Latest Announcements from the Forums

2025-01-31: WordPress xmlrpc.php is now blocked
Several sites were being massively hammered by attacks focused on the obsolete xmlrpc.php interface to WordPress. That file is now blocked server wide, and cpu use fell from 80% to 1%.

More info can be found here: https://www.hostinger.com/tutorials/xmlrpc-wordpress

I don't believe anyone was legitimately using this feature. If I'm wrong about that, please contact me and we can look into solutions.

In the meantime, please, please update your WordPress installs (and keep them up to date!)


2024-06-10: Email Changes Coming Soon
So xepher.net is running a bit like the Voyager probes. Long past their expected lifetime, and so we have to narrow mission scope to keep things going. In the past few years, the bulk of my pain-points with continuing things has been around email. More specifically, with various other services blacklisting xepher.net as a "spam source." Mostly I think this is the fault of having such low volume email: One spam message in a month makes this server's message output 5%+ spam (because we send so few messages.) So I think we're getting trapped by heuristics that don't really apply. But also, that's the reality and I can't get google/yahoo/msn/etc. to change their behavior.

That said, I want to work on fixing the issue in the long run. To that end, I want to know who is actually USING email services here. This question comes in several parts:

1) Are you using xepher.net email directly (e.g. user@xepher.net)
2) Are you using a virtual domain (user@mywebsite.com, which is hosted by xepher.net)
3) Are you SENDING email from either of the two above?
3a) If so, which ones? Both?
4) Are you sending email here some other way? (Possibly a violation/problem, possibly not.)

What I'm considering is spooling up an independent mailserver VM for xepher.net, such that you'll need to log into it directly (for both sending and receiving) but that will negate the worry that infected wordpress installs and similar are somehow sending spam from the only "official" server and getting us blacklisted. Also, with a separate server, all transactions will be fully logged (not content, just sender+datetime) so that if/when spam is detected, it can be shut down quickly and connected with the compromised account.

Please let me know if you're in the emailing using category, but also if you have any other thoughts or concerns around this. Thanks!


2024-03-29: Upgraded System
Upgrade time again. Nothing specific, but prompted by a major security breach in a core package (XZ) used by almost every Linux (and BSD) distro on earth today. It doesn't look like any direct exploit or vulnerability happened here on xepher.net, but it made me want to update and verify things generally.

We're still on PHP 8.1 but 8.2 may be coming sooner rather than later. Don't expect any issues there, but, one never expects the Spanish Inquisition. That said, and for now, this round of updates should be "done." If you have any remaining issues or problems, please let me know. And I apologize for the interruptions the past 10 hours or so.


2023-07-16: Upgrading to PHP 8.1 and MariaDB (mysql) 10.6 soon.
PHP 7.4 is end-of-life, and so mysql 5.7. The real impetus for this change though is that openssl 1.1 itself (which both of these depend on) is going EOL in September as well. Most people hopefully won't be affected in any serious ways, but if you have PHP scripts on your site (such as wordpress) you should make sure you're up to date with the latest version.

I will likely perform this upgrade sometime next week, but depending on how busy I am, may postpone it slightly longer. I aim to have it done by the end of July in any case, so please check your site software for upgrades soon.

EDIT: Upgrade complete. Please upgrade your software if you have issues, and reach out to me if you can't resolve things.


2021-10-24: Due to Upgrade, Password Updates Required Soon
Starting next week (November 1st) there will be an upgrade to some of the core system software on the server. This will obsolete old passwords (set before around 2008) which are stored using weaker md5 hashes. Support for those is going away in the cryptography library used by service pieces of software (including SFTP.) Everyone who hasn't changed their password in the past few years will need to do so, or potentially be locked out of some services until they do.

To change your password, go to https://xepher.net/user-services/ and login with your old/current password, then change it. Note that if you use MySQL for things like wordpress, this will change your database password as well, so you may need to update your wordpress (or other software) configs. For wordpress, that typically just means editing wp-config.php. This would also be a good time to make sure that file is secure (it does contain your password after all) so click the properties for that file and set the permissions so ONLY user (you) have read/write access (for you nerd types, "chmod 600 wp-config.php".) Remove the access from group and other/world so no one else can view it. You should do this for any other web software you may be using... any file where you have your own password stored.

If you have any questions or problems, just let me know!

All code, images, and content in this page are licensed under a
Creative Commons Attribution-ShareAlike 3.0 Unported License.