Release-3774: Mitigate CVE-2017-6074 and firewall known bot networks
Today’s release implements two security measures on Hypernode. Yesterday a new double-free vulnerability was announced in the Linux kernel. We’ve implemented some rules to mitigate this vulnerability until all nodes are running the new patched kernel. Additionally we’ve seen an increase on brute-force attacks on the Magento /downloader. In this release we blacklist a range…
Read moreRelease-3760: Updated monitoring for development plans
We’ve updated the monitoring of development nodes. The alerting for these plans has been changed to only alert during business hours.
Read moreRelease-3732: Let’s Encrypt Nginx configs are generated without www. prefix
Today we will update the hypernode-ssl-config-generator so that it generates Nginx server definitions without a www. prefix in the server name. This additional server_name was unneeded because dehydrated only creates certificates for the domain you specified, not automatically also a www. domain. A new config will automatically be generated the next time you run dehydrated…
Read moreRelease-3728: allow let’s encrypt on dev plans. fix ibdata1 shrink automation
On development plans it’s now possible to use let’s encrypt again. The relevant requests have been made exempt from the basic auth. We fixed a regression in our shrink_ibdata1 automation. A regression had been introduced by the MySQL version update end November. We added an alias `sf2` which shows all magento2 storefronts. It executes `cd…
Read moreRelease-3657: Whitelist Sendcloud
This release contains a change to the default Nginx whitelist that makes SendCloud exempt from the standard bot ratelimit. The FPM slot limit still applies. Users can further configure their ratelimiting settings in the Nginx config in /data/web/nginx. Also in this release: more tweaks to the WAF for yesterday’s RCE mitigation The Cart2Quote development team…
Read moreRelease-3636: New WAF rules to mitigate RCE in two plugins
We’ve added new rules to our web application firewall to block hacking attempts relating to a remote code execution exploit found in the EM_Ajaxproducts and Ophirah_Qquoteadv plugins. We scanned all Hypernodes, if your shop had any of these two plugins installed you will have received an email with more specific information. Other changes in this…
Read moreRelease-3586: Updated composer
We’ve changed our composer update itself with the –stable flag. Freshly provisioned nodes however did not understand this flag yet, due to the initially deployed composer being too old. We’ve updated composer in our repository so that all new nodes will be able to update themselfs to the latest stable composer.
Read moreRelease-3540: fix CVE-2016-8655, disable the freshclam daemon and more
Because it is December we have done our best to make as little alterations to the platform as possible to provide the most stable hosting experience for our customers during these busy holiday months. However we do have some updates to share. These are some of the things we have been up to since the…
Read moreRelease-3523: block Visbot user-agent
We now block all user-agents which contain the term “Visbot” inside the user-agent string.
Read moreRelease-3513: Updating MySQL to 5.6.33
We are in the process of updating MySQL to the latest version, to get the latest improvements and security fixes. Last night we updated all Hypernodes with starting letters U-Z. Tonight we will update all Hypernodes with starting letters M-T. Tomorrow night all Hypernodes with the starting letters A-L and 0-9 will be updated. …
Read moreRelease-3512: More granular hypernode-importer error logging and more
This release implements Magento 2 detection for the hypernode-importer so that a message can be displayed that we at this time do not support Magento 2 in the hypernode-importer yet when a Magento 2 shop is attempted to be imported with this tool. The message reads “importing Magento 2 with the hypernode-importer is not supported…
Read moreRelease-3480: Additional PHP modules
Today we are installing two requested packages on all PHP 7 Hypernodes. php7.0-odbc php7.0-sybase
Read moreRelease-3470: Improved auto recovery
We’ve improved our auto recovery to automatically attempt fix filesystem inconsistencies on boot. In rare occasions a Hypernode would be forced to reboot off an uncleanly closed filesystem. On boot it would then prompt asking what to do (if it should recover). A recovery is now automatically attempted, reducing recovery time for these cases.
Read moreRelease-3347-1: update PHP7 to 7.0.13-1
Today’s release updates PHP on PHP 7 Hypernodes and other minor changes. PHP 7 updated from 7.0.12-1 to 7.0.13-1. You can look at our packaging here if you are interested in that sort of stuff. The hypernode-importer can skip Magento path autodetection If the host has many files in the directories where the hypernode-importer will…
Read moreRelease-3447: stricter fail2ban rules on rss notifystock
We tightened our fail2ban rules for rss/notifystock bruteforce attempts to ban 24 hours instead of previously 2 hours. Additionally we enabled the automatic recovery for all nodes now, along with a minor improvement in the auto recover logic.
Read moreRelease-3428: Stop HHVM on all A-L Hypernodes which are not using it
For all Hypernodes with the first letter A-L we’ve stopped HHVM unless it was used. On the remaining Hypernodes (M-Z), we stopped HHVM already in an the earlier release. HHVM is deprecated in favor for PHP7. In order to save memory we’ve stopped HHVM on all nodes which were not using it to reclaim memory….
Read moreRelease-3421: Stop HHVM on all M-Z Hypernodes which are not using it
For all Hypernodes with the first letter M-Z we’ve stopped HHVM unless it was used. The remaining Hypernodes (A-L) will also receive this feature in due time. HHVM is deprecated in favor for PHP7. In order to save memory we’ve stopped HHVM on all nodes which were not using it to reclaim memory. New Hypernodes…
Read moreRelease-3411: Automatic recovery
For all Hypernodes, whose first letter begins with M-Z, we’ve enabled a new automatic recovery feature today. All Hypernodes starting with letters A-L will receive this feature as well in due time. Should a Hypernode become unreachable or unresponsive, our automation will attempt to resolve the problem before alerting one of our technicians. The automation…
Read moreRelease-3405: new hypernode-importer features, tweaks in memory management
Today we deployed some changes to the hypernode-importer which might end up saving you some time when migrating a Magento shop to a Hypernode or a local hypernode-vagrant development environment. The –set-maintenance-on-source flag This new option for the hypernode-importer enables you to automatically put the Magento installation you are importing from in maintenance mode before…
Read moreRelease-3377: Remove HHVM for new Hypernodes
As of now newly ordered Hypernodes will not have HHVM available anymore. Support can re-enable HHVM for you, should it really be necessary. We recommend everyone to use PHP7 instead. It delivers an even better performance boost and is better maintained by the community.
Read moreRelease-3359: NGINX config reloader no longer allows absolute includes
We’ve updated the NGINX config reloader to not allow absolute includes. Absolute includes worked against the NGINX config reloader. The purpose of the config reloader is to ensure that the live config is syntactically correct and working, having an outside dependency (include) that can change the running live config can cause NGINX to no longer come up. Specifically the following includes are…
Read moreRelease-3359: Let’s Encrypt Firefox fix
We’ve improved the let’s encrypt implementation. Firefox now accepts the certificates as expected.
Read moreRelease-3331: Increased server_names_hash_bucket_size and more
In this release we made a couple of minor changes to our configurations on Hypernode. Increased the server_names_hash_bucket_size to 128 The server_names_hash_bucket_size NGINX config value was increased from 64 to 128 as it was causing issues with longer domain names. For example previously trying to generate an SSL configuration for domains of a certain length…
Read more