Latest Announcements from the Forums

2026-08-20: SSH Moved to non-standard port: 2222
Big botnet attack kept hitting the server, locking me and some others out. As it's coming from hundreds of different sources (changing every couple of attempts) there's no real way to block it by IP, so I've moved SSH to a non-standard port (2222) which should hopefully keep them from finding/attacking for a bit and move on to the next target. It MAY move back in the future, but if you cannot connect to ssh/sftp, manually change the port to 2222 for now (instead of the default of just 22.)


2025-01-31: WordPress xmlrpc.php is now blocked
Several sites were being massively hammered by attacks focused on the obsolete xmlrpc.php interface to WordPress. That file is now blocked server wide, and cpu use fell from 80% to 1%.

More info can be found here: https://www.hostinger.com/tutorials/xmlrpc-wordpress

I don't believe anyone was legitimately using this feature. If I'm wrong about that, please contact me and we can look into solutions.

In the meantime, please, please update your WordPress installs (and keep them up to date!)


2024-06-10: Email Changes Coming Soon
So xepher.net is running a bit like the Voyager probes. Long past their expected lifetime, and so we have to narrow mission scope to keep things going. In the past few years, the bulk of my pain-points with continuing things has been around email. More specifically, with various other services blacklisting xepher.net as a "spam source." Mostly I think this is the fault of having such low volume email: One spam message in a month makes this server's message output 5%+ spam (because we send so few messages.) So I think we're getting trapped by heuristics that don't really apply. But also, that's the reality and I can't get google/yahoo/msn/etc. to change their behavior.

That said, I want to work on fixing the issue in the long run. To that end, I want to know who is actually USING email services here. This question comes in several parts:

1) Are you using xepher.net email directly (e.g. user@xepher.net)
2) Are you using a virtual domain (user@mywebsite.com, which is hosted by xepher.net)
3) Are you SENDING email from either of the two above?
3a) If so, which ones? Both?
4) Are you sending email here some other way? (Possibly a violation/problem, possibly not.)

What I'm considering is spooling up an independent mailserver VM for xepher.net, such that you'll need to log into it directly (for both sending and receiving) but that will negate the worry that infected wordpress installs and similar are somehow sending spam from the only "official" server and getting us blacklisted. Also, with a separate server, all transactions will be fully logged (not content, just sender+datetime) so that if/when spam is detected, it can be shut down quickly and connected with the compromised account.

Please let me know if you're in the emailing using category, but also if you have any other thoughts or concerns around this. Thanks!


2024-03-29: Upgraded System
Upgrade time again. Nothing specific, but prompted by a major security breach in a core package (XZ) used by almost every Linux (and BSD) distro on earth today. It doesn't look like any direct exploit or vulnerability happened here on xepher.net, but it made me want to update and verify things generally.

We're still on PHP 8.1 but 8.2 may be coming sooner rather than later. Don't expect any issues there, but, one never expects the Spanish Inquisition. That said, and for now, this round of updates should be "done." If you have any remaining issues or problems, please let me know. And I apologize for the interruptions the past 10 hours or so.


2023-07-16: Upgrading to PHP 8.1 and MariaDB (mysql) 10.6 soon.
PHP 7.4 is end-of-life, and so mysql 5.7. The real impetus for this change though is that openssl 1.1 itself (which both of these depend on) is going EOL in September as well. Most people hopefully won't be affected in any serious ways, but if you have PHP scripts on your site (such as wordpress) you should make sure you're up to date with the latest version.

I will likely perform this upgrade sometime next week, but depending on how busy I am, may postpone it slightly longer. I aim to have it done by the end of July in any case, so please check your site software for upgrades soon.

EDIT: Upgrade complete. Please upgrade your software if you have issues, and reach out to me if you can't resolve things.

All code, images, and content in this page are licensed under a
Creative Commons Attribution-ShareAlike 3.0 Unported License.