CRIN Trac: {1} Active Tickets

#100: crin.org site down

chris — Sat, 18 Feb 2017 11:38:48 GMT

Russell, what's up? I'm really sorry I have to go out in 5 mins so I'm not around to help, what has gone wrong?

#73: CRIN2 ran out of memory

chris — Sun, 01 May 2016 19:16:38 GMT

The site has been down since Sun, 01 May 2016 18:05:44, it is now 8:15. I'm rebooting the server, it ran out of memory.

#94: Ongoing high load caused by a bot

chris — Thu, 15 Dec 2016 19:23:12 GMT

Ticket to working out what to do with this issue...

#104: Problem with CRIN1 and CRIN2 backups

chris — Tue, 21 Mar 2017 09:32:43 GMT

Errors from the s3ql backup scripts:

Backend reports that file system is still mounted elsewhere. Either the file system has not been unmounted cleanly or the data has not yet propagated through the backend. In the later case, waiting for a while should fix the problem, in the former case you should try to run fsck on the computer where the file system has been mounted most recently. You may also continue and use whatever metadata is available in the backend. However, in that case YOU MAY LOOSE ALL DATA THAT HAS BEEN UPLOADED OR MODIFIED SINCE THE LAST SUCCESSFULL METADATA UPLOAD. Moreover, files and directories that you have deleted since then MAY REAPPEAR WITH SOME OF THEIR CONTENT LOST.

#119: MySQL Downtime

chris — Thu, 15 Jun 2017 10:31:52 GMT

Just after midnight last night MySQL appears to have started having some issues.

#12: ownCloud Synching

jonas — Mon, 11 May 2015 15:15:54 GMT

Changes are not synching between the desktop app and the browser version. There is no error message showing up at the desktop app.

#14: Blank CRINmail newsletters being sent out

chris — Sat, 16 May 2015 21:12:30 GMT

A newsletter sent via Drupal contained no content, Jenny reported:

We have tried twice today but both times when we send to all it sent out a blank email, with just the subject line. We have tried sending it to a few individual addresses and this works. We have sent other listservs out this week and they have worked as normal.

This is one of the emails:

From: CRIN [mailto:info@crin.org]
Sent: Friday, May 15, 2015 7:04 AM
To: Gertrud Lenzer
Subject: Children in Court CRINmail 48: Special edition on LGBTQI rights
--
*Child Rights International Network - CRIN*
Unit W125-127, Westminster Business Square
1-45 Durham Street
London SE11 5JH
United Kingdom
T: +44 20 7401 2257
 www.crin.org
@CRINwire <https://twitter.com/CRINwire>

#20: Problem adding Drupal user accounts

chris — Mon, 15 Jun 2015 13:58:06 GMT

Jenny has reported:

We are having trouble adding users (see screenshot - it should just be a save button but has an anti spam message) - this was working last week.

#41: CRINmail multipart email contain CSS in the plain text version

chris — Thu, 10 Sep 2015 10:07:17 GMT

CRINmail, which are sent by Drupal, have a HTML and plain text version, the plain text version contains CSS at the top, which takes a while to scroll through and makes it less likely that people with mail user agents set to display the plain text version first will read the newsletter, for example:

