• If you get the error  “Internet Explorer has encountered a problem and needs to close. We are sorry for the inconvenience.” from IE8 (Internet Explorer 8), there’s a chance it is a problem with jQuery specifically a bug with jQuery v1.6.2. The solution is to upgrade to the latest version of jQuery.

    I found the problem via Rob Spangler’s blog post Random IE8 Crashes – “This tab has been recovered”. So all the thanks go to him.

  • After you’ve installed the Chromium browser, there’s a nice Chromium Snapshot Monitor extension that allows you to check the continuous and snapshot repositories for new versions.  However its broken and it hasn’t had any changes for over a year.

    Its only broken because the URLs it checks have changed as pointed out on this page (http://build.chromium.org/f/chromium/snapshots/README.txt – N.B. this link no longer exists, the text of the file is replicated below):

    Looking for builds that don't exist anymore?
    
    Some directories have been renamed.
    
    chromium-rel-arm -> Arm
    chromium-rel-linux -> Linux
    chromium-rel-linux-64 -> Linux_x64
    chromium-rel-linux-chromiumos -> Linux_Builder__ChromiumOS_
    chromium-rel-mac -> Mac
    chromium-rel-xp -> Win

    There’s also a couple of other URL changes that have gone on when you look at which URLs this extension uses.

    You can fix the extension yourself by modifying the application.js javascript code thats in (on Windows – I guess its similar on Linux)

    %LOCALAPPDATA%\Chromium\User Data\Default\
    Extensions\kkmhmcomapkibhfnjbjfaeemdkjeoamh\1.14_0\javascript\application.js

    assuming you’re happy looking at minified javascript.  I’ve done a bunch of search and replaces and other slight URL fixes and it seems that I’ve got it working for snapshots but not for continuous versions yet.

    You’re welcome to try replacing the installed one with my modified version. You can download it from here.

    Hopefully if I get round to fixing the Continuous versions I’ll update this post.

    Update: I’ve got an alpha version of the plugin zipped up here. It required a fix to the manifest.json file to allow permission to access the new Continuous server. To install it: unzip the file | open Chromium | go to Tools > Extensions | enable developer mode | click ‘Load Unpacked Extension’ and find the chromium-snapshot-monitor folder you just unzipped.

  • Update: finally over 2 years after I wrote this, there is a better way of doing this. Use the Chocolatey Chromium package.

    The folks at Chromium make it unnecessarily hard to install the Chromium browser.  This post from ghacks.net does a good job of explaining the basics.

    Here’s what I’ve done to install it for Windows.

    Windows

    1. download chrome-win32.zip (http://commondatastorage.googleapis.com/chromium-browser-continuous/Win/221974/chrome-win32.zip) [updated 9 Sep 2013]
    2. unzip it
    3. move it to your Program Files directory
    4. run C:\Program Files\chrome-win32\chrome.exe

    N.B. the link should be updated based on the current release number.

    To make sure you have the latest release read on…

    Note: I am using the Continuous builds which have gone through more tests than the snapshot builds as used in the ghacks.net post – at least that’s the impression the Chromium Snapshot Monitor extension gives once you install it (Further note: that extension is broken – I’ve made an attempt at fixing it in a separate post).

    The first thing you need is the current release number. This can be found at: http://commondatastorage.googleapis.com/chromium-browser-continuous/Win/LAST_CHANGE. This changes on a daily basis.

    Then use this release number to get to the latest download page. Currently [13 Sep 2013] it is http://commondatastorage.googleapis.com/chromium-browser-continuous/index.html?path=Win/221974/.

    Alternatively (but the page is slow to load) you can find the same folder by scrolling to the bottom of this page (http://commondatastorage.googleapis.com/chromium-browser-continuous/index.html?path=Win/) and click on the bottom folder.

    You want the chrome-win32.zip file from the download page, which contains the following files:

    • chrome-win32.test – IGNORE
    • REVISIONS – IGNORE
    • changelog.xml – IGNORE
    • chrome-win32-syms.zip – IGNORE
    • chrome-win32.zip
    • devtools_frontend.zip – IGNORE
    • mini_installer.exe

    I find the mini_installer.exe to be second rate – it doesn’t install it in the Program Files directory. I’m not sure why they can’t create a proper nullsoft installer for it.

    So as per the start of this section, your best choice is to:

    1. download chrome-win32.zip [updated 9 Sep 2013]
    2. unzip it
    3. move it to your Program Files directory
    4. run C:\Program Files\chrome-win32\chrome.exe

    Upgrading

    As Chromium gets updated quite a lot you may want to upgrade it. As any extensions that you install get stored outside the main Chromium installation directory you can delete all the files in the installation directory and replace them with the contents of the latest zip file.

    1. download chrome-win32.zip [updated 9 Sep 2013]
    2. unzip it
    3. delete all the files from your installation directory (e.g. C:\Program Files\chrome-win32\ as above)
    4. move the files from the unzipped chrome-win32 directory to your installation directory
  • Ten years no eczema (living in healthy London smog). Winter, a move to the country, a few cats, a bit of hard water and some stress later and kaboom the eczema is back. Go to doctor. Doc says, “Get some emulsifying ointment, aqueous cream, oilatum and some hydrocortisone for that eyelid”.  Use all four for a while.  Eczema dies down by the summer and reappears in the winter.  I manage it all along with lots of Aqueous cream.

    Sodium lauryl sulfate

    Having survived the winter, come April 2011 and the eczema flares up and is horrific.  Itch all night – can’t sleep, itch all day – can’t work. Read National Eczema Society (NES) website FAQ on Aqueous cream.   Aqueous cream thins the skin and increases water loss. Its got 1% Sodium lauryl sulfate (SLS aka Sodium dodecyl sulfate aka sodium laurilsulfate) and SLS is really bad stuff.

    I kept telling my better half that Aqueous cream was great and safe.  Its only got a few ingredients, its cheap, there’s no gimmicks or marketing behind it.  Its just paraffin, as long as I don’t light my farts I’ll be fine.

