (CSF) plugin in WebHost Manager, you can do exactly that.

Prior to making direct edits to the firewall configuration file or changing advanced firewall settings in WHM, a backup of the current configuration should be taken so that the settings can quickly and easily be reverted if needed.

Pre-Flight Check

• These instructions are intended for domain names using Liquid Web’s nameservers.
• If the main domain uses other nameservers, such as at a registrar, you will need to log in there and add an “A” record for the hostname in the main domain’s DNS zone file. The record should point to the server’s primary IP address.

WordPress Optimized Template sites installed via the Sites tab in Manage automatically are backed up each day, with the server retaining the 10 most recent backups. You can easily restore any site from an available backup in the Sites dashboard in Manage.

Using the Command Line Tools

Liquid Web’s WordPress Optimized Template servers come with a pre-installed set of command-line tools designed to simplify common site maintenance tasks. WP-CLI (WordPress Command Line Interface) can be accessed via SSH, and allows you to do nearly anything that can be done from within the WordPress admin interface.

Pre-Flight Check

• This article applies specifically to Liquid Web’s Managed WordPress servers.
  We will be adding a WordPress site directly through the Manage interface, the preferred method for WordPress Optimized Template servers.

Step #1: Open the Server Dashboard

1. Log into your Manage dashboard and click the [+] button to the left of your WordPress Optimized Template server’s name to expand the dashboard.
2. Click on the Sites button in your dashboard to launch the WordPress Sites view.

Step #2: Add A Site

1. To add a site, click the Install a WordPress Site button, fill out the requested information, and then click Add Site to add the new site.
   • Domain Name is the domain name you want to add to the server. If the domain name is using Liquid Web nameservers, a free SSL certificate will be ordered and installed on the domain, and WordPress will be configured to use the https protocol on the site. If the domain name is pointed elsewhere, an SSL can be added later.
   • Username is the WordPress admin user. The username specified here will be used to log into both WordPress and the site’s cPanel account. It must be 16 characters or fewer.
   • Email is the contact information for the site.
   • Password is the credential which will be used to log into both WordPress and cPanel. It should be a strong password, and can contain upper- and lower-case letters, numbers, and basic special characters such as underscores.
   • Verify Password requires you to enter the password again, and will alert you if it does not match what was entered on the Password field.
   • Automatic Updates allows you to choose between automatically updating WordPress itself (Core), WordPress and its plugins (Core and Plugins), or disabling automatic updates altogether (None). It is recommended to at least enable automatic updates for WordPress itself.
2. The site now will be listed in your Sites dashboard, where you can change update preferences or install a free standard SSL on the domain.

Step #3: Review Settings

Once you return to the Sites dashboard in Manage, you’ll now see your new WordPress site listed in the WordPress Sites section. Click on the [+] next to the domain name to expand the view and configure options for the site.