Return-Path: <info@crin.org>
Received: from mail.webarch.net ([unix socket])
        by mail.webarch.net (Cyrus v2.3.7-Invoca-RPM-2.3.7-16.el5_11) with LMTPA;
        Thu, 10 Sep 2015 00:19:23 +0100
X-Sieve: CMU Sieve 2.3
Received: from elderberry.rat.burntout.org (mx.webarch.net [81.95.52.71])
        (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits))
        (Client did not present a certificate)
        by mail.webarch.net (Postfix) with ESMTPS id A7BFB100072
        for <chris@webarchitects.co.uk>; Thu, 10 Sep 2015 00:19:23 +0100 (BST)
Received: from crin2.crin.org ([93.95.228.180])
        by elderberry.rat.burntout.org with esmtps (TLS1.2:RSA_AES_128_CBC_SHA1:128)
        (Exim 4.80)
        (envelope-from <info@crin.org>)
        id 1ZZoe5-00056h-Dl
        for chris@webarchitects.co.uk; Thu, 10 Sep 2015 00:19:23 +0100
Received: from www-data by crin2.crin.org with local (Exim 4.84)
        (envelope-from <info@crin.org>)
        id 1ZZoe4-0006TK-78
        for chris@webarchitects.co.uk; Wed, 09 Sep 2015 23:19:16 +0000
To: chris@webarchitects.co.uk
Subject: CRINmail 1445
X-PHP-Originating-Script: 1005:mimemail.module
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="8a276e6c6a6f9459ea8c98217bf4e986"
Content-Transfer-Encoding: 8Bit
X-Mailer: Drupal
Sender: CRIN <info@crin.org>
From: CRIN <info@crin.org>
List-Unsubscribe: <http://www.crin.org/en/newsletter/confirm/remove/XXX>
Precedence: bulk
Message-Id: <E1ZZoe4-0006TK-78@crin2.crin.org>
Date: Wed, 09 Sep 2015 23:19:16 +0000
[-- Attachment #1 --]
[-- Type: multipart/alternative, Encoding: 8bit, Size: 73K --]
Content-Type: multipart/alternative;
    boundary="f5f8c71876cf7825d95e748d55f23268"
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
-------- CRINMAIL 1445 -------------------------------------------------------
#nl_wrapper {background-color:#EFEFEF;}#nl_wrapper table,
#nl_wrapper td  {
   font-family:Verdana, Arial, Helvetica;
   line-height:150%;
   font-size:10px;
   margin: 0;
}
#nl_wrapper td img{
   margin: 0;
}
#nl_wrapper .headerTop {
background-color:#FFCC66; border-top:0px solid #000000; border-bottom:1px
solid #FFFFFF; text-align:center;
}
#nl_wrapper .adminText {
font-size:10px; color:#996600; line-height:200%; font-family:Verdana, Arial,
Helvetica; text-decoration:none;
}
#nl_wrapper .headerBar {
background-color:#FFFFFF; border-top:0px solid #333333; border-bottom:10px
solid #FFFFFF;
}
#nl_wrapper .title {
font-size:20px; font-weight:bold; color:#CC6600; font-family:Verdana, Arial,
Helvetica; line-height:150%;
}
#nl_wrapper .subTitle {
font-size:11px; font-weight:normal; color:#666666; font-style:italic;
font-family:arial;
}
#nl_wrapper td {
font-size:11px; color:#000000; line-height:150%; font-family:Verdana, Arial,
Helvetica;
}
#nl_wrapper .sideColumn {
background-color:#FFFFFF; border-left:1px dashed #CCCCCC; text-align:left;
}
#nl_wrapper .sideColumnText {
font-size:11px; font-weight:normal; color:#AAAAAA; font-family:Verdana,
Arial, Helvetica; line-height:150%;
}
#nl_wrapper .sideColumnTitle {
font-size:15px; font-weight:bold; color:#333333; font-family:Verdana, Arial,
Helvetica; line-height:150%;
}
#nl_wrapper .footerRow {
background-color:#FFFFCC; border-top:10px solid #FFFFFF;
}
#nl_wrapper .footerText {
font-size:10px; color:#996600; line-height:100%; font-family:Verdana, Arial,
Helvetica;
}
#nl_wrapper h1,
#nl_wrapper h2  {
   color:#888888;font-size:20px;font-weight:bold;font-family:Arial,
Helvetica;margin:0 0 10px 0; line-height:150%;
}
#nl_wrapper h2  { font-size:15px; margin:23px 0 10px 0; padding-top:8px;
border-top:1px solid #EFEFEF;}
#nl_wrapper p   {margin:10px 0;
font-size:11px;color:#333333;font-family:Verdana, Arial, Helvetica;
line-height:150%;}
#nl_wrapper a,
#nl_wrapper table td p a,
#nl_wrapper #crintable a,
#nl_wrapper #crintable a:visited { color:#1155cc; /* color:#003a6a;*/ }
#nl_wrapper a:hover,
#nl_wrapper table td p a:hover,
#nl_wrapper #crintable a:hover{color:#000;}
#nl_wrapper ul,
#nl_wrapper li,
#nl_wrapper
#crintable ul   {margin:0; padding:0; list-style:none; list-style-image:none;
list-style-type:none}
#nl_wrapper ul li,
#nl_wrapper #crintable ul li,
#nl_wrapper #CMrightcol ul li
{font-size:11px;color:#333333;background-image:url(http://crin.org/i/crinmail/bg_bullet.gif);
background-repeat:no-repeat; background-position:2px
center;font-family:Verdana, Arial, Helvetica;  margin:0; list-style:none;
list-style-type:none; padding:0 0 0 20px; margin:13px 0;}
#nl_wrapper div.FB,                                                                                     #nl_wrapper div.FB p    { margin:10px 0}
#nl_wrapper div.FB h2   {color:#5e768b; font-size:16px; margin:0;}
#nl_wrapper #crintable table td {
vertical-align: top;
}
#nl_wrapper h3.h3image{
   background-repeat: no-repeat;
   background-position: center right;
}
   http://crin.org
09 September 2015
subscribe http://crin.org/node/41907 | subscribe http://crin.org/node/293 |
submit information http://crin.org/en/home/about/contact-us
======== *CRINMAIL 1445* =====================================================
-------- IN THIS ISSUE: ------------------------------------------------------
*The year in children's rights:*
CRIN annual report 2015 #AR
*Latest news and reports* #news
- Discrimination on school grounds #dis
- Criminalising children for sexting #crim
- Access to bathrooms denied #ac
- States leave migrant children unprotected #sta
- Issues neglected by UN committees #iss
- UN calls for submissions #un
- Contribute to evaluation of CRIN’s work #cont
*Access to justice for children in Ireland* #a2j
*Upcoming events* #events
*Employment* #jbs
/Problems viewing this CRINmail? Click here
https://www.crin.org/en/home/what-we-do/crinmail/crinmail-1445. /
*/CRIN announcement/*
/We are aware that some of our readers may be receiving blank CRINmails. This
is due to our website experiencing some technical issues, which we are
working to resolve. Should you receive a blank or incomplete CRINmail, you
can also access the latest edition via our website here
https://www.crin.org/en/home/what-we-do/crinmail. /