    Emollients not moisturisers

    So what should I use? Read anything on eczema and they say – you gotta use emollients.  None of these perfumed moisturisers, you want emollients.  Yeah get some emollients.

    WTF are emollients?  Emollients are moisturisers (at least so says Wikipedia).  But moisturisers are bad – you can’t use those.  They’re perfumed, they’re bad.

    Look at any moisturiser and its got 100 ingredients – and when chemists only get to use four ingredients (as with Aqueous cream) they still mess it up and put in a chemical (just 1%) that does explicity bad things, so what chance have you got with a 100?  Aqueous cream is 30 years old, its been used by millions, it must be safe. Nope.

    Just tell me one emollient.  Aqueous cream is an Emollient. Oh… great.

    So moisturisers are bad, Emollients are moisturisers and some Emollients are still bad.

    I’m confused. I’ll ask again.  WTF are Emollients?

    Emollients for Dummies [June 2013]

    Update Eventually I found a decent description of Emollients:

    Non-cosmetic moisturisers

    Those lovely chaps at the National Eczema Society, have a page on Emollients and actually print a pdf list for you that was last updated June 2013. I’m going to re-print it here in a slightly less buried and awkward format than they have it.

    Lotions (light preparations)
    • Aveeno
    • Cetaphil
    • Dermal 500 (with anti-microbials)
    • E45
    • Eucerin lotion (3% and 10% urea)
    • Keri
    • Oilatum
    • QV
    • Vaseline Dermacare lotion
    Creams (medium preparations)
    • Aderma emollient cream (with oat milk)
    • Aquadrate (10% urea)
    • Aveeno
    • Avene Trixera Crème emollient
    • Balneum (5% urea)
    • Calmurid
    • Cetaphil
    • Decubal
    • Dermol cream (with anti-microbials)
    • Cetraban
    • Dexeryl
    • Diprobase
    • E45 Cream
    • Elave
    • Epaderm Cream
    • Eucerin (5% urea)
    • Eumobase
    • Hewletts Cream (contains peanut oil)
    • Linola Gamma (removed in June 2013)
    • Lipobase
    • Imuderm
    • Neutrogena dermatological cream
    • Nutraplus (10% urea)
    • QV
    • Vaseline Dermacare
    • Zerobase
    Ointments (oily preparations)
    • 50/50 white soft paraffin/liquid
    • paraffin
    • Diprobase
    • Emulsifying ointment (related to Aqueous cream see below)
    • Epaderm
    • Hydromol
    • Hydrous ointment (oily cream)
    • Kamillosan
    Gels
    • Doublebase emollient
    • Oilatum Gel emollient
    Soap Substitutes
    • Aderma oat milk cleansing bar
    • Aquabar
    • Avene cleansing bar
    • Cetaphil wash
    • Cetaphil cleansing bar
    • Cetraben wash
    • Doublebase Wash
    • Dove Pure and Sensitive Bar (added June 2013)
    • E45 wash
    • Eczmol
    • Elave hand wash
    • Emulsifying ointment (related to Aqueous cream see below)
    • Eucerin Dry Skin Relief Wash (5% urea)
    • Imuderm body/hand and face wash
    • Oilatum soap bar
    • Pinetarsol gel (removed June 2013)
    • Pinetarsol cleansing bar (removed June 2013)
    • Ultrabase
    Bath Additives
    • Aveeno Colloidal
    • Aveeno (bath oil)
    • Balneum
    • Balneum Plus
    • Cetraban bath oil
    • Dermal 600 (with anti-microbials)
    • Dermalo
    • Diprobath
    • Doublebase Bath
    • E45 Bath
    • Eucerin Bath Therapy
    • Emulsiderm Emollient (with anti-microbials
    • Hydromol Emollient
    • Imuderm therapeutic bath oil
    • Oilatum fragrance-free
    • Oilatum Plus (with anti-microbials)
    • Pinetarsol bath oil (removed June 2013)
    Shower Additives
    • QV Shower Products
    • Dermal 200 (with anti-microbials)
    • Doublebase Shower
    • E45 shower
    • Eucerin Shower Therapy
    • Oilatum Shower
    • Imuderm Shower
    Other Products
    • Balneum Plus – anti-itch cream
    • E45 – itch relief cream
    • Emollin – emollient spray
    Products for Children & Babies
    • Babies (removed June 2013)
    • Infaderm bubble bath (baby bath)
    • Infaderm body lotion
    • Infaderm bath and body oil
    • Children
    • E45 Junior hand & body wash
    • E45 Junior moisturising cream
    • E45 Junior moisturising mousse
    • E45 Junior shower mousse
    • Oilatum Junior bath formula
    • Oilatum Junior cream emollient

    What I use

    Interestingly I’m currently banned by my doctor from using anything (for a couple of weeks, until they can run tests to find what my current allergies are).  I cheat slightly and take salt baths. Two cups of sea salt (about 300g) in a bath every day.  Currently my skin is very dry but it doesn’t itch too much.  And its the itching that knackers everything.

    Ask your doctor to test you for allergies (patch test or blood test) – don’t leave until he sends you to a dermatologist.  Its no good if you were tested years ago – things might have changed.

    Update October 2014

    My blood tests came back with cats as my number one allergen.

    When my eczema was bad I tracked everything I took daily in a spreadsheet. I also included a subjective measure from 1-10 of how bad my eczema was – roughly based on what percentage (in 10s, 10%, 20%…) of my body was covered in eczema.

    If you’re interested, I’ve published my Medical diary as a Google spreadsheet.

