I am in the process of migrating all 200 domain names (approximately 100 websites) on my server over to Mosso – which is why you would have gotten a 404 if you happened on the site for a short time last night. (.htaccess did not transfer correctly, so mod_rewrites were borked.) Sorry for any inconvenience – was my fault, not Mosso’s.
I have had my own dedicated machine, hosted in a colo in San Diego, for several years, and dedicated managed servers prior to that. While I enjoy the flexibility that running your own box allows, I just don’t have the time or interest in being a sysadmin, and I feel it is unwise for me to do a half-assed job at something I hate in a role that is as important as that. Until recently, moving all of those sites to any kind of shared hosting environment would have meant a steep increase in what I pay per month. With Mosso, I’ll be paying around $100 a month, $65 less than I pay now, assuming I don’t go over bandwidth.
I apologize in advance for how ranty this post is about to get. I realize some of you may have just come here to find out if Mosso would be a good match for you. I’ll explain more about my experience with them in a moment, but I have to get this off my chest first.
I’m tired of being treated like a moron
I haven’t done a shared hosting solution in years now, partly because its been cost prohibitive if you have more than a handful of websites, and partly because I got tired of being treated like a moron every time I had to talk to support. Just yesterday, I was on the phone with Lunarpages, on behalf of a friend. (My friend doesn’t know much about servers. His website had been compromised, so I offered to be the middleman between him and tech. I have NOTHING to do with his website – was just stepping in here.)
This is what I sent Lunarpages support:
We recently experienced a script exploit on the domain name example.com. John Smith, the account holder, is copied on this message, as I am helping him try to find the source of the problem.
While we’re still trying to isolate the origin of the vulnerability, in viewing the FTP logs, we see several IP addresses that seem suspicious – several of these IP addresses track back to Russia and China.
The exploit allowed hundreds of randomly named index files to be created in directories with 755 permissions, owned by and belonging to the <groupname> group. Additionally, existing HTML files were edited to have a javascript appended to them containing links to hundreds of websites, all of which are reported as malicious websites. We can provide sample files that were generated, however the javascript that was inserted used randomly generated function names, so its nearly impossible to trace back via a google search.
The webroots of the malware sites seem to be normal websites, so it would seem that these sites are infected and unaware of it. The files appearing on their sites redirect to the intermediary site onlinedetect.com which then forwards to the malware site pro4scan.com:
http://google.com/safebrowsing/diagnostic?tpl=safari&site=www.onlinedetect.com&hl=en-us
http://google.com/safebrowsing/diagnostic?tpl=safari&site=www.pro4scan.com&hl=en-usHowever, since the FTP logfiles are only accessible to us for 1 day, we are unable to view the apache and ftp logfiles for January 4, 2009, when the bogus files were created.
We have downloaded a recent backup of the site, however it would be great if we could access a backup from January 4th or 5th, as the 6th was the only day available. If possible, can you dump a backup from Jan 5 to the account root so we can download it by FTP.
We have already changed the login password to the FTP account, however since we are not 100% sure of what caused the exploit, if it is possible to set up a monitoring script on this account that will send a daily email of ftp login attempts and/or uploaded files, that would be extremely helpful. Not sure if you have something like that available.
We do not have many dynamic scripts set up on this account, however the one that could have potentially been the issue has been removed. If we had access to the log files from Jan 4, that would help us determine whether the exploit was done by way of passing malicious code via a GET or POST, which would help us rule out a few things.
We have set up a server monitor to alert us if the content of the affected pages changes more than 20%, but any assistance you can provide us with the above issues would be great.
Thank you very much for your assistance.
What I got in response was a form letter response telling me to change my password.
*blink*
Are you fucking kidding me?
First of all, I already told you I did that – second of all, did you even read beyond the first sentence? I am asking you for something – something only you can provide me. Don’t give me some bullshit form letter. You are support. Support me.
I haven’t had to deal with a retail virtual hosting company in a long time – I had hoped they had changed. Evidently, they have not.
So, yeah – anyway, the thought of returning to a hosting company rather than having my own server made me want to chew through my own wrists. But the thought of having issues (and there were a few, although mostly minor – maintaining a server requires work) that I’d have to tackle by myself, or with the help of a friend who had the skill but not the time was equally troubling.
Enter Mosso
A friend of mine in the PHP community had been talking to me about Mosso for a while, but I hadn’t really looked into it. The combination of a crappy economy, the fact that my Virtualmin license was about to expire (which was going to cost me a few hundred clams to renew), the fact that I no longer live in San Diego (which I deeply lament every day) and can’t just go down to the colo when I need to, and frustration over not having the time to do some things that needed to be done on the server finally forced my hand and I started looking into it.