Also note that the list unsub header contains a HTTP URL when this would be better as a HTTPS one for privacy reasons:

List-Unsubscribe: <http://www.crin.org/en/newsletter/confirm/remove/XXX>

#49: Frozen emails on crin4

chris — Thu, 05 Nov 2015 19:22:51 GMT

Munin is sending alert emails every 5 mins because of the number of frozen emails on Crin4.

#53: Blank email: CRINmail 1459

chris — Thu, 17 Dec 2015 13:04:49 GMT

I was sent this last night, with no email body:

To: chris@webarchitects.co.uk
Subject: CRINmail 1459
X-PHP-Originating-Script: 1005:mimemail.module
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8Bit
X-Mailer: Drupal
Sender: CRIN <info@crin.org>
From: CRIN <info@crin.org>
List-Unsubscribe: <https://www.crin.org/en/newsletter/confirm/remove/XXXX>
Precedence: bulk
Message-Id: <E1a9N9t-0001cP-Qt@crin2.crin.org>
Date: Thu, 17 Dec 2015 01:15:05 +0000

This looks like another case of the issue previously raised here: ticket:14

#54: 502 Errors

chris — Tue, 22 Dec 2015 11:06:04 GMT

Last night the wiki:NginxLogWatch script found a lot of 502 errors:

Dec 22     288 502, 0 503 and 0 504 errors from crin2.crin.org
Dec 22    4283 502, 0 503 and 0 504 errors from crin2.crin.org

I'm not sure why yet.