    1. For about two years I regularly used corticosteroids, a weaker one for my face and a stronger one for the rest of my body
      1. Once the skin was red only steroids did any good, so unfortunately I’ve still found nothing beyond steroids to get rid of serious eczema
    2. Once my eczema got slowly better, I switched to Elidel (it has similar properties to corticosteroids with less side-effects)
    3. I use Dexeryl (in the NES list) as my ‘non-cosmetic mosturiser’ aka Emollient 🙂
      1. It was one of the cheapest ones I could get hold of and does help with dry skin
      2. It didn’t help with the eczema if it was red, but does help preventing dry skin getting worse
      3. I have a weekly bath and shave using Dead Sea salt. Where as Atlantic Sea Salt showed no difference, Dead Sea salt definitely did (but not massively). WebMD does recommend this for psoriasis too
    4. I used antihistimines for a while e.g. Citrizine and Rupatall but I didn’t find that they made any difference

    Notes

    From the Wikipedia moisturiser article, I came across the cosmetics database which has an entire section on Eczema products (not they ever mention Emollients grrr).  That might help when looking for products.

    The BBC has an article on Aqueous cream citing the same study that the NES do.

    Update

    There is a connected cream to this called Emulsifying ointment (its mentioned in the NES list above) , usually mentioned as the base from which Aqueous cream is made. This is a remarkably obtuse name (which I don’t understand why the ingredients of it don’t have to be explained). However Emulsifying ointment is also known as Emulsifying wax. According to the Emulsifying wax wikipedia article is usually made up with a ‘detergent’ sodium dodecyl sulfate i.e. Sodium lauryl sulfate).

  • The SteigenBerger knives are a scam. The http://www.steigenberger-worldwide.com website is a front for selling cheap Chinese (I’m guessing) recycled steel knives. Rob Bevan got scammed by this and wrote a post back in 2004 about this when they were being sold under the name Berghaus and Swissler Royal.  There’s nearly 400 comments on Rob Bevan’s site of people who’ve been similarly scammed.

    The story

    A dutch guy called Jacob called at our house in Belgium today. He was in Belgium on his way back to Holland. They had furnished a flat for a new block of apartments which they had just furnished as a show flat. He had some furniture from the apartment that he didn’t want to take back to Holland. When we went to see him he said that he had just given the
    furniture away. However he said that he had a few knives and saucepan sets left from an exhibition that were a ‘real bargain’ – a 90% discount on the retail price. He offered the knife set and the saucepan set. We paid 60 euros for the knife set.

    Had a quick check with the local policeman – this is not actually a crime because you’ve agreed to buy, its simply a civil matter that is almost impossible to prosecute with because he is a foreign citizen.

    The website

    A domaintools.com check on the steigenberger-worldwide.com site is that its registered by T&U Handel und Service GmbH and a guy called Andreas van de Vinne whose e-mail is steigenberger.worldwide@gmail.com.  The address its registered to is the same address as the contact page on the website in Germany – both could be made up though – I don’t know how strict the Germans are about checking addresses.

    Notes

    An interesting comment by Rob Bevan in his post referring to a forum that is now defunct:

    “I bought the knives and they are horrible. They are a very heavy piece of dull steel. I brought them to a professionell service and they explained, they can not resharpen, as the steel is recycled and too soft. I am using them now in the garden ..”

    There’s a german discussion on the SteigenBerger knives on this forum, or the google translated version.

  • For Orange,O2,Vodafone the 18 month £30/month contract was always the cheapest (ignoring data/text/minutes usage)

    For T-mobile the 24 month £25/month was the cheapest

    I took the Carphone Warehose tariff comparison worked out the overall cost until the contract ends and you own the phone.

    I then figured out how much they’re actually charging you a month versus just buying the thing yourself.

    The actual cheapest total cost was the Vodafone 3GS 18 month £30/month deal at £670.

    iPhone UK mobile tariff comparison (13 Jan 2011) N.B. 1st 2nd
    (from the carphone warehouse)
    Apple UK O2 O2 O2 O2 O2 Orange Orange Orange Orange Orange Orange Orange vodafone vodafone vodafone vodafone T-mobile T-mobile T-mobile Three
    Tariff 0 £25.53 £30.64 £30.64 £35.74 £35.74 £30.64 £30.64 £35.75 £35.75 £35.75 £35.75 £25.54 £30.65 £30.65 £35.75 £35.75 £25.54 £30.64 £35.75 £35.00
    Contract 0 24 18 24 18 24 18 24 18 18 24 24 24 18 24 18 24 24 24 24 24
    iPhone3GS 8GB £428.00 £223.66 £152.17 £121.53 £121.53 £60.26 £139.99 £59.99 £139.99 £139.99 0 0 £119.00 £119.00 £59.00 £59.00 0 £189.99 £79.99 0 0
    iPhone4 16GB £510.00 £305.36 £233.87 £203.23 £203.23 £141.96 £229.99 £169.99 £229.99 £229.99 £119.99 £119.99 £269.00 £269.00 £199.00 £199.00 £139.00 £279.99 £179.99 £99.99 x
    iPhone4 32GB £612.00 £350.30 £336.00 £305.36 £305.36 £244.09 £319.99 £269.99 £319.99 £319.99 £219.99 £219.99 £329.00 £329.00 £299.00 £299.00 £239.00 £329.99 £269.99 £219.99 x
    UKMinutes 100 100 300 300 600 150 150 600 400 600 400 75 75 300 300 600 100 300 600 900
    UKTexts Unlimited Unlimited Unlimited Unlimited Unlimited 250 250 500 500 Unlimited2 Unlimited2 250 250 Unlimited Unlimited Unlimited Unlimited Unlimited Unlimited 5000
    UKData 500MB 500MB 500MB 500MB 500MB 500MB 500MB 500MB 750MB 500MB 750MB 500MB 500MB 500MB 500MB 500MB 500MB 500MB 500MB 1GB
    UKWiFi unlimited3 unlimited3 unlimited3 unlimited3 unlimited3 3GB 3GB 3GB 3GB 3GB 3GB 1GB 1GB 1GB 1GB 1GB N/A N/A N/A NONE
    Tariff x Contract 0 £612.72 £551.52 £735.36 £643.32 £857.76 £551.52 £735.36 £643.50 £643.50 £858.00 £858.00 £612.96 £551.70 £735.60 £643.50 £858.00 £612.96 £735.36 £858.00 £840.00
    Total = (Tariff x Contract) + iPhone3GS 8GB £428.00 £836.38 £703.69 £856.89 £764.85 £918.02 £691.51 £795.35 £783.49 £783.49 £858.00 £858.00 £731.96 £670.70 £794.60 £702.50 £858.00 £802.95 £815.35 £858.00 £840.00
    Total =(Tariff x Contract) + iPhone4 16GB £510.00 £918.08 £785.39 £938.59 £846.55 £999.72 £781.51 £905.35 £873.49 £873.49 £977.99 £977.99 £881.96 £820.70 £934.60 £842.50 £997.00 £892.95 £915.35 £957.99 #VALUE!
    Total = (Tariff x Contract) + iPhone4 32GB £612.00 £963.02 £887.52 £1,040.72 £948.68 £1,101.85 £871.51 £1,005.35 £963.49 £963.49 £1,077.99 £1,077.99 £941.96 £880.70 £1,034.60 £942.50 £1,097.00 £942.95 £1,005.35 £1,077.99 #VALUE!
    Actual tariff = (Total – Apple)/Contract 0 £17.02 £15.32 £17.87 £18.71 £20.42 £14.64 £15.31 £19.75 £19.75 £17.92 £17.92 £12.67 £13.48 £15.28 £15.25 £17.92 £15.62 £16.14 £17.92 £17.17
    Actual tariff = (Total – Apple)/Contract 0 £17.00 £15.30 £17.86 £18.70 £20.41 £15.08 £16.47 £20.19 £20.19 £19.50 £19.50 £15.50 £17.26 £17.69 £18.47 £20.29 £15.96 £16.89 £18.67 #VALUE!
    Actual tariff = (Total – Apple)/Contract 0 £14.63 £15.31 £17.86 £18.70 £20.41 £14.42 £16.39 £19.53 £19.53 £19.42 £19.42 £13.75 £14.93 £17.61 £18.36 £20.21 £13.79 £16.39 £19.42 #VALUE!

