2718.us blog

Authenticating with WordPress 2.6 (part 1)

I’ve been hoping for the last hour or two that there’d be just one post on this topic, giving the problem and solution all together, but I have yet to solve it and so I’m just going to post the issue for now, until I have a solution.

As a security measure in WP2.6, login cookies are now split into what seem to be at least three different cookies—two with paths like /wp-admin and /wp-content/plugins that are the full cookie that auth_redirect() checks against and one that’s different, with path / [paths relative to the blog root]. Near as I can tell, this immediately breaks any attempt to use auth_redirect() for authentication (e.g. this and this) outside the /wp-admin and /wp-content/plugins directories. It is also not immediately clear to me how to authenticate against the whole-site cookie, if there’s any way to do that at all.

A temporary, but very bad fix would be to completely defeat the security by defining ADMIN_COOKIE_PATH to be the site root, rather than the path to /wp-admin. I’m thinking that, from a quick skim of pluggable.php, there might be plugin action hooks to allow setting other cookies that would allow authentication on other paths…

¶ Posted 29 July 2008 † 2718.us § Web Programming ‡ Comments (2) ° Tagged: 2.6, admin_cookie_path, authentication, auth_redirect, cookie, cookie path, cookie paths, cookies, security, user, user authentication, user login, wordpress, wordpress 2.6, wp, wp2.6

DNS, DDoS, and VPSes

For many years now, I’ve used WorldWideDNS.net for the bulk of my DNS hosting. On Monday, they suffered a massive DDoS attack, taking out pretty much everything and making a few of my domains (including 2718.us) unavailable. Now, personally, I consider this sort of attack and outtage at a service provider to be an inevitability, so from my perspective, it’s my own damn fault that my sites went down, since I failed to diversify their DNS across providers. (Also, I have no intention of leaving WorldWideDNS over this—they have always been a great value and good provider from my perspective and a few hours of downtime in years of using them is insignificant to me.)

Over the past few years, as I’ve moved into VPS-based hosting, I’ve also started to use my VPSes as additional DNS servers, keeping the professional hosted-DNS for geographical and connectivity diversity. As this incident has pushed me along in making sure that every domain I host has DNS from at least two different providers, I came to the conclusion that, given that I already have one commercial DNS host (giving me three nameservers), the best economics were for me to get a super-cheap VPS to run as only a nameserver. While not the absolute cheapest, JustGotVPS.com is probably the best price-configuration balance, especially at their cheapest ($5/mo and $8/mo) plans, and they discount for longer-term prepayment. There’s an entry for them, as well as numerous other VPS options around the $5/mo price point at lowendbox.com.

The tradeoff for this versus a commercial DNS host (since in both instances I’m paying about $60/year) is that the commercial host gives me three diverse nameservers but limits the domains, etc., whereas running my own VPS-based nameserver gives me only one host but substantially greater flexibility. I would also note that I chose to get a cheap VPS box from some provider other than my primary VPS provider so that my new additional nameserver would not be in the same datacenter and on the same internet links.

I also have been using EveryDNS.com, a free DNS host, for additional backup (I’ve donated since I’m using them on several domains and they seem to provide a good service), but having used GraniteCanyon and others in the past, I don’t consider a free DNS host as a serious alternative to a commercially-provided option.

¶ Posted 24 July 2008 † 2718.us § Networking § Web Programming ‡ Comments (3) ° Tagged: ddos, dns, everydns, justgotvps, lowendbox, vps, worldwidedns

Converting to Asterisk-Native SLN Audio with ffmpeg

I have spent a large chunk of the past two weekends trying to find some kind of instructions as to how to get audio into the native Asterisk “SLN” format. Specifically, I wanted to convert some mp3s of classical music (such as from Musopen) to SLN for music-on-hold. I was able to discern that SLN files are “raw” or headerless “wav” format, 16-bit signed PCM or signed linear (hence SLN). After several attempts to convert mp3s, wavs, and other things to this format, only to have them play as painfully loud static, I tried reversing the process and importing some working sample SLN files in Audacity. This led to the big ah-ha! moment of the weekend—the Asterisk SLN files are 16-bit little-endian signed PCM, whereas SoX, Audacity, et al, were putting out big-endian 16-bit signed PCM. I couldn’t for the life of me find an option to change the endiannes in Audacity, however.

In searching some more, I found that ffmpeg, one of the best swiss-army-knife-type audio/video conversion programs, specifically supports signed 16-bit little-endian PCM. Here’s the command to convert just about any audio (anything ffmpeg can handle) to the appropriate format for Asterisk music-on-hold:

ffmpeg -i "[input file]" -ar 8000 -ac 1 -acodec pcm_s16le -f s16le "[output file].sln"

You may also want to add a volume modifier, to make the music appropriately quiet for music-on-hold, and ffmpeg allows this to be specified in dB gain like “-vol -15dB”.

