Modwest Blog

Migrate to a Faster Database Server in Minutes

Earlier this year, we deployed another MySQL database server (db2.modwest.com) for our shared hosting customers. It's a beast of a machine, and still has lots of horsepower to spare. In fact, compared to db.modwest.com, it's roughly 4x more powerful and currently doing a lot less work.

In addition to having lots of power to spare, db2 is also running MySQL 5, rather than MySQL 4.1. Version 4.1 will be "end of life" at the end of this year, meaning that MySQL will no longer provide bug or security fixes for it. MySQL 5 has some cool new features, as well, and so we encourage everyone with databases hosted on db.modwest.com to switch them over.

Most modern applications (such as Joomla, Wordpress, or Drupal) should be perfectly happy with MySQL 5; though if you have a custom application, you should probably ask your webmaster to read through MySQL's guide to upgrading from 4.1 to 5.

To make one step in the migration process easier, we've recently whipped up a web tool to copy a database from one server to another. It's here:

•  http://dbcopy.modwest.com

We hope you'll enjoy the increased performance of db2, and the increased features and security of MySQL 5, and let us know of any trouble along the way.

Alternatives to FTP

We're not quite ready to say "R.I.P. FTP", but it's true that FTP has an inherent security flaw: your username and password are passed in clear text from your computer to the server. This means that  malicious software on your computer could trivially capture your FTP credentials the next time you update your site.

We were alerted recently when a customer reported that some files in their website had been modified to include a strange looking IFRAME tag, which apparently loaded malicious code from a server in Russia every time a visitor arrived at the page. This prompted Google to temporarily list the customer's site as "Dangerous" in search results.

A quick check of the logs indicated the customer's account had been logged into via FTP from many IP addresses around the world, some of which uploaded the various malicious changes to the site. Our customer was able to securely upload a clean backup, and changed of course their password immediately.

We're not sure how the bad guys got ahold of this customer's FTP credentials, but if this was a case of spyware on the customer's PC capturing his cleartext username and password during a site update, then using an alternative to FTP could have helped avoid this painful event.

Two of the simplest alternatives are SFTP and SCP. Both protocols encrypt the connection from beginning to end, so cleartext "sniffers" can't read the traffic. SFTP support is often built in to FTP clients such as FileZilla, Cyberduck, and the built-in client of Dreamweaver, but may not be enabled by default. Check the help files for your favorite file upload program to learn how to enable SFTP.

WinSCP provides SCP and SFTP support, and a familiar Windows Explorer style interface, too.

There are no important differences between SFTP and SCP (both encrypt authentication and file transfers), so use whichever one your program supports. If your file upload program only supports old-fashioned FTP, it is time to upgrade.

New Database Server Deployed

We've just deployed another MySQL database server for customers on the shared system. It goes by the name of "db2.modwest.com", and it's running MySQL 5. It's a powerful, brand new server and we encourage anyone using the older database servers to switch.

Adding a new database on the new server is easy. Just log into OnSite and click Add or Drop Database. Right now, the migration process is manual, but we'll be glad to assist upon request. One caveat: if you're running an older PHP application and currently using "db.modwest.com" (which runs MySQL 4.1), double check that your application is compatibile with MySQL 5, because there are some differences, such as new reserved words.

Enjoy!

Feedback Community Launched!

Since our open beta announced in October, we've had some really helpful input by a handful of Feedback Community members, fixed a few things, and improved a few things. So it's time to draw back the curtain and invite all Modwest customers to participate.

Marianne is our Community Manager and as she said in an email invitation this morning:

It's not a survey. It's not really a forum, either. It's probably like nothing you've seen before, and if you visit the site you'll see what I mean.

• Share your ideas and feedback
• Discuss web hosting (and other web topics) with us and other customers
• Win prizes for participating in contests
• Let's get to know each other and hear what everyone has to say!

We also have some contests with real prizes planned, so we hope you'll check it out.

You can log in to the Feedback Community with any valid OnSite username, so feel free to forward your invitation to all your mailbox owners too!

See you in the "MFC"!

-JM

PHP Versions at Modwest

We've had a few requests recently about upgrading PHP on the Modwest shared system. We specialize in PHP hosting -- we have substantial expertise in this arena -- but as of March 2008, we're not running the latest stable release of PHP on our shared system. We're running 4.4.6 as the default PHP version for new accounts, and the PHP development team currently recommends version 5.2.5.

