T. Longren

WordPress Theme: Unwakeable 1.5.3

Published by Tyler on January 19, 2010 at 2:41 pm 0 Comments

Unwakeable 1.5.3 is available for download. This version is built off K2 1.0.3 and should work beautifully with WordPress 2.9+. You can head over to the Unwakeable page to get the download, or you can grab it here.

K2 1.0 added more support for WordPress 2.9. For example, K2 1.0 supports new WordPress features such as post thumbnail images. One of the more noticeable changes to K2 since the 1.0 release is the absence of SideBar Manager (SBM). It sounds like it was simply too much work to maintain SBM, and was beyond the scope of what K2 is:

It’s worth mentioning that the last remnants of the old SideBar Manager, or SBM, have now been removed from the codebase. It started out as a fully-fledged replacement for WP’s lacking widgets system and ended up as a patch-of-sorts to the widget system, allowing for widgets to be placed only on specified pages. But in the end, while the native widget system is still very much in need of an update, it didn’t feel right for K2 to try and cover that particular area of the administration interface. And besides, other plugins for doing just that exist already.

So instead of spending our time patching that system for an ever-changing WordPress, our time is probably better spent on more theme-specific functionality, like the rolling archives or livesearch systems, as well as keeping up with new WordPress features, like for instance Post Thumbnails.

Rather than break down all of what’s changed in recent versions of K2, I’m going to make it easy on myself and direct you to the K2 1.0 release announcement. Just know that Unwakeable 1.5.3 sports all the features found in K2 1.0.3. You can comment on this post or on the Unwakeable page with questions or comments.

Categories: Internet, Noteworthy, Open Source, PHP, Personal, Unwakeable and WordPress Tags: Internet, k2, Noteworthy, Personal, PHP, Unwakeable, WordPress, wordpress-theme.

WordPress 2.9.1

Published by Tyler on January 19, 2010 at 11:13 am 0 Comments

WordPress 2.9.1 was released a little over two weeks ago. You can download it at the usual location.

From the release announcement:

This release addresses a handful of minor issues as well as a rather annoying problem where scheduled posts and pingbacks are not processed correctly due to incompatibilities with some hosts. If any of these issues affect you, give 2.9.1 a try. Download 2.9.1 or upgrade automatically from the Tools->Upgrade menu in your blog’s admin area.

WordPress 2.9.1 came less than a month after WordPress 2.9.

Categories: Internet, Open Source and WordPress Tags: Internet, Open Source, WordPress.

WordPress 2.8.6 Security Release

Published by Tyler on November 14, 2009 at 9:32 am 0 Comments

WordPress 2.8.6 is available for download. It’s another security release and was released two days ago. Below is a summary from the WordPress development blog:

2.8.6 fixes two security problems that can be exploited by registered, logged in users who have posting privileges. If you have untrusted authors on your blog, upgrading to 2.8.6 is recommended.

The first problem is an XSS vulnerability in Press This discovered by Benjamin Flesch. The second problem, discovered by Dawid Golunski, is an issue with sanitizing uploaded file names that can be exploited in certain Apache configurations. Thanks to Benjamin and Dawid for finding and reporting these.

You can download WordPress 2.8.6 here.

Categories: Internet, Open Source, Security and WordPress Tags: Internet, Open Source, Security, WordPress.

How To: Cisco and Microsoft VPN Through Firestarter on Ubuntu

Published by Tyler on November 7, 2009 at 1:57 pm 0 Comments

After doing a fresh install of Ubuntu 9.10 Karmic Koala on my router, I realized that I had lost the ability to connect to my employer’s VPN. I use Firestarter for managing my firewall on this particular router.

As I usually do, I googled “firestarter vpn“. Much to my dismay, it appeared that the Firestarter website was no longer alive. Instead of the usual Firestarter page, a page filled with useless links about security and anti-virus loaded. Luckily I was able to access the cached version of the page from Google. Since then, it appears that the Firestarter website has come back to life.

I wanted to make a note of how to allow VPN connections in the event that the Firestarter website becomes inaccessible again, that’s basically the point of this post. The page on the Firestarter site that details VPN connections can be found here. This should apply to pretty much every Linux distribution, not just Ubuntu.

To allow VPN connections with the Microsoft VPN client, simply enter the following lines into /etc/firestarter/user-pre.

# Forward PPTP VPN client traffic
$IPT -A FORWARD -i $IF -o $INIF -p tcp --dport 1723 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i $IF -o $INIF -p 47 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i $INIF -o $IF -p 47 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

And to allow VPN connections with the Cisco VPN client, enter the following lines into /etc/firestarter/user-pre.

# Forward Cisco VPN client traffic
$IPT -A FORWARD -i $IF -o $INIF -p udp --dport 500 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i $IF -o $INIF -p tcp --dport 500 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i $IF -o $INIF -p 50 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i $INIF -o $IF -p 50 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

Finally, if you’re running a Microsoft VPN server and want to allow incoming PPTP VPN connections, add the following lines to /etc/firestarter/user-pre.

# Forward PPTP VPN connections to internal server
SERVER=192.168.0.100 # Internal VPN server

$IPT -A FORWARD -i $IF -o $INIF -p tcp --dport 1723 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -t nat -A PREROUTING -i $IF -p tcp --dport 1723 -j DNAT --to $SERVER
$IPT -A FORWARD -i $IF -o $INIF -p 47 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -t nat -A PREROUTING -i $IF -p 47 -j DNAT --to $SERVER

That should pretty much cover it. If you are using OpenVPN, head over to the Firestarter VPN configuration page for details.

Categories: Internet, Linux, Noteworthy and Open Source Tags: cisco, how-to, Internet, Linux, microsoft, networking, Noteworthy, Open Source, Security, ubuntu, vpn.

WordPress 2.8.5: Hardening Release

Published by Tyler on October 21, 2009 at 8:15 am 2 Comments

WordPress 2.8.5 has been released. This is another security release, just like the 2.8.4 release. As with the last release, the SANS Internet Storm Center has another post about the latest WordPress.

The WordPress team decided to call 2.8.5 a hardening release because it includes some security features that were back-ported to 2.8.x from the upcoming 2.9 series. Below are some details about 2.8.5 from the WordPress development blog:

As you know over the past couple of months we have been working on the new features for WordPress 2.9. We have also been working on trying to make WordPress as secure as possible and during this process we have identified a number of security hardening changes that we thought were worth back-porting to the 2.8 branch so as to get these improvements out there and make all your sites as secure as possible.

The headline changes in this release are:

A fix for the Trackback Denial-of-Service attack that is currently being seen.

Removal of areas within the code where php code in variables was evaluated.

Switched the file upload functionality to be whitelisted for all users including Admins.

Retiring of the two importers of Tag data from old plugins.

You can download WordPress 2.8.5 here.