VPS

My Experience with Cloud At Cost VPS

I’ll try to remember to do an update post if things iron out but I wanted to throw out my experience so far with Cloud At Cost, a VPS provider that charges a one time upfront fee for their VPS, as opposed to a monthly subscription or other reoccurring cost.  They had a sale for Black Friday, 90% off (later 80% off).  This meant that for $7, you could buy a VPS, for life.

This seems really really “too good to be true”.  So I did some research.  First, apparently Cloud at Cost has some horrible uptime and shouldn’t be used for anything production level.  I can live with that, it’s cheaper than buying another Pi for a project server, and this one’s in the cloud!

I also read one report that the servers are insecure and CloudAtCost has cancelled accounts for lifetime subscribers for hosting malicious software, after the servers were hacked due to C@C’s poor server security.  This mostly means, nothing production or crucial.  It’s something I can accept the risk of for the cost.

I opted for two of the tier 3 servers at $14 each.  This got me 2x servers with the following specs, 4 cores each, 2GB of RAM each, and 40GB of space each.  What’s notable though is that as near as I can tell, you pay for e cores, RAM, and HD space, it all just pools together in the end and you can build as many servers as you’d like.

That’s what I chose, and paid for.  On my user dashboard it shows that I have 2 products (the ones I chose listed).  Weirdly, I received several additional invoice emails, though I never ordered more, nor was I charged for more nor does my account say I have more.  When I log into the control panel to manage my servers, It shows I have available 28 cores, 14GB of RAM, and 240 GB of hard drive space.  Basically, it’s like I have 6 servers, instead of 2.  I have no idea if they will realize what happened and scale my resources back or not but I went ahead and kept things within the range I paid for, for now.

It took forever to get the initial purchase set up and available as well, though I’m blaming that on the Black Friday sale.

The interface of the site leaves a LOT to be desired.  There is a user dashboard that tells what you’ve purchased at members.cloudatcost.com.  Managing the servers actually occurs at panel.cloudatcost.com.  There isn’t an obvious link between these two sites that I could find.  Also, the panel site said it used your same password but it didn’t work and I had to do a reset to access the control panel.

The servers also took a good while to get spun up, though I’m blaming Black Friday again.  I created one Windows 7 Ultimate server and one Ubuntu 14.04 server.  I was thinking of using the Windows server to run some Corrade bots in Second Life.  Not sure yet on the Ubuntu server.  I could access both servers via the console but networking seems to be offline on both since I couldn’t ping out to anything.  I tried to set up Remote Desktop on the Windows 7 server but since networking is not working, I couldn’t access it.  The same for SSH on the Ubuntu server.

I checked around and others on Reddit had the issue and it seems to be part of the problems this provider has and should resolve itself… eventually.

So the initial experience has been interesting, for sure, and I can definitely say I won’t be putting anything that NEEDS to be up on these servers, like any sort of website for example.

 

 

I Screwed Up

So, for a little while now, one of the sites I host on my VPS has had some sort of malware.  I have no idea how it got there but I have ideas about fixing it if I could find it.  There are plenty of sites that will tell you that your website is infected.  There don’t seem to be any that will also tell you “It’s probably in this file here, go look there.”  Instead it’s all “We’ll fix it for a small monthly subscription of $50/month.”

I think I’ll pass on that one.

Instead, I opted to simply rebuild the website from the ground up.  It’s a simple process really, set up a fresh WordPress install, ad the appropriate plug ins, copy the images in the Uploads folder, and do a quick export/import of the database.  I also wanted to make sure I got the permissions right, to avoid any future malware issues, since this was the likely culprit for how the malware got there.

This is where I screwed up.  Instead of doing a CHMOD on the local directory, I mistakenly did a CHMOD on /* -R.  Or in other words, everything in the root directory, Recursively through each directory.  Or in other, other words, “everything”.  It actually failed to run on a bunch of files, likely because they were in use.  It did however break SUDO, which meant I couldn’t easily try to change anything back.  It also immediately killed every website I host since they all use MySQL which could no longer use it’s databases, because it didn’t have permissions.

I don’t host anything major at least.  A couple of personal blogs, my wife’s two blogs, some side projects like TinyTinyRSS.  My main concern were my wife’s blogs, frankly, no one reads my shit at all anymore (why are you here???), lots of people read both of her blogs.

If this were a physical server, I’d load a recovery CD and backup or even just reinstall from there.  This is a VPS though.  There isn’t a physical machine I can access and really, there probably isn’t even a physical machine at all, not a dedicated one.  There may be a dozen other servers on the same physical machine as my VPS.  Fortunately, with the use of a support ticket, Digital ocean will mount a virtual recovery disc to your virtual server.

So I managed to get access to the server files.  I set about with two plans at this point.  Worst case scenario, I would need to reimage the server and rebuild everything.  I’ve done this sort of thing many times over the years moving from server to server, I’m actually pretty good at it.  Getting the data was the important part, so I started some downloads of the data.  Honestly, this was always the only option, but I was hoping I could get the old set up running because it would make my life easier.  If I could get MySQL working I could make proper back ups instead of trying to use the raw files, something I’ve never done (it wasn’t hard in the end).  So, 50,000 files later, I had all of the needed files downloaded.  I probably could have saved some time and just reinstalled the core WordPress files but I wanted to keep things as pain free as possible to avoid any more screw ups.

How to restore the server.  The problems stem from permissions, as in, nothing has permissions on anything.  So the simplest solution seemed to be to set the files all to 777, or open access to every user, group and everything.  This is absolutely horrible practice for a live server and should not be done.  However, I needed ten minutes or so to dump some SQL files and a few other proper back ups that would be much easier in a live environment.

Setting everything to 777 didn’t work, for starters, all those system files that were previously inaccessible, were now accessible, since the recovery CD wasn’t using them.  So now EVERYTHING became 777.  I don’t know much beyond that other than it flat out refused to work at all now.

Fortunately, I had my files, the important stuff.  The next few steps were simple, re-image the server with a clean install, sudo apt-get on apache2, php5, mysql-server, proftpd, ftp the files in the appropriate places.

This is also where I did right on permissions, like I should have done to start with.  Instead of screwing with permissions themselves using CHMOD, I set the appropriate ownership with CHOWN.  This was partially necessary, for example, the files created by MySQL normally own and belong to the mysql user and group.  The ones I restored, were all owned by root.

I also took this opportunity to pair down some of the cruft I’d accumulated.  I kept a copy, but it all doesn’t need to go back.

I feel like the end result worked out well, everything is mostly back on line.  I found later that something had gone wrong in backing up the SQL files for both Joshmiller.net and Blogging Intensifies.  Fortunately there isn’t anything on JoshMiller.net since I had purged it all.  And I don’t post here super often so I only came up missing 2 posts from my last back up, I was able to recover both posts from Google’s Cache pages.  Everything for both The Zippy Zebra and Treasured Tidbits came over though, which was my main concern.