#56: Drupal Caching

chris — Sun, 03 Jan 2016 11:46:35 GMT

This is a ticket to discuss and then implement some additional caching for the https://www.crin.org/ Drupal site.

Possible options:

Generating static content from Drupal and serving these to non-logged in users, for example using Boost or something like it.
Caching PHP generated pages using Nginx.
Using a caching server such as Varnish.

My preference would for 1. and 2., I can start doing some research on how best to do 2. I'd rather not do 3. if possible due to the complication it would add: php5-fpm -> varnish -> nginx.

#60: Advania S3 Account

chris — Thu, 04 Feb 2016 11:36:22 GMT

This ticket is to track the time spent answering Andrew's questions regarding the Advania S3 account which is used for backups by Crin3.

#65: Custom 502 and 503 pages for crin.org

chris — Sun, 28 Feb 2016 14:17:03 GMT

It would be more informative if there were custom 502 and 503 error pages for https://www.crin.org/ rather than the default Nginx ones.

I will write up some details below on the 502 and 503's we seeing getting, see also ticket:54.

I'm happy to create a static 502 and static 503 error page and will look at adding it to the git repo.

#66: Optimise backups, omit some MySQL tables and delete old backups from s3ql

chris — Tue, 08 Mar 2016 10:59:50 GMT

Currently the DumpMysqlTables script doesn't omit or truncate any tables so the backups contain unneeded data, such as cache tables, Drupal tables which can be truncated, see:

https://drupal.stackexchange.com/questions/22041/which-drupal-tables-are-safe-to-clear

The same will be the case for Piwik and ownCloud and MediaWiki.

In addition php session files should be deleted.

Also the S3QLBackup script could be improved so it deleted old backups.

#72: exim paniclog on crin3.crin.org

chris — Tue, 19 Apr 2016 09:47:12 GMT

I'm getting this email every day:

exim paniclog /var/log/exim4/paniclog on crin3.crin.org has non-zero size, mail system might be broken. The last 10 lines are quoted below.

2016-03-31 10:00:15 Warning: No server certificate defined; TLS connections will fail. Suggested action: either install a certificate or change tls_advertise_hosts option

#76: Google Apps setup for crin.com

chris — Wed, 06 Jul 2016 19:50:38 GMT

This ticket is to track the time spent setting up Google Apps for crin.com.

#77: Drupal contrib - Highly Critical - Remote code execution PSA-2016-001

chris — Wed, 13 Jul 2016 09:47:24 GMT

At 16:00 UTC (5pm BST) fixes for multiple "highly critical remote code execution vulnerabilities" in unspecified Drupal 7 modules will be released and it is expected that "exploits are expected to be developed within hours/days", see:

https://www.drupal.org/node/2764899

Peter: do you have this in hand? I notice that the dev site is still not running properly:

https://dev.crin.org/

CSS is linked like this:

@import url("https:///sites/all/modules/contrib/domain/domain_nav/domain_nav.css?o4jry7");
@import url("https:///modules/field/theme/field.css?o4jry7");

JS is linked like this:

<script src="https:///sites/default/files/js/js_zzcIWOou_jnX0ZWAIA4sb6Xy_p5a8FZNA0GySvuWjPU.js"></script>

And images are linked like this:

<img typeof="foaf:Image" src="https:///sites/default/files/styles/390x387/public/1.1.jpg?itok=p_PWQReL" width="390" height="387" alt="" />

Is there anything I can do to help?