     

  • Apache phpMyAdmin spam-pot

    This is for preventing 404 errors when hackers try to guess your phpmyadmin setup file location. This is based off the project honey-pot concept. The bot stops searching once it finds a file its after and thus reduces the load on your server (actually this is not strictly true, sometimes they will just search for every directory regardless).

    1. Created a spam-pot php page.
    2. Copy the basic folder structure that they search for e.g. sometimes its config.php rather than setup.php
    3. Create a shed load of Apache AliasMatch rules to redirect the various requests to the spam-pot directory

    PHP spam pot

    Its just a one line php file.

    error_log(sprintf('phpMyAdmin hacking attempt %s %s', $_SERVER['REMOTE_ADDR'], $_SERVER['PHP_SELF']));

    Directory structure

    • spam-pot/
      • index.php
      • main.php
      • config/config.inc.php
      • scripts/setup.php

    Apache config

    Spammers try all sorts of different directory structures, AliasMatch helps with that, but then the below is required to capture the final specific directories they try.

    AliasMatch ^/.*PMA/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*PMA2005/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*PMA2006/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*pma/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*/administrator/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*database/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*database-admin/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*databaseadmin/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*databasemanager/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*databaseweb/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*/db/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*db-admin/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*dbadmin/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*dbmanager/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*dbweb/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*myadmin/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*mysql/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*mysql-admin/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*mysqladmin/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*mysqlmanager/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*p/m/a/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*pMA/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*pMA2005/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*pMA2006/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*php-my-admin/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*php-myadmin/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.2\.3/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.2\.6/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.2\.7-pl1/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.5\.1/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.5\.4/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.5\.5/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.5\.5-pl1/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.5\.5-rc1/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.5\.5-rc2/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.5\.6/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.5\.6-rc1/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.5\.6-rc2/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.5\.7/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.5\.7-pl1/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.6\.0/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.6\.0-alpha/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.6\.0-alpha2/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.6\.0-beta1/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.6\.0-beta2/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.6\.0-pl1/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.6\.0-pl2/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.6\.0-pl3/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.6\.0-rc1/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.6\.0-rc2/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.6\.0-rc3/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.6\.1/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.6\.1-pl1/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.6\.1-pl2/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.6\.1-pl3/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.6\.1-rc1/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.6\.1-rc2/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.6\.2/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.6\.2-beta1/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.6\.2-pl1/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.6\.2-rc1/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.6\.3/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.6\.3-pl1/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.6\.3-rc1/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.6\.4/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.6\.4-pl1/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.6\.4-pl2/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.6\.4-pl3/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.6\.4-pl4/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.6\.4-rc1/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.7\.0/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.7\.0-beta1/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.7\.0-pl1/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.7\.0-pl2/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.7\.0-rc1/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.8\.0/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.8\.0-beta1/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.8\.0-rc1/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.8\.0-rc2/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.8\.0\.1/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.8\.0\.2/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.8\.0\.3/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.8\.0\.4/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.8\.1/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.8\.1-rc1/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin-2\.8\.2/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpMyAdmin2/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpadmin/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpmanager/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpmy-admin/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpmyadmin/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpmyadmin1/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*phpmyadmin2/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*pma/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*pma2005/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*pma2006/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*/sql/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*sql-admin/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*sqladmin/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*sqlmanager/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*sqlweb/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*sysadmin/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*/web/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*webadmin/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*webdb/(.*\.php)$ "/var/www/html/spam-pot/$1"
    AliasMatch ^/.*websql/(.*\.php)$ "/var/www/html/spam-pot/$1"

  • Database Crash

    On a few separate occasions the database has become overwhelmed with ‘too many connections’ and then starts rejecting people from trying to view the website.

    We are running:

    • Fedora
    • MySQL 5.0.27
    • WordPress 3.0.1 (the problems all occurred with WordPress 2.7-2.9)
    • phpBB 2.0.23
    • PHP 5.1.6

    Current solution

    The database has now been up for 220+ consecutive days. The main solutions were:

    1. tune the database according to MySQLTuner
    2. defragment the tables weekly based on this post
    3. put in place WP-Cache for WordPress
    4. Bad Behaviour for WordPress
    5. PhBad Behave based on Bad Behavior for phpBB
    6. finally create a Spam Pot for phpmyadmin sniffing based off the idea of the project honey pot site (see below).

