It’s our aim to make things easier and quicker for our customers, so over the past few weeks we’ve been rolling out CloudLinux OS into our web hosting environment. The new OS is designed to give customers increased control over their hosting.

CloudLinux is an operating system that uses lightweight virtualization to improve the performance and stability of the server. Using some of the latest technology found in cloud environments, it brings some massive benefits to a regular hosting ecosystem. The CloudLinux OS gives our web hosting, PaaS and SaaS providers the ability to manage resources available to their shared hosting customers in a reliable and efficient way.

In a shared web hosting environment, one web server is shared between users. Hosting companies benefit from enhanced security and stability within the Lightweight Virtual Environment (LVE) created by CloudLinux OS. System administrators can control CPU, memory and connections available to each tenant. The result is effectively preventing one site from slowing down or taking down an entire server, allowing hosters to substantially increase server density, bringing far greater efficiency to their business while delivering overall improved service to customers.

To celebrate the agreement, the two companies have a special offer for customers. Anyone who orders and installs a server with a CloudLinux license before the 1^st March 2012 will receive the first two months of CloudLinux free of charge. CloudLinux OS licenses can be purchased directly on our site and existing customers can license their existing infrastructure through LeaseWeb’s customer portal. Fancy finding out more about how you can benefit from the CloudLinux OS? Get in touch with us via sales@leaseweb.com.

                          

Last week, we connected another AMS-IX connection, which gives us a total of 120Gbps connection. At the very moment it was connected, we were already doing over 100Gbps at the AMS-IX. This makes us the largest traffic sending/receiving party on the largest internet exchange of the world! According to the AMS-IX there is no other company connected to the AMS-IX transmitting more traffic via the exchange as we do.

AMS-IX traffic @ LeaseWeb

                          

EvoSwitch, the hosting facility we use, has a Power Usage Effectiveness of 1.6 (yearly). Traditional (and most) data centers have a PUE of around 2.0.  Their goal is to have a PUE of 1.2, something Google claims to have already.

Different business, different options
Google and others have completely different business cases then data centers like EvoSwitch. The way they manage their data centers differ completely from the way we have to. Restrictions on accessibility by clients, being carrier-neutral network data center and more, matter less for data centers Google is running, than a multiple client data center (our clients cannot take the boat to the data center :)). Equipment must be protected properly, but clients must have physical access to the premises as well (have in mind that unlike Google, we have clients with their own hardware and thus they need access). Size also matters. Lowering energy consumption is much easier for smaller data rooms located within a SME, than a large data center.

One of the easiest ways of saving energy is raising the airflow temperature. In the past it was almost mandatory to have an inflow temperature of 21degrees, however server equipment can operate at higher temperatures. We currently use an average temperature of 24degrees and might increase temperature in the future. To be able to raise temperature, you will probably also need to make sure no short circuiting of hot and cold air is possible (see also ‘Cooling a datacenter’). Nowadays you will see concepts like the Cold-Corridors being used more and more. Various options can be taken even with legacy data centers (closing empty racks with covering panels, using efficient Uninterruptable Power Supply (like Delta Conversion from APC)).

Not every technology can be used in all situations. As said before, building a data center in the sea or coal mine is no option for multiple client data centers, but might be an option for compagnies like Google, MicroSoft etc. Using free-cooling (ambient temperature is used for chilling water) can be used in cold countries, but is not an option for example Dubai.

New techniques will become available the next years. What can be used is depending on several business parameters. There is not a ‘one-suits-them-all’ solution. Saving energy remains a pioneering journey for many.

Co-author: Laurens Rosenthal, Innovation Director EvoSwitch Datacenter Netherlands

                          

Looking at the traffic history, we have quadrupled the traffic within one year. Early 2007 we did around 70Gbps, now over 300Gbps.