#81: crin3 backup issue

chris — Fri, 19 Aug 2016 09:36:01 GMT

Munin email alert I'm getting every 5 mins:

Date: Fri, 19 Aug 2016 09:30:16 +0000
From: munin application user <munin@crin1.crin.org>
Subject: crin3.crin.org Munin Alert
crin.org :: crin3.crin.org :: Disk usage in percent
        WARNINGs: / is 97.35 (outside range [:92]).
        OKs: /run is 10.40, /dev/shm is 0.00, /boot is 87.07, /run/lock is 0.00, /sys/fs/cgroup is 0.00, /run/user/1000 is 0.00.

#89: Broken Links

matthew — Mon, 24 Oct 2016 12:11:44 GMT

https://www.crin.org/en/library/publications/crin-newsletter-15-mainstreaming-child-rights https://www.crin.org/en/library/publications/crin-newsletter-16-children-and-young-peoples-participation

were reported as broken

#97: Debian Stretch

chris — Mon, 30 Jan 2017 10:59:00 GMT

Debian Stretch will probably be released in May 2017 or so, we need a plan to migrate to it, specifically:

PHP 7.0
MariaDB 10

This has been raised with Russell on Bitbucket.

#99: Let's Encrypt Cert for CRIN.org

chris — Mon, 30 Jan 2017 14:32:43 GMT

The Gandi cert expires in a couple of weeks, in 17th Feb 2017, see:

https://www.ssllabs.com/ssltest/analyze.html?d=www.crin.org&latest

It would make sense to switch to use https://letsencrypt.org/ and the client implementation I suggest we use is this one https://github.com/Neilpang/acme.sh

#102: Security certificate issue

russell — Fri, 10 Mar 2017 12:30:04 GMT

Hi Chris,

I'm having trouble browsing to the stage site today on crin4 - I'm getting:

SEC_ERROR_EXPIRED_CERTIFICATE

.. trying to view stage.crin.org

Are you able to help there?

Many thanks, Russell

#103: Upgrade CRIN4 to 2GB of RAM

chris — Thu, 16 Mar 2017 09:37:21 GMT

Ticket to track the upgrading of Crin4 from 1GB to 2GB of RAM.

#106: MySQL Error

chris — Mon, 27 Mar 2017 13:37:30 GMT

On Saturday morning the MySQL database on Crin1 was generating errors which prevented the site for working, this was fixed by running this command on the server:

mysqladmin flush-hosts

#111: Backups to Webarchitects server

chris — Thu, 13 Apr 2017 10:11:54 GMT

This is a ticket to setup backups to store1.webarch.net on.

#113: MySQL Performance

chris — Tue, 25 Apr 2017 11:22:11 GMT

MySQL is set to use a lot of resources, see the RAM allocation here:

https://munin.crin.org/munin/crin.org/crin1.crin.org/multips_memory.html

And also a lot of queries are cached via memcache, which also has a lot of RAM allocated, see:

https://munin.crin.org/munin/crin.org/crin2.crin.org/multips_memory.html

What can we do to make it quicker?

See also the work done when the server was setup on ticket:9

#114: Update TLS certs for MySQL

chris — Fri, 05 May 2017 12:20:04 GMT

The TLS certs for MySQL connections between the servers are due to expire on 7th May 2017 so need to be updated.

Peter, Russell, I have added you just so you know this is happening, it'll involve restarting MySQL when the new keys and certs are in place, so there might be a few moments of site downtime, but I'll do this on the dev/staging sever first.

#115: 500 Errors for crin.org

chris — Tue, 16 May 2017 17:00:33 GMT

There have been a lot of 500 errors today and they appear to be related to lines like this in /var/log/php/error.log:

[16-May-2017 17:33:08 Europe/London] PHP Fatal error:  Call to undefined function entity_translation_language_load() in /var/www/prod/docroot/includes/menu.inc on line 593

The section on the file in question:

 538
 539 /**
 540  * Loads objects into the map as defined in the $item['load_functions'].
 541  *
 542  * @param $item
 543  *   A menu router or menu link item
 544  * @param $map
 545  *   An array of path arguments; for example, array('node', '5').
 546  *
 547  * @return
 548  *   Returns TRUE for success, FALSE if an object cannot be loaded.
 549  *   Names of object loading functions are placed in $item['load_functions'].
 550  *   Loaded objects are placed in $map[]; keys are the same as keys in the
 551  *   $item['load_functions'] array.
 553  */
 554 function _menu_load_objects(&$item, &$map) {
 555   if ($load_functions = $item['load_functions']) {
 556     // If someone calls this function twice, then unserialize will fail.
 557     if (!is_array($load_functions)) {
 558       $load_functions = unserialize($load_functions);
 559     }
 560     $path_map = $map;
 561     foreach ($load_functions as $index => $function) {
 562       if ($function) {
 563         $value = isset($path_map[$index]) ? $path_map[$index] : '';
 564         if (is_array($function)) {
 565           // Set up arguments for the load function. These were pulled from
 566           // 'load arguments' in the hook_menu() entry, but they need
 567           // some processing. In this case the $function is the key to the
 568           // load_function array, and the value is the list of arguments.
 569           list($function, $args) = each($function);
 570           $load_functions[$index] = $function;
 571
 572           // Some arguments are placeholders for dynamic items to process.
 573           foreach ($args as $i => $arg) {
 574             if ($arg === '%index') {
 575               // Pass on argument index to the load function, so multiple
 576               // occurrences of the same placeholder can be identified.
 577               $args[$i] = $index;
 578             }
 579             if ($arg === '%map') {
 580               // Pass on menu map by reference. The accepting function must
 581               // also declare this as a reference if it wants to modify
 582               // the map.
 583               $args[$i] = &$map;
 584             }
 585             if (is_int($arg)) {
 586               $args[$i] = isset($path_map[$arg]) ? $path_map[$arg] : '';
 587             }
 588           }
 589           array_unshift($args, $value);
 590           $return = call_user_func_array($function, $args);
 591         }
 592         else {
 593           $return = $function($value);
 594         }
 595         // If callback returned an error or there is no callback, trigger 404.
 596         if ($return === FALSE) {
 597           $item['access'] = FALSE;
 598           $map = FALSE;
 599           return FALSE;
 600         }
 601         $map[$index] = $return;
 602       }
 603     }
 604     $item['load_functions'] = $load_functions;
 605   }
 606   return TRUE;
 607 }
 608

Peter, is the the cause of the 500 errors or is it a symptom, or is it unrelated? Do you have an idea what is going on here?

#116: Limit the number of MySQL connections from Crin4 to Crin1

chris — Wed, 17 May 2017 11:44:18 GMT

Both the dev, Crin4 and live Crin2, servers use the MySQL database on Crin1 and we want to limit the resources available to Crin4 so it reduced the impact on the live site.

Some documentation on this:

#117: Install Newrelic on Crin2

chris — Wed, 17 May 2017 11:51:53 GMT

Peter has requested that Newrelic be installed on Crin2.

Note that last time it was installed we had to remove it due to the resources it was using, see this thread ticket:73#comment:24, so I'd advise against leaving it on the server all the time.

#118: Piwik 3.0.4 and some setting changes

chris — Fri, 02 Jun 2017 09:58:17 GMT

The latest Piwik is 3.0.4

#121: [webarch-mail] Planned migration of the email services at mail.webarch.net

chris — Mon, 19 Jun 2017 09:30:05 GMT

Hi
You are being sent this email because you have a email account on
mail.webarch.net, if you don't believe this to be the case please let us know.
Soon we will be migrating your email account to a new Webarchitects mail server
running Mailcow, https://mailcow.email/
The new server will be available at https://webarch.email/ and it will provide
a lot of new features.
We haven't yet got a date for when all the email domains will be migrated but
we are moving the first few on the evening of Friday 23rd June from 8pm
onward.
To ensure that no email is lost when we do the migration we will have to stop
the mail.webarch.net and webarch.email servers for a little while, no emails
will be lost but some might be delayed while the servers are unavailable.
We will post an update to https://www.webarch.info/ when we start the migration
on Friday 23rd June and also when it has been completed.
If you have any questions please don't hesitate to get in touch via
support@webarchitects.coop.
All the best
Chris
--
Webarchitects Co-operative
http://webarchitects.coop/
+44 114 276 9709
@webarchcoop
_______________________________________________
webarch-mail mailing list
webarch-mail@lists.webarch.co.uk
https://lists.webarch.co.uk/mailman/listinfo/webarch-mail