    I also put in place a cron job that tries to connect to the database every 15 mins, if it gets a ‘too many connections’ error, it tries to restart the webserver. It calls a shell script connection-test.sh that runs a php file in the same directory. It was almost completely ineffective – by the point it kicks in the webserver has ground to a halt.

    If this doesn’t solve the problem read on…

    [ACTION] Log what happened

    Logs:

    • /var/tmp/php.log – will show php error messages of failing to connect to the database.
    • /var/log/httpd/access_log – will show who was accessing the site when the database errors occurred.
    • /var/log/httpd/error_log

    First log what is happening, the extended-status command has a few useful variables you should check:

    $ su -
    $ ps -ef > /tmp/all_processes_[DDMMYY].txt
    $ mysqladmin -u root -p processlist > /tmp/db_processes_[DDMMYY].txt

    You should also log this, but once the server is back up and running:

    $ mysqladmin -u root -p extended-status > /tmp/db_status_[DDMMYY].txt
    

    [ACTION] Ways to get the server running again

    Access to the server will be slow, but try these fixes in order, they go from the least to the most dramatic.

    First stage

    To fix the problem you can restart the webserver. Its better to call an explicit stop and let the main server begin responding quickly again before starting the webserver.

    $ su -
    $ service httpd stop
    $ service httpd start

    Wait 5 minutes to see if these changes take effect.

    Next stage

    If this fails try restarting the services, note the problems of restarting mysqld :

    $ service mysqld restart
    $ service httpd restart

    You might need to do this more than once if there is no response. Restarting the webserver (httpd) is less drastic than the database (mysqld).

    Wait 5 minutes to see if these changes take effect.

    Final stage

    $ reboot

    You’re on your own if you get to this stage – it shouldn’t require a reboot.

    Other solutions

    Set the interactive_timeout to be one hour, which should kill off dead connections (the 19th Mar attack only lasted on minute and the connections then lay dormant). However by default the connections should have died after 8 hours but didn’t – so maybe a timeout won’t work. According to the first list item below the MYSQL_CLIENT_INTERACTIVE option must be set when making mysql_connect statements.

    Here are a few useful pages on this:

    A reboot of the server should not be required.

    I’ve noticed that the query log file was massive at 6GB. I’ve backed up the log and started a new one.

    Analysis of activity when the crash occurred

    Sun 23-Nov-2008 11:28:23

    PHP Error messages: 1040 (too many connections), 2002 (can’t connect through socket)

    Thu 11-Dec-2008 08:16:05

    PHP Error messages: 2002 (can’t connect through socket)

    Thu 19-Feb-2009 17:45:25

    PHP Error messages: 1040 (too many connections)

    Thu 19 Mar 2009 19:54

    PHP Error messages: 1040 (too many connections), 2013 (Lost connection to MySQL server during query)

    There was a large number of connections from http://www.iguanahosting.com (IP Address 200.6.152.205). They started at 19:54:03 and finished at 19:54:51 i.e. all connections were sent within a minute to the root of our website. This overloaded the WordPress database and consequently the errors show up in the php error log from the forum (I wrongly assumed that it was the forum causing the problem). The database then thrashed around until 9am the next morning when I restarted the mysql server and the apache webserver.

    Fri 24 Apr 2009 04:54

    PHP Error messages: 2002 (can’t connect through socket)

    Similar incident (to 19 Mar 2009) with many mysql queries active. Rebooted server, had to manually restart mysqld. Reconfigured so mysqld would automatically start in future.

    The PHP logs when the database went down are the same as last time:

    [24-Apr-2009 04:54:01] PHP Warning:  mysql_connect() [<a href='function.mysql-connect'>function.mysql-connect</a>]: Lost connection to MySQL server during query in /var/www/html/forum/db/mysql4.php on line 48
    [24-Apr-2009 04:54:02] PHP Warning:  mysql_error(): supplied argument is not a valid MySQL-Link resource in /var/www/html/forum/db/mysql4.php on line 330
    [24-Apr-2009 04:54:02] PHP Warning:  mysql_errno(): supplied argument is not a valid MySQL-Link resource in /var/www/html/forum/db/mysql4.php on line 331
    

    These three lines are repeated, with further errors coming in later:

    [24-Apr-2009 06:36:23] PHP Warning:  mysql_connect(): Too many connections in /var/www/html/forum/db/mysql4.php on line 48
    [24-Apr-2009 06:36:23] PHP Warning:  mysql_connect() [<a href='function.mysql-connect'>function.mysql-connect</a>]: Too many connections in /var/www/html/forum/db/mysql4.php on line 48
    
    [24-Apr-2009 08:56:40] PHP Warning:  mysql_connect() [<a href='function.mysql-connect'>function.mysql-connect</a>]: Can't connect to local MySQL server through socket '/var/lib/mysql/mysql.sock' (2) in /var/www/html/common/include/database.inc.php on line 19
    [24-Apr-2009 08:56:40] PHP Warning:  Missing argument 2 for show_db_error(), called in /var/www/html/common/include/database.inc.php on line 21 and defined in /var/www/html/common/include/dberr.inc.php on line 2
    [24-Apr-2009 08:56:40] PHP Notice:  Undefined variable: email_string in /var/www/html/common/include/dberr.inc.php on line 4
    [24-Apr-2009 08:56:40] Error connection with localhost for , 2002: Can't connect to local MySQL server through socket '/var/lib/mysql/mysql.sock' (2)

    Thu 30-Apr-2009 00:41:17

    PHP error messages: 2002

    The crash seemed to be connected to a rogue spider application from the firm Kintiskton LLC – IP Address range 65.208.151.112 – 65.208.151.119. A Google search on them implies they have affected a few sites. Essentially they flood your server with traffic over a short period of time.