¶ Posted 21 July 2008 † 2718.us § Telephony ‡ Comments (2) ° Tagged: 16-bit pcm, 16-bit signed little-endian pcm, asterisk, asterisk native, asterisk sounds, audacity, big endian, endianness, ffmpeg, little endian, moh, mp3, music, music on hold, pcm, pcm_s16le, s16le, signed linear, sln, sox, wav

Simple Weather in Asterisk with Minimal Tools

I’ve been fiddling around with Asterisk on a slug box. It’s working pretty well, but since I don’t want to deal with compiling things for the slug, I’m limited to the Asterisk modules that are available as binaries (not many). I’m also using the older Asterisk 1.2. This has led to some interesting hacks to make things happen. The end result of a lot of this hacking is a dialplan-shellscript-sed combo to read out some basic weather forecast info acquired from Yahoo.

¶ Posted 20 July 2008 † 2718.us § Telephony ‡ Comments (0) ° Tagged: asterisk, asterisk dialplan, dial plan, dialplan, nslu2, sed, sh, shell script, slug, weather, yahoo, yahoo weather

Steps to “Unsling” the NSLU2

Since I’m on my second of what will probably be 4 or 5 unslung NSLU2 “slug” units (with identical 1GB flash drives from eBay), I figured it was time to write down specific step-by-step directions, if perhaps only for my own use later. (As an aside, having the two ethernet ports on my Mac Pro is really helpful at times like this when I’m monkeying around with some piece of hardware that doesn’t do DHCP out of the box, forcing me onto some specific subnet.) CAUTION: I take absolutely no responsibility for what you may do to your hardware/software/life/etc. if you follow these directions. You should read lots of other, more thorough instructions like the how-to’s at the Unslung HomePage. Continue Reading »

¶ Posted 13 July 2008 † 2718.us § Networking ‡ Comments (3) ° Tagged: linksys, nslu2, openssh, slug, ssh, step by step, unsling, unslung

Hiding the WordPress Dashboard

I use WordPress as the backbone of a site I run, including using it for user authentication. This means a lot of people who aren’t invovled in running the site are logging in and could see the dashboard. Now, it’s not that there’s anything really secret there, but it makes things look a lot less “finished” to have users deposited on a page that has no relevance to them. This is where the Hide Dashboard plugin from Patrick/DeepWave comes in. It does a nice job of getting users to their profile page and generally hiding most of the dashboard things that regular users don’t need to see.

I, however, wanted a little more. I wanted to make sure that regular users who might be, well, “curious” about the inner workings of the site and who have some knowledge of wp-admin URL structure to be unable to get at anything but their profile page. To this end, I added a little to the code:

// add after line 41, which reads: if(!current_user_can('level_10')){
if (strpos($_SERVER['REQUEST_URI'],'/wp-admin') !== FALSE
and strpos($_SERVER['REQUEST_URI'],'/wp-admin/profile.php') !== 0){
wp_safe_redirect('/wp-admin/profile.php');
}

This should redirect any non-admin user off of any /wp-admin* page to /wp-admin/profile.php. This might, however, cause issues for mid-level users (i.e. authors/editors/etc may not be able to access needed functions) and I haven’t tested it thoroughly and there might be a better way to do this. YMMV. See also some comment-discussion on these changes at the plugin’s own page: me Patrick me.

¶ Posted 10 July 2008 † 2718.us § Web Programming ‡ Comments (4) ° Tagged: dashboard, deepwave, hide, hide dashboard, hide dashboard plugin, integration, plugin, wordpress, wordpress plugin, wp, wp plugin

Child Themes to Upgrade-Proof Your Theme Changes

I’ve had yet another why-didn’t-anyone-tell-me-sooner moment–child themes in WordPress. From How To Protect Your WordPress Theme Against Upgrades (via Parent Child Themes and How I used a WordPress Child Theme To Redesign My Blog The Smart Way):

Problem: You’ve finally found a theme you like but you want to modify it. The modifications are pretty simple but what happens when you want to upgrade the theme? Do you really want to go through all those files again hunting down the changes? Don’t you wish you could just upgrade and be done with it?

So, basically, install the theme you want, create a new theme directory for you modifications, and in the style.css file, which defines the metainfo for the style, designate the original (unedited) theme as the template. If need be, use functions.php to make more modifications. Just note that any template files in your own version’s directory beyond style.css and functions.php will be ignored.

When it comes time to upgrade the theme, you upgrade the “parent” theme and your modifications are unchanged in their own directory.