#122: DB sync failed

russell — Fri, 23 Jun 2017 14:38:12 GMT

Hi Chris,

Our dev. site (https://dev.crin.org) looked like it got rebuilt from a very old backup.

I've just tried to resync dev. from live, and the DB sync has failed:

crin4:/var/www/dev/docroot/drush sql-sync @crin.prodbox-prod @crin.dev

.. with error 'Query failed'

This has always worked until today.

Any idea what's gone wrong?

Thanks, Russell

#125: Piwik 3.1.1

chris — Thu, 21 Sep 2017 08:01:47 GMT

See the changelog https://piwik.org/changelog/piwik-3-1-1/

#127: 1984.is Server Rebuild

chris — Tue, 21 Nov 2017 19:26:16 GMT

Due to critical hardware failure at 1984.is all three servers needed rebuilding from scratch.

#129: Problem with image uploads

chris — Mon, 11 Dec 2017 18:09:39 GMT

unable to upload new documents and images to the website.

#131: Let's Encrypt Certificates

chris — Tue, 20 Feb 2018 21:17:52 GMT

I have installed a new script for getting HTTPS certs on both servers:

https://github.com/Neilpang/acme.sh

And there are now new certs for these domains:

The Trac cert on this server is also used for, wiki.crin.org, phpmyadmin.crin.org, munin.crin.org and stats.crin.org.

#132: Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002

chris — Wed, 28 Mar 2018 20:06:22 GMT

https://www.drupal.org/sa-core-2018-002

#19: PHP Parser Error - node--country.tpl.php

chris — Mon, 15 Jun 2015 10:21:19 GMT

The php-fpm error log at /var/log/fpm-php.www.log contains lots of entries like this:

[15-Jun-2015 11:17:32 Europe/London] PHP Parse error:  syntax error, unexpected end of file in /var/www/drupal/sites/default/themes/crin/templates/node--country.tpl.php on line 522

Line 522 is the last line of the file, it simply contains a closing } bracket, this is the last part of the file:

    <?php
  }
  ?>
  <?php // print render($content['links']); ?>
  <?php // print render($content['comments']); ?>
<?php
  // 'Albania' = 441;
  //$node_load(441);
  /*
  global $user;
  if($user->uid == 1 ){
    if($node->nid == 441){
      //update_country_from_wiki($node);
    }
  }
  */
?>
</article>
<?php
}

This is an issue for the Drupal developers to look at.

#57: RSS requests from MediaWiki site to Drupal site

chris — Thu, 07 Jan 2016 13:05:37 GMT

The MediaWiki site requests RSS URL's which are 404's at such a high rate that it is blocked, see ticket:54#comment:6

#82: Attempted DDOS?

chris — Sat, 24 Sep 2016 09:20:39 GMT

Yesterday evening there 1k 502 errors caused by one user agent from multiple IP addresses. This isn't an uncommon event, I usually don't write them up, but I thought it might be useful for Mathew if I do with this one.

#92: dev.crin.org needs /en appending the the URL for CSS to load

chris — Tue, 08 Nov 2016 12:35:59 GMT

This came up on ticket:77#comment:10 and it would be good to find the cause and also to solve it.