    This time the cron job I set up did perform a httpd restart (at 04:06 and 07:50), which seemed to get the server working again on the second attempt. The cron job calls a php page that attempts to connect to the database and if it fails it calls the shell program ‘/sbin/service httpd restart’. It had previously been calling ‘service httpd restart’ which seemed to result in the follow

    There is a possible fix to the 2002 / 2013 error messages which is to no longer use the socket connection and use a connection setting of 127.0.0.1 rather than localhos, which would avoid using the socket connection. This is treating the symptoms rather than figuring out the cause though.

    It appears that there was some access to the database during the errors (00:41 – ~08:00).

    A further attempt to mitigate this has been to allow a higher max_connections in the /etc/my.cnf at 300 in the hope that the total is too large for 100 but it might max out below 300. This may not be the best solution, but is worth a try.

    Wed 20-Sep-2009 21:13:32

    A similar set of problems occurred again:

    [20-Sep-2009 21:13:32] PHP Warning:  mysql_connect() [<a href='function.mysql-connect'>function.mysql-connect</a>]: Lost connection to MySQL server during query in /var/www/html/forum/db/mysql4.php on line 48
    [20-Sep-2009 21:13:32] PHP Warning:  mysql_error(): supplied argument is not a valid MySQL-Link resource in /var/www/html/forum/db/mysql4.php on line 330
    

    This took three attempts to solve. Firstly by using the First Stage of actions listed above – i.e. flushing the hosts and restarting the webserver. This got the website to come back up, but it got overwhelmed again within minutes. A second restart of the webserver, managed to stop the webserver but failed to restart it. When the web server was started again it came up ok and stayed up.

    The other interesting thing is that the connections that have problems are all to do with the forum. Specifically it is the mail2forum add-in log. The log was in debug mode (set in the file /var/www/html/forum/m2f/m2f_config.php mentioned on the mail2forum website) which largely increases the database access. This means that if there is an issue, the connections fill up very quickly overloading the server.

    I have put the logging down to the standard level now.

    It is worth noting the the first set of database processes that cause the website to crash were due to the forum. After restarting the webserver the database became overwhelmed again, but this time with wordpress processes.

    Sun 04-Oct-2009 21:00:58

    Similar problems to previous (21-Sep) but more severe.

    [04-Oct-2009 21:00:58] PHP Warning:  mysql_connect() [<a href='function.mysql-connect'>function.mysql-connect</a>]: Can't connect to local MySQL server through socket '/var/lib/mysql/mysql.sock' (11) in /var/www/html/forum/db/mysql4.php on line 48
    [04-Oct-2009 21:00:58] PHP Warning:  mysql_error(): supplied argument is not a valid MySQL-Link resource in /var/www/html/forum/db/mysql4.php on line 330
    [04-Oct-2009 21:00:58] PHP Warning:  mysql_errno(): supplied argument is not a valid MySQL-Link resource in /var/www/html/forum/db/mysql4.php on line 331
    [04-Oct-2009 21:01:58] PHP Warning:  mysql_connect() [<a href='function.mysql-connect'>function.mysql-connect</a>]: Lost connection to MySQL server during query in /var/www/html/forum/db/mysql4.php on line 48
    

    Logged all the problems whlist the server was slow. Took approx 40 mins. Flushed the mysql hosts and then tried restarting the httpd service. The PuTTY? connection then stopped responding before the httpd service was stopped. Further attempts to connect via PuTTY failed. Then the server was manually rebooted by the offsite hosts.

    Almost all of the connections to the server were wordpress connections, none especially seemed to be causing a problem. At the time of the crash an IP address in Canada was trying to guess the URL of phpMyAdmin. The first two attempts resulted in a 404 not found error. The next 8 requests gave 500 internal server errors. All the attempts should have returned simple 404 not found requests.

    After following an idea on improving MySQL performance I installed MySQLTuner onto the web server which pointed out that the max number of threads (300) would use up 108% of the RAM. This was probably the reason for having to do a hard reboot. I have set the max threads to be 200 (in /etc/my.cnf) which should max out at 74% of the RAM. Hopefully then the cron job listed above should restart the webserver killing off all the httpd connections allowing the website to come back up.

    Fri 23-Oct-2009 16:47:57

    This crash was on Friday afternoon. There was an abnormally large number of connections from this IP: 147.91.22.101 around the time when the site went down. Doing a google search for this finds that it appears to be some random bot. This article appears to have some good advice on dealing with various spikes in traffic using wordpress databases: http://blog.circlesixdesign.com/2007/01/22/diggproof/

    Tue 27-Oct-2009 22:18:32

    This occurred late on a Tuesday night. Still investigating the cause. The IP: 147.91.22.101 was again the cause it seems.

    Wed 04-Nov-2009 11:29:37

    There were php errrors for about 11 minutes until 04-Nov-2009 11:40:36. Cause unknown.

    Fri 06-Nov-2009 22:26:57

    This occurred on a Saturday morning. The website actually managed to right itself over the weekend – but it was down for approx 24 hours. As a result I tried following some of the MySQLTuner? (see ’04-Oct-2009 21:00:58′ above) advice. The following was added to the /etc/my.cnf file:

    skip-bdb
    log-slow-queries = /var/lib/mysql/ns-slow.log
    long_query_time = 5
    table_cache = 400 #modified from a value of 64

    The table cache was modified based on a conservative value given in the mysql manual. It is releated to the max connections * max joins in a query. We have a max connections of 200 and I gave a conservative estimate of 2 for the max number of joins.

    I came across some posts that indicate that the Simple Tags plug-in we use is causing problems with slow queries. I have disabled this plug-in for now.

    I went through all the tables optimising the ones which were fragmented. There is an excellent post with a script for optimising all the fragmented tables. It uses at its core this SQL:

    use information_schema;
    SELECT TABLE_SCHEMA,TABLE_NAME
    FROM TABLES
    WHERE TABLE_SCHEMA NOT IN ('information_schema','mysql')
    AND Data_free > 0
    

    We’ll see what happens now…

    15-Nov-09 10:24:11

    So the database crashed again. This time though the slow query log (/var/lib/mysql/ns-slow.log) caught what was happening 3 minutes before errors showed up in the php log (/var/tmp/php.log).