¶ Posted 03 July 2008 † 2718.us § Blogging ‡ Comments (0) ° Tagged: child, child theme, functions.php, parent, parent theme, style.css, theme, upgrade, wordpress, wordpress theme, wp, wp theme

svnX is out, Versions is in

While I’d been really happy using svnX, it didn’t deal with svn properties at all, which meant having to go to the CLI and set properties manually. This got annoying fast when I kept forgetting the syntax to set svn:keywords so that I would get those nice automatic tags filled in at the top of my source files. This prompted me to go looking for a Mac svn GUI that did handle setting properties. What I found was Versions and now, about ten minutes into using Versions, svnX is out my dock and Versions is in. My only worry is that beta 2 expires in 3 days…

If the price is even remotely reasonable when the final version is available, I think I’ll be sticking with it.

¶ Posted 27 June 2008 † 2718.us § Web Programming ‡ Comments (0) ° Tagged: mac, os x, subversion, svn, svn gui, svnx, versions

SSH Tunneling on a Mac

Since my employer’s wireless network is unencrypted and since I use other open WiFi networks with some frequency, I’ve gotten in the habbit of tunneling everything through SSH, using the SOCKS5 proxy mechanism built in to SSH. In WinXP, there’s a nice little program called Tunnelier that makes the setup of the tunnel simple and it reconnects automatically, so the tunneling part is virtually automatic (even though proxy setup is still tricky and/or annoying).

On the Mac, however, I have tried several programs and never really been happy. So I wrote a little AppleScript that not only sets up the SSH tunnel, but also deals with switching my location to set the system’s network settings to use the proxy (the code is after the cut). Combine this with System Proxy for Firefox and all my application traffic goes through the SSH tunnel. Note also that if you’re using a SOCKS5 proxy with Firefox, you probably want to set it to do DNS lookups through the proxy. Continue Reading »

¶ Posted 13 June 2008 † 2718.us § Networking ‡ Comments (0) ° Tagged: applescript, firefox, firefox system proxy, location, mac, network, network location, os x, proxy, secure shell, socks, socks proxy, socks5, socks5 proxy, ssh, ssh tunnel, system proxy, tunnel, tunnelier

Why Didn’t Someone Tell Me About Subversion Sooner?

I’d gotten very used to editing some of my sites on the live running copy or editing a testbed server, then rsyncing it to the live server. I really had the WinSCP+TextPad thing down, then moved to Transmit+KomodoEdit when I went Mac-only for programming. It wasn’t bad at all, though every once in a while I really wished I could do one of those “search every file” actions from the editors, but that’s just not possible when editing one file at a time as a temporary copy via SFTP.

At the moment, I’m just starting to dig into one of the larger web projects I’ve done, migrating a large, data-driven site from PHP4 to PHP5, moving it from a commercial host to my own hosting, and rewriting large swaths of code—all at once. The previous webmaster, who wrote the original code, said he’d used subversion to deal with making revisions and having the ability to roll back when things broke, so I decided to look into subversion.

While most of the documentation made it seem really complex, once I’d settled on https access (apache mod_dav_svn), in the context of an existing SSL site I had, things were very easy–just a few svnadmin commands to set up the directories and a few lines of tweaking in an apache config file. About 10 minutes into playing with the repository, having imported the existing site and set up a working copy on my local machine, I wondered if there weren’t some nice GUI way to deal with checkout/checkin/status/etc. Enter svnX.

Now I’ve got working copies on my desktop and laptop as well as a copy checked out to the new production server and I can easily edit locally, even searching all files (that makes it a lot easier to fix all the instances of some incompatibility with PHP5 or some assumption about the directory structure or other oddity). Once I’ve edited, I can easily check what’s been revised (status) and save the changes to the repository (checkin/commit) using svnX. A quick “svn up” on the server and everything’s live.

This setup is so wonderfully easy that I’m annoyed I didn’t know to do it sooner.

¶ Posted 06 June 2008 † 2718.us § Web Programming ‡ Comments (1) ° Tagged: komodo, komodo edit, mac, subversion, svn, svn gui, svnx, textpad, transmit, winscp

Authenticating with WordPress 2.6 (part 1)

DNS, DDoS, and VPSes

Converting to Asterisk-Native SLN Audio with ffmpeg

Simple Weather in Asterisk with Minimal Tools

Steps to “Unsling” the NSLU2

Hiding the WordPress Dashboard

Child Themes to Upgrade-Proof Your Theme Changes

svnX is out, Versions is in

SSH Tunneling on a Mac

Why Didn’t Someone Tell Me About Subversion Sooner?

Home

2718.us

Recent Posts

Categories

Archives

RSS Links

WordPress