The Kindness Chain

Written on Mon, 30 May 2016

Has someone just given you an act of kindness? Thank that person. That person might have just received kindness from someone else, and thus has passed the kindness baton onto you.

The kindness baton is now with you. What will you do?

Pass it on?

Keep it for yourself?

Questions! Questions! Is there even a need for questions? The power to change lies in you. Pass on, make a better world. Keep it, the world just gotten a little dull.

Pass on that baton to another person. When the other person thanks you for it, say this: "Do the same kindness to another person". Let the other person decide whether to pass the baton or not. You have done your part of complete the kindness chain.

Let's Encrypt the internet

Written on Fri, 20 May 2016

Every website should have https option. In fact, it should be the default. But how many times have we seen that https cert costing a lot, and even the free certs require 30 days regular renewal. Some offer 90 days renewal, but that's aside the point. Certs require maintenance.

But we can thank Internet Security Research Group, a public benefit corporation, for providing the internet with free and hassle-free certificates. ISRG is sponsored by many organisations, from non-profits to Fortune 100 companies. A full list of sponsors can be found here.

Important

One important thing to note is that this is not Extended Validation(EV) certificates. EV certificates can be obtained from Comodo. These certificates require additional verification beyond the technology, which is why it's particularly important if you want to conduct online transactions. Your customers need to know that the website(YOU!) they are transacting with, is trusted.

Alright, so let's get started to install certs for our web servers. If you had followed my tutorial on setting up a web hosting site, this tutorial is exactly for you. If you had set up your own web server under different configuration, the tutorial here should still apply to you for most part. For more information, you can go here to find a specific instruction for your build.

By the end of this tutorial, you will have:

• certbot installed
• All sites in your server instance to have https enabled, if you didn't proceed to revoke.
• All Certificates installed will automatically renew every 90 days.
• Bonus: If you have piwik installed from previous tutorial, you can force SSL on it.

What you need:

• You need to have a web hosting site already running. You can follow my tutorial on setting up a web hosting site to get you started.
• Some linux knowledge

Installation

Let's start with installing the certbot to Ubuntu 16.04. SSH into your server. All commands are done on root account. Prepend sudo if you are not in root account.

apt-get install python-letsencrypt-apache

Automated installation

Let's run the installation programme:

letsencrypt --apache

On the first screen, it will prompt you for which sites you would like to install certs to. Choose all that you want to. As for me, I picked all my sites.

Next, you have to enter your email address.

Be sure to read all the legal terms and conditions of usage before you proceed to install the certificates. Especially the rate limits. If you agree, just select agree on your SSH console.

Now it's going to prompt you whether to set https as the only connection or allow both http and https. For me, I prefer to use both and instead leave it to individual application to redirect to https. Choose the option which you prefer.

That's it for the installation. You are set to use https. You can verify your ssl is working with https://www.ssllabs.com. Your Certificate will also last you 90 days. It's also a good idea to regularly backup /etc/letsencrypt folder.

In case you can't connect to https, be sure to check your aws security groups and allow port 443 to your instance.

Automated Certificate Renewal

Since your certificate will only last you 90 days, you need to regularly renew your cert. Now, here's the part where Let's Encrypt does magic better than most other free certificate providers. It will automatically renew for you, which is as good as a permanently free service.

Let's do a test run on certificate renewal to see if any errors occur:

letsencrypt renew --dry-run --email [YOUR-EMAIL] --agree-tos

Make sure you clear away any errors if you encounter any.

If there is no error, you can proceed to set automatic renewal through cronjob:

crontab -e

Add the following to the cronjob entries:

30 */12 * * * letsencrypt renew --email [YOUR-EMAIL] --agree-tos

This will run the renewal twice every day, recommended by their documentation. It is advisable that you run the renewal process on a random minute. I guess this is to ease their server load for being hit by renewal request when the clock strikes a particular minute.

That's it! You now have a permanently free SSL cert for all your websites. If this service has benefited you, do consider a small donation.

Revoking a certificate

If you ever need to revoke a certificate, here's how you can do it:

letsencrypt revoke --cert-path /etc/letsencrypt/[path-to-your-cert]

If your cert is placed elsewhere, do modify the path accordingly.

Your cert will no longer authenticate with the Certificate Authority after awhile. That's it.

Conclusion

This is by far the easiest way to install certificates I've ever experienced. It practically does everything for me. I don't even need to know how to generate keys, or configure anything on Apache. It just works.

Great job, Let's Encrypt

Bonus: Force SSL for Piwik

Did you follow my tutorial on Piwik Installation? If you did, you can force Piwik to use https everytime. It's highly recommended that you do so, so that you can protect your login credentials from being in the clear during transaction.

Browse to your piwik installation configuration folder

cd [path-to-piwik-installation]/config

Edit the config.ini.php

nano config.ini.php

Add the following under [General]: (or edit the line if the settings already exists)

[General]
force_ssl = 1

That's it! Your Piwik installation will now use https whenever it is browsed. You have made your site secure and the internet a little bit safer.