    Queries start normally taking 0.02 seconds start taking 6 seconds – there was probably a build up before this as slow logs only kick in at 5 seconds.

    The crash it seems was caused by a large number of queries from 87.115.109.190 from the UK.

    I’m going to try implementing the mysql query_cache and thread_cache as recommended by the MySQLTuner script. The following was added to the /etc/my.cnf file:

    long_query_time = 2
    query_cache_type = 1
    query_cache_size = 16M
    query_cache_limit = 1M
    thread_cache_size = 4
    

    Also the slow query log was set to 1 second to try and capture when the queries start slowing down.

    Finally I’m going to add in WP-Cache to reduce the impact of WordPress. The site doesn’t change very much, so it should be worth it.

    02-Jan-2010 11:12:17

    A host tracker message picked up that the site had gone down.

    It was a ‘too many connections’ problem that seemed to start at 11:01 from some slow wordpress queries:

    use wordpress;
    UPDATE wp_options SET option_value = '1262430076' WHERE option_name = '_transient_doing_cron';
    SELECT option_name, option_value FROM wp_options WHERE autoload = 'yes';
    

    I found people having similar problems in the wordpress forums.

    There appeared to be a possible sendmail attack going on with these processes appearing in “ps -ef”:

    sendmail: rejecting connections on daemon MTA: load average: 123
    sendmail: Queue runner@01:00:00 for /var/spool/clientmqueue
    

    Don’t know if that’s the case but have shut down the sendmail daemon for now.

    At the time when the queries began to slow down there was another hacker looking for phpMyAdmin on our site. The IP Address was 187.146.179.97 which is is Mexico. It logged about 45 requests in 10 seconds. This has happened before (see above) but does not make much sense as to why it should slow the whole server down.

    03-Jan-10 09:59:23

    The website went down with too many connections. It briefly got itself up again but crashed again soon after.

    Attempting to stop the apache daemon (service httpd stop) resulted in the service not shutting down properly. As a result the command “service httpd start” would fail. There was the following error in the /var/log/httpd/error_log file:

    [crit] (28)No space left on device: mod_rewrite: could not create rewrite_log_lock
    

    A google search for the error found that it was leftover semaphores owned by apache that needed to be deleted using the following command:

    for i in `ipcs -s | grep apache | awk '{print $2}'` ; do ipcrm -s $i; done
    

    The command finds all the semaphore ids and does a ‘ipcrm -s’ on each id (which should delete the semaphore).

    I defragmented the tables as suggested in the wordpress forums using the script found on 6-Nov-2009. Also I decreased the max connections and increased the query_cache_size in /etc/my.cnf.

    This appeared to be related to approx 100 hits in 10 seconds from a Saudi Arabian forum spammer over multiple IP Addresses, e.g. 212.138.113.13, 212.138.69.17. Most were listed on the http://www.stopforumspam.com website.

    27-Jan-2010 04:59:17

    This was the first few error messages:

    [27-Jan-2010 04:59:17] WordPress database error MySQL server has gone away for query UPDATE `wp_options` SET `option_value` = '1264568325' WHERE `option_name` = '_transient_doing_cron' made by require, require_once, require_once, require_once, do_action, call_user_func_array, wp_cron, spawn_cron, set_transient, update_option
    [27-Jan-2010 04:59:17] WordPress database error MySQL server has gone away for query UPDATE `wp_options` SET `option_value` = '1264568318' WHERE `option_name` = '_transient_doing_cron' made by require, require_once, require_once, require_once, do_action, call_user_func_array, wp_cron, spawn_cron, set_transient, update_option
    [27-Jan-2010 04:59:22] WordPress database error MySQL server has gone away for query SELECT t.*, tt.* FROM wp_terms AS t INNER JOIN wp_term_taxonomy AS tt ON t.term_id = tt.term_id WHERE tt.taxonomy = 'category' AND t.slug = 'php-my-admin' LIMIT 1 made by require, require_once, include, get_header, locate_template, load_template, require_once, wp_title, get_term_by
    

    Interestingly again there were numerous references to php-my-admin (n.b. t.slug = ‘php-my-admin’ above) as somebody else tried to guess the URL of it.

    This was the access log at the time:

    187.146.181.169 - - [27/Jan/2010:04:56:30 +0000] "GET /dbadmin/ HTTP/1.1" 404 9634 "-" "-"
    187.146.181.169 - - [27/Jan/2010:04:56:30 +0000] "GET /mysql-admin/ HTTP/1.1" 404 9635 "-" "-"
    187.146.181.169 - - [27/Jan/2010:04:56:30 +0000] "GET /mysqlmanager/ HTTP/1.1" 404 9634 "-" "-"
    187.146.181.169 - - [27/Jan/2010:04:56:30 +0000] "GET /phpMyAdmin-2.5.4/ HTTP/1.1" 404 26994 "-" "-"
    187.146.181.169 - - [27/Jan/2010:04:56:30 +0000] "GET /phpMyAdmin-2.5.5-pl1/ HTTP/1.1" 404 9636 "-" "-"
    187.146.181.169 - - [27/Jan/2010:04:56:30 +0000] "GET /phpMyAdmin/ HTTP/1.1" 404 9634 "-" "-"
    187.146.181.169 - - [27/Jan/2010:04:56:30 +0000] "GET /phpMyAdmin2/ HTTP/1.1" 404 9636 "-" "-"
    187.146.181.169 - - [27/Jan/2010:04:56:30 +0000] "GET /phpmanager/ HTTP/1.1" 404 9636 "-" "-"
    187.146.181.169 - - [27/Jan/2010:04:56:30 +0000] "GET /sqlweb/ HTTP/1.1" 404 9634 "-" "-"
    187.146.181.169 - - [27/Jan/2010:04:56:33 +0000] "GET /phpMyAdmin-2.5.7/ HTTP/1.1" 500 358 "-" "-"
    187.146.181.169 - - [27/Jan/2010:04:56:33 +0000] "GET /phpMyAdmin-2.6.0-beta1/ HTTP/1.1" 500 358 "-" "-"
    187.146.181.169 - - [27/Jan/2010:04:56:33 +0000] "GET /phpMyAdmin-2.6.0-rc3/ HTTP/1.1" 404 9635 "-" "-"
    187.146.181.169 - - [27/Jan/2010:04:56:34 +0000] "GET /phpMyAdmin-2.6.0-pl3/ HTTP/1.1" 500 358 "-" "-"
    187.146.181.169 - - [27/Jan/2010:04:56:35 +0000] "GET /phpMyAdmin-2.6.1-pl1/ HTTP/1.1" 500 358 "-" "-"
    187.146.181.169 - - [27/Jan/2010:04:56:35 +0000] "GET /phpMyAdmin-2.6.2-beta1/ HTTP/1.1" 404 9636 "-" "-"
    187.146.181.169 - - [27/Jan/2010:04:56:35 +0000] "GET /phpMyAdmin-2.6.3/ HTTP/1.1" 500 358 "-" "-"
    187.146.181.169 - - [27/Jan/2010:04:56:35 +0000] "GET /phpMyAdmin-2.6.4-rc1/ HTTP/1.1" 500 358 "-" "-"
    187.146.181.169 - - [27/Jan/2010:04:56:36 +0000] "GET /phpMyAdmin-2.6.4-pl4/ HTTP/1.1" 404 9636 "-" "-"
    187.146.181.169 - - [27/Jan/2010:04:56:36 +0000] "GET /phpMyAdmin-2.7.0-pl1/ HTTP/1.1" 500 358 "-" "-"
    187.146.181.169 - - [27/Jan/2010:04:56:36 +0000] "GET /phpMyAdmin-2.8.0-rc1/ HTTP/1.1" 404 9636 "-" "-"
    187.146.181.169 - - [27/Jan/2010:04:56:36 +0000] "GET /phpMyAdmin-2.8.0.2/ HTTP/1.1" 500 358 "-" "-"
    187.146.181.169 - - [27/Jan/2010:04:56:36 +0000] "GET /phpMyAdmin-2.8.1/ HTTP/1.1" 500 358 "-" "-"
    

    Note that the first 9 receive 404 not found errors then the database crashes and most of the rest give 500 internal server errors. Further to this they were actually using two IP addresses at the same time, resulting in 60+ attempts in 7 seconds. Clearly 10 per second is too much for the database.

    As a result of this I have put in place a /spam-pot/ directory that has a blank php page that simply logs a hacking attempt. I have then built a list of apache Aliases that point to this directory based on the 700-odd hacking attempts logged between 18th Dec 2009 – 17 Feb 2010.

    This should prevent these hacking attempts from hitting the database which is the main problem.

    This is based off the idea of the project honey pot site.

    04-Feb-2010 11:00:34

    This was a very temporary error that occurred.

    [04-Feb-2010 11:00:34] WordPress database error MySQL server has gone away for query SELECT *    FROM wp_links  WHERE 1=1 AND link_visible = 'Y'     ORDER BY link_name ASC made by require, require_once, include, get_header, locate_template, load_template, require_once, suckerfish, wp_list_bookmarks, get_bookmarks
    [04-Feb-2010 11:00:34] WordPress database error MySQL server has gone away for query SELECT * FROM wp_users WHERE ID = 5 LIMIT 1 made by require, require_once, include, the_post, WP_Query->the_post, setup_postdata, get_userdata
    [04-Feb-2010 11:00:34] WordPress database error MySQL server has gone away for query SELECT * FROM wp_users WHERE ID = 5 LIMIT 1 made by require, require_once, include, edit_post_link, get_edit_post_link, current_user_can, call_user_func_array, WP_User->has_cap, call_user_func_array, map_meta_cap, get_userdata
    [04-Feb-2010 11:00:34] WordPress database error MySQL server has gone away for query SELECT term_ID FROM wp_terms WHERE name='Asides' made by require, require_once, include, get_sidebar, locate_template, load_template, require_once
    [04-Feb-2010 11:00:34] WordPress database error MySQL server has gone away for query SELECT term_ID FROM wp_terms WHERE name='Featured' made by require, require_once, include, get_sidebar, locate_template, load_template, require_once
    [04-Feb-2010 11:00:34] WordPress database error MySQL server has gone away for query SELECT t.term_id, tt.parent, tt.count FROM wp_terms AS t INNER JOIN wp_term_taxonomy AS tt ON t.term_id = tt.term_id WHERE tt.taxonomy IN ('category')  ORDER BY t.name ASC  made by require, require_once, include, get_sidebar, locate_template, load_template, require_once, wp_list_categories, get_categories, get_terms, get_terms
    [04-Feb-2010 11:00:34] WordPress database error MySQL server has gone away for query SELECT t.*, tt.* FROM wp_terms AS t INNER JOIN wp_term_taxonomy AS tt ON t.term_id = tt.term_id WHERE tt.taxonomy IN ('category')  AND ( t.term_id <> 0  AND t.term_id <> 0 ) ORDER BY t.name ASC  made by require, require_once, include, get_sidebar, locate_template, load_template, require_once, wp_list_categories, get_categories, get_terms
    [04-Feb-2010 11:00:34] WordPress database error MySQL server has gone away for query SELECT * FROM wp_users WHERE ID = 5 LIMIT 1 made by require, require_once, include, get_sidebar, locate_template, load_template, require_once, the_post, WP_Query->the_post, setup_postdata, get_userdata
    
  • Blue Marble

    So I guess I’m not the first to discover this photo, but at the time I posted the photo I bet I was the most recent person to have admired its beauty.

    Blue Marble
    Well… I was impressed
  • Genius

    Open Sarcasm – Just a little bit of genius in the maelstrom¡…