The question pops up: where does it stop? Do we expect another increase this big within one year? Although we see more content getting online (video, file sharing, SaaS, etc.) I don’t think we will quadruple the traffic again within one year, but doubling is something we always did.� So let’s see if we can break through the 600Gbps by the beginning of 2010. Would be nice :)

                          

On the March 23 we announced the WinPHP Challenge the competition for PHP programmer to create the app they always wanted to write and have the opportunity to win a trip to the MIX 2010 conference in Las Vegas. This competition is run by the Dutch PHP Conference, Microsoft and LeaseWeb.

When Cal Evans and myself were discussing this competition it soon became clear that we needed to faciltiate the competitiors with a server running Windows Server 2008 so they are able to deploy their application. I didn’t have to think long and immediately called our friends at LeaseWeb.

LeaseWeb, being one of the biggest hosters in Europe, has the expertise and scale to host the competition and give all the competitiors their own Virtual Machine running Windows Server 2008. They are providing this on their premium storage solution from the Evoswitch datacenter. LeaseWeb is one of the fastest growing hosters and they were a TAP customer for Windows Server 2008. They have been selling Windows Server 2008 dedicated servers one day after the release date of Windows Server 2008 which make them one of the most experienced Windows Server 2008 hosters.

Because LeaseWeb always wants to be the first with new technologies they were also part of the Hyper-V technical adoption program and will launch a very competitive Virtual Dedicated Server offer based on Hyper-V very soon again as one of the first in the Netherlands.

This expertise made LeaseWeb the obvious partner to work with for the WinPHP Challenge and they were happy to join DPCon and Microsoft in making this contest happen.

I am very happy to send out the login codes to the Virtual Dedicated servers on Monday when the competition kicks of.

Happy coding

Bram Veenhof

About Bram Veenhof

Bram Veenhof is Web Platform Architect at Microsoft Netherlands. For three years, Microsoft and LeaseWeb are working extensively together, and Bram Veenhof is one of LeaseWeb’s primary contact persons. When Microsoft and the Dutch PHP Conference were discussing the WinPHP Challenge 2009, Bram immediately thought about LeaseWeb. Bram is a frequent blogger on www.msdn.com/bramveen and can be followed on www.twitter.com/bramveen.

                          

LeaseWeb is hosting a lot of public upload sites (image- and filehosting sites). For some of those sites, it is impossible to check every file that is being uploaded by unknown users (we have customers with over 1.000.000 uploads/day). With the help of our customers, we have created an online service where hashes can be checked against a database automatically. From several organizations we have received databases containing hashes of known child pornography images (to learn more about hashes see Cryptographic Hashes). During this pilot, we will be using a database from Netclean and databases from Dutch Police.

How it works

When a user is uploading a new image it will be hashed via MD5 to a unique string. This string will be matched against our databases with known illegal material. When a match is found, the uploaded image is illegal and will not be published online. We will not record IP’s for the matched images to prevent privacy issues.

Caveats

Of course, there are some caveats to this project. If someone changes only a small piece of the image, matching will not be possible as the hash will change. Also the number of hashes in the databases is limited and small compared to the number of illegal images distributed. Still a large part of the distribution of child pornography happens under the surface and not via public websites.

During this pilot we will closely monitor the number of hits (both positive and false) to see if it’s effective. But when can we name it effective? With 1 blocked image? Or 10? Or 1000? We will improve the used techniques further and are already looking in smarter fingerprinting solutions (where even small changes in images can be matched). The future will have to show us if this is a way to go, along with other developments from the industry.

See also the press release

                          

Virtualization Enterpise and SME

I know companies who did their calculations on a virtualization application investment over and over again, just to make sure the ROI is good. Although cost saving shouldn’t be the main reason for choosing virtualization – flexibility and energy saving in the hosting environment, in my opinion, are better arguments – I can imagine why some companies hesitate. An initial investment in virtualization tends to be a bigger investment than an investment in a traditional hosting design, especially when you choose the Rolls Royce of virtualization software: VMware. Do you meet the break-even point of this investment? It’s often hard to tell in advance.