Finally! Categories

Written on Thu, 19 May 2016

Ok, so I have finally added categories into my blog so that I can properly categorised my blog post. More than just administrative, it's so that I can put up the menu up there and have you sort out the post. Plus, I like things organised. And if I'm going to get any advertising agencies for my site to earn a tiny income from here, I need to have proper site maps.

There's still a lot of things I want to work on for my little site. The most painful eye-sore is the site design. I really should start working on it. But then again, it's not my highest priority right now.

I'm considering a tick-tock improvement cycle for my site, somewhat similar to how Intel implements their tick-tock model, shifting from working on shrinking their transistors to working on a better microarchitecture, and back again. So I'm going to implement something like that, shifting from implementing site improvements on existing items, to implementing something new on my site, which I will share how I did that new thing to the world.

Interestingly, Intel is not going to use that tick-tock model anymore, instead, opting for "process-architecture-optimization" cycle. Moore's law is in trouble.

Right, so on to what I'm going to work on next. Maybe https for my site?

Piwik: Private Analytics

Written on Fri, 13 May 2016

Piwik is easily the best analytics for organisations who have a privacy policy that doesn't allow them to share information with third party. If you've tried Google Analytics, who will find that Piwik offers very similar functionalities. The biggest downside is probably that Google actually integrates its services seamlessly, while piwik is a purely standalone product. But the biggest advantage is that Piwik is entirely open sourced, so you can go ahead to modify or extend its functionalities.

Requirements

Minimum:

• Webserver such as Apache, Nginx, IIS, etc
• PHP5.3 or greater
• MySQL version 4.1 or greater, or MariaDB
• PHP extension pdo and pdo_mysql, or the mysqli extension

Recommended:

• Webserver such as Apache, Nginx, IIS, etc
• PHP7
• Latest MySQL or MariaDB
• PHP extension pdo and pdo_mysql, or the mysqli extension

Tip: Check out my other blog post for more information on setting up a web hosting with PHP7 and infinitely growing hard disk space.

Preparing the Server

Now I assume you have followed my previous blog post and installed PHP7 on Ubuntu 16.04. If not, do check it out! Let's prepare the server for Piwik installation.

Starting with the required libraries:

apt-get install php7.0-curl php7.0-gd php7.0-cli php7.0-dev libgeoip-dev

Interestingly, at the time of writing, GeoIP extension is not supported in PHP7. So we are going to need some help. Fortunately, Zakay from GitHub has compiled a solution. Let's hope there will be an official release of GeoIP extension for PHP7 soon.

We are going to get the codes from github:

git clone https://github.com/Zakay/geoip.git
cd geoip

Next, we compile it:

phpize
./configure --with-php-config=/usr/bin/php-config
make
make install

Now it is ready to be used. Let's put the settings in php.ini so that it will during runtime.

touch /etc/php/7.0/mods-available/geoip.ini
echo "extension = geoip.so"> /etc/php/7.0/mods-available/geoip.ini
phpenmod geoip
service apache2 restart

I hope you still have your phpinfo.php file in your webroot. Run the script in your browser and you should see GeoIP installed.

Next we configure your mysql so that it has a username for itself. It's always a good security measure that you assign each app to a single user and not shared.

mysql -p

Then enter your root password. If you have another username, do use the following command instead:

mysql -u anotherusername -p

You should now be at the mysql console. Enter the following:

CREATE DATABASE piwik_db_name_here;
CREATE USER 'piwik'@'localhost' IDENTIFIED BY 'password';
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES ON piwik_db_name_here.* TO 'piwik'@'localhost';
exit

Do substitute the names accordingly. Otherwise, your future administrators might think you're lazy.

Once you are done with that, you are absolutely good to proceed to piwik installation.

Installing Piwik

Now you are ready to download the piwik installation. You can download it to your computer, unzip, and upload it via ftp or sftp. But for pure linux sake, here's the commands to do it:

apt-get install unzip
wget http://builds.piwik.org/piwik.zip
unzip piwik.zip
mv piwik/* /var/www/html
rmdir piwik
rm How\ to\ install\ Piwik.html piwik.zip

The last few commands to remove is for cleaning up no longer needed files. It's always a good habit to clean up after yourself. Keep servers neat and tidy is important. The piwik is installed in the default webroot. If you are using it as a virtual host, you must configure apache accordingly, which is not covered in this tutorial.

If you browse to your website in your web browser, you should see your piwik installation. If the page shows an error /tmp/cache/tracker, you need to ensure that the tmp folder has enough write permission. It's also recommended that you keep the entire installation writable by apache so that piwik can do self-upgrade.

Go ahead to install piwik by following the instructions. And you're done! Congratulations!

Improving my little site

Written on Thu, 12 May 2016

Ok, so I've been spending the past few days trying to improve the site at the back. This is very important as the content that is generated on the front depends a lot on what was at the back. The system behind the blog posts were not correctly rendering <br /> properly. So I had to dig deeper to find out why my /n is not properly converted.

Turns out, the way the wiki text parser is treats every line break as a new line to parse, thus totally ignoring my regex that needs to read the /n symbol. Thus I had to do hackish methods make line breaks work.

It works out now properly.
Like!
This!
Tada!

And the previous posts are now rendering line breaks properly too.