There are a few technical barriers to upgrading the shared system, some of which I've hinted at in previous posts. The Modwest shared system is a centralized SAN-attached storage architecture, and in its current incarnation, there is only one technical server environment possible for all customers. This environment, despite periodic security and stability updates, is in many ways the same as it was in 2001 when we built it.  That is going to change in 2008.

In the meantime, here are the options available to customers on the shared system who would like to (or need to) utilize a more recent version of PHP.

• You can switch a site to PHP 5.0.4 in OnSite under 'PHP Configuration'.
• PHP 5.2.0 is also available on the shared system, but it's incomplete. Some new extensions simply cannot be installed in our current environment. More info about these first two options is in the FAQ.
• Both VPS plans and managed servers provide PHP 5.2.

But the long term solution is to offer our customers on the shared system an array of choices with regards to their hosting environment. That's what we have planned. Customers whose web applications require the latest PHP version, extensions, and libraries, will eventually be able to configure their accounts to accommodate these requirements. Customers whose web apps are running just fine as is won't need to change a thing.

We intend to continue being an excellent hosting choice for PHP developers. We may be slightly behind the curve currently, but we've got some great things in the works. If you'd like to beta-test the new environment this summer, just let us know by writing to feedback at modwest dot com.

-JM

Carbon Calculator

First, an introduction: I'm Jody Tate, the web production manager for Modwest. That's a long title that means, in short, that I'm generally your first point of contact at Modwest when you'd like us to build a website from scratch or if you just need a phone number updated on your current site.

I wanted to write today about the Carbon Calculator recently launched by one of our development clients, Friends of the Forest, a program of the National Forest Foundation, also one of our clients.

We developed the calculator for them over the last several months, but I hesitate to say we. I watched as Colin McCann and Dustin York, two of our developers who specialize in making PHP and MySQL sing in harmony, pulled off the programming. Cole Moeller, another member of our team, designed the calculator logo.

You can read a bit more about our development team and peek at some of our other projects on our design site. The Carbon Calculator is a great example of the sort of work we do in the web design and development department, but it's just one of a ton of projects we have in the works. I'll be posting more about those soon, so check back for updates.

-Jody

MIVA Misadventures at Modwest

Modwest has offered MIVA as our e-commerce solution for several years. Despite some administrative complexity (both on the server and client side), we've found it to be the most feature-complete shopping cart application on the market. Recently, though, it's presented some new challenges, some of which have affected a minority of our customers' hosted stores.

Over the last week or two, with about 15% of our hosted stores, we've seen intermittent lock-ups that cause the store to become completely inaccessible. Since there is no good way for us to know immediately upon a store malfunction, sometimes the store owner notices first and notifies us, and sometimes our server administration team notices first. After a great deal of research, we've determined a workaround which frees the store up and allows it to continue functioning, at least temporarily. What we haven't found yet is a way to prevent it from happening in the first place.

While we don't anticipate it'll permanently fix the problem,  we will be upgrading MIVA Empresa on Sunday, just in case it helps (as recently announced in OnSite).

Because our confidence in our ability to reliably provide MIVA software has dipped, at least temporarily, we're suspending installation of new stores until we're confident the situation is resolved appropriately.

Technical analysis of the problem:

Modwest runs a load-balanced cluster of web servers which all attach to a central SAN-attached file server using NFS. There's a concept of 'advisory locking' of files over NFS, which means a file which is locked should probably not be accessed/overwritten by other process, but this is not enforced in the protocol. MIVA, unfortunately, seems to ignore this nuance, and assumes that file locking over NFS is authoritative. MIVA does quite a bit of reading and writing to database files during normal operation, and (as we've now learned) can get itself into a situation in which it believes a file is locked, and waits around for the lock to be freed... forever. This results in a store that never loads for visitors.

Our workaround for digging MIVA stores out of this state isn't pretty, and there's some chance it could cause file corruption and/or data loss, but it does seem to get a store back up and running. Basically we make a copy of /mivadata, remove the original, and then move the copy back into place. i.e.,

# cp -a mivadata mivadata.new && mv mivadata mivadata.old && mv mivadata.new mivadata && rm -rf mivadata.old

It's our hope that MIVA can fix this issue, but we're also working on a Linux kernel module which, if we can do it, might help avoid this situation in the future. In the meantime though, we won't be installing new MIVA stores. We'll post a followup as soon as we have more information.

-JM