Outsourcing Hosting

Luckily we have a great VMware platform installed within the (green, CO2-neutral) data center environment of LeaseWeb on which virtual servers run. This way our clients can rent state-of-the-art virtual servers, without the hassle of complex investment calculations and without the risks that go with the purchase of software applications in general. With the assurance of a great and very reliable hosting network for continuous worldwide internet presence, and always enough knowledge back-up on VMware software within the LeaseWeb organization.

LeaseWeb is one of VMware’s top hosting partners in Europe, as such also present at VMware Europe 2009, which means that our engineers are well trained on VMware. They can help out with the VMware hosting design, maintenance and support, right through to technical support on the hardware.

Rolph Haspers,
Operations Director LeaseWeb

                          

Last week the WODC (Research and Documentation Centre) published an interesting report (Dutch with English summary) about the technical and legal possibilities of blocking and filtering child pornographic material on the internet. In their research the WODC tried to find an answer to the question: what are the technical posibilities of filtering and blocking content on the internet and what are the legal possibilities?

Currently their is little experience with filtering content in the Netherlands. The KLPD (National Police Services Agency) is maintaining a blacklist which at least one ISP (UPC) is using. One of the conclusions by the WODC is that filter techniques used by the KLPD (filtering based on URL) requires a disproportionately large amount of time resulting in an out-dated blacklist: sites appear on the list when hosted in the Netherlands (and the KLPD can take normal legal actions against those sites), sites are hosted in countries with which the Netherlands has a legal cooperation treaty or sites no longer have illegal material. The list is also not updated frequently enough (once every two-three months).

On top of this the WODC concludes: “No procedures have heen established for the management of the list by the KLPD and no verifiable criteria have been formulated on the basis from which additions to the list are decided“. Which leaves me the question how a site gets listed? Who makes the descission on listing a site? From my experience with the KLPD I know they have enough knowledge to list only sites they are 100% sure the site is illegal (to Dutch law). However, what happens when you are using this list and a legal site appears on the list?

Legal context

Although several laws provide the legal authorities some power to act against content on the internet (make stored data inaccessible), it is unclear if filtering and blocking fits in all the involved laws. ISPs are not responsible for the data traffic they did not initiate or influence with respect to the content. They have to act in case they have knowlegdge of unlawful material.
Escpecially when freedom of speech is involved, governments must be aware that overblocking (blocking legal content) will occur. If a law will be provided to the government which gives them the authority to block content, the instruments used for blocking must be verified continously to prevent that the blocking is in violiation with the constitution.

Taking a look at the blacklist previously mentioned, the KLPD makes agreements with ISP. The WODC concludes that “the filtering and blocking of internet traffic infringe on the constitutional right of confidential information, as regulated in art. 13 GW and art. 8 EVRM, these require a similar measure for a formal legal basis.“. As a result, the agreements between the KLPD and ISP are therefore not legally valid. “These agreements form therefore an unacceptable thwarting of public law authority and with this public safeguards”.

Four scenarios

The report ends with four possible scenarios:

1. Leaf filtering to private companies, non-commercial organisations and internet users. There are no legal complications.
2. Governments stimulates and facilitates the development of filters without taking executory duties on itself. This gives governments some control.
3. The governments take care of the implementation of some of the tasks itself. In a PPC (public-private cooperation) the police provide lists to block wich the market sectors use to develop the filters. Police must be full transparent in the criteria on which the list has been put together.
4. Governments make the implementation of filters mandatory based on formal legislation. ISP have to install filters to block content. A variation could be that the government forces certain persons or organisation (public libraries etc.) to take action, without having the authority to filter.

One last conclusion by the researchers is that is unknown how effective filtering and blocking content on the internet really is. This (along with other aspects) must be taken into account when choosing a scenario for the future.