#93: Piwik 2.17.1

chris — Fri, 02 Dec 2016 14:11:51 GMT

Not urgent, no security updates, see https://piwik.org/changelog/piwik-2-17-1/

#120: crin2 mail queue

chris — Thu, 15 Jun 2017 18:36:04 GMT

There is a mail queue on Crin2, we haven't had one of these for ages, Munin reports:

crin.org :: crin2.crin.org :: Exim Mailqueue

WARNINGs: frozen mails is 171.00 (outside range 100). OKs: queued mails is 230.00.

Graph here:

https://munin.crin.org/munin/crin.org/crin2.crin.org/exim_mailqueue.html

Anyone know if this is something to be concerned about?

#42: How CRINmail deals with email addresses that no longer work

chris — Thu, 10 Sep 2015 10:42:07 GMT

When the CRINmail newsletter is sent out via Drupal it has the following from envelope:

Return-Path: <info@crin.org>

This results in emails that are returned as undeliverable going to that address and the Drupal site doesn't know when a recipient address no longer works so is unable to stop sending emails to address that bounce email back.

One symptom of this problem are the forozen emails that build up after each CRINmail run, see the blue on Munin graphs here:

https://munin.crin.org/munin/crin.org/crin2.crin.org/exim_mailqueue.html

What should happen is that the from envelope (this is different from the From: header users see, that can remain as it is) should be an address that Drupal can check (probably via IMAP but we could set up one of the servers to accept SMPT email if needs be) and then do some thing sensible with the bounces.

See for example the discussion here:

https://stackoverflow.com/q/1011714

#17: Debian System Updates

chris — Tue, 09 Jun 2015 18:42:00 GMT

This ticket is document system updates done to the servers.

Sources for further information:

These updates are generally done using the wiki:AptitudeUpdateScript and this records all the changes in the /root/Changelog and then the contents of the Changelog are pasted into the ticket to document the upgrade.

#45: MediaWiki 1.23.11

chris — Fri, 16 Oct 2015 08:44:21 GMT

Email on the announcements list:

Tomorrow we will be issuing a security release to all supported
branches of MediaWiki.
The new releases will be:
1.25.3
1.24.4
1.23.11
Fixes will be available in these respective release branches, the
unreleased 1.26.x branch, and master. Tarballs will be available
for the above mentioned point releases as well.
This security release will encompass core only, no bundled extensions
are affected.

#64: Let's Encrypt HTTPS Certs

chris — Fri, 26 Feb 2016 11:30:54 GMT

These certs, on Crin1, are due to expire soon:

The one on Crin2 has a while to run:

https://www.crin.org/ 17/02/18

To save money I suggest that the certs on Crin1 are replaced with Let's Encrypt ones, for the above domains and in addition these sites which use CAcert:

https://munin.crin.org/ 07/05/17
https://phpmyadmin.crin.org/ 07/05/17

I suggest we still use CACert for the MySQL certs as these are valid for two years and Let's Encrypt ones are only valid for 3 months and it would be complicated to automate the renewal and deployment for these certs.

#79: Create accounts for Matthew

chris — Thu, 21 Jul 2016 10:15:23 GMT

Create Trac and other accounts for Matthew.

#85: Trac is run on a different IP

matthew — Tue, 04 Oct 2016 15:07:07 GMT

#86: Discussion

chris — Wed, 05 Oct 2016 12:14:15 GMT

This ticket is to keep track of time spent discussing issues with Matthew via email and IRC.

#88: enoch website is deactivated

matthew — Tue, 11 Oct 2016 10:13:17 GMT

#90: Cost of backup is estimated

matthew — Tue, 25 Oct 2016 07:06:20 GMT

It would be useful to estimate the expected cost of back up, by estimated the size and correlating this with the advertised price page.

#108: Go live

russell — Tue, 04 Apr 2017 16:01:05 GMT

Hi Chris,

I've got a round of work ready to go onto Crin live. All tested and signed off on stage. The code element is very light. I don't expect any problems, but just letting you know. I'm planning to get into this as the working day is finishing today.

Best, Russell