Minister of Justice Hirsch Ballin already said he would stop the current system (KLPD-blacklist). Providers already announced an independent organisation which will create a blacklist. The ECP.NL will take a look at the recommendations made by the WODC to provide a procedure before the end of this year. One of the biggest challenge will be the legal status of the list.

                          

What is a Honeypot?

Defining what a honeypot is can be harder then it sounds. Honeypots come in many different shapes and are used in many different ways. In general a honeypot is a (set of) tool(s) monitoring networks for unauthorized activities. Normally a honeypot should not see any traffic, and as a result all traffic it sees is malicious. Depending on the kind of honeypot, this traffic can be analyzed. Popular honeypots are Nepenthes, HoneyD, HoneyWall.

We are using Nepenthes for our honeypot servers (three in total on three different locations). With Nepenthes, we analyze the requests we get from the attackers.The honeypot gives the attacker the impression that his attack is successful. These attackers often offer download links in their requests to malicious files, often Trojans and other viruses. We download those files and give them a fingerprint. With those fingerprints we can see if we have seen this file before. After downloading, we check the file with several virusscanners to see if the file contains a virus. Along with this information we collect the source IP’s, source and target ports and timestamps. This gives us more information about the attacks.

Findings after one month

Our honeypot is now running for a month and so far we have seen the following:

• We have seen over 50.000 attacks on three servers.
• Around 80% of the source ports are 445 (45%), 139 (22%) and 135 (13%).  These ports are mostly used by file sharing applications (see What’s port 445 in Windows (XP/2000/2003). You should never open these ports on a public network to the outside world. Some providers even block these ports on their routers, which is at least a good idea if you a lot of home-pc’s on your network (consumers don’t install the latest security patches as often as they should).
• 75% of all attacks only come from < 0.5% of the source IP’s. Attacking IP’s have the intention to try over and over again for a while once an attack is successful.
• 65% of the found viruses is Trojan.SdBot, followed by Worm.Allaple (10%) and Trojan.MyBot. Allmost all viruses are Windows viruses.

If you want to see some live statistics you can view some graphs on http://hp.leaseweb.net:8000/charts/graphs.php

Honeypots like nepenthes are very useful in collecting data without any risks. During the next months we will continue to collect and analyze data which we will use to secure our network. We will update the Honeypot page with more information at a later stage.

                          

In the recent months we have deployed our new VMware platform to start hosting VPS. After some testing by our engineers and some customers, we are now ready for production. Starting from EUR 99,-/month you will get a full VMware VPS with (almost) all features (DRS/HA/Vmotion/GUI).

We are now using Dual Quad Core servers with at least 32GB RAM, connected to NetAPP storage (FAS 3040 at this moment and already looking into the bigger brothers). Offcourse, everything redundant (network/power/etc.) to minimize the risk of downtime. The platform can be scaled without any problems to fit the needs of our customer.

Why VMware?

In my opinion VMware is the only serious option in our business at this moment. Features like DRS (to optimal manage your resources), Live VMotion (to move a VPS from one host to another without any downtime) and HA (High Availability, to automatically start servers when one hosts fails) are necessary to guarantee high uptime and good perfomance. Xen, Hyper-V,etc. do offer some of these functionalities, but not as complete like VMware (for example: Xen doesn’t provide DRS/HA by design, Hyper-V (the new Microsoft product) doesn’t have VMotion (without downtime)). Also the ability to connect to a nice GUI, connect your own ISO/CD-ROM to your VPS, is something our customers requested and which can be done with VMware.

 With our VPS products you will get all these features. It is also possible to connect to the console port of your server (KVM), which can be helpful in case your VPS doesn’t boot correctly. Want to install your own kernel/OS? No problem, you can mount your CD-ROM or an ISO-image to your VPS within seconds. You can choose various operating systems (Windows 2003/2008, CentOS, Debian, FreeBSD, Ubuntu etc.) to be installed when ordering.

Want to know more? Check our VPS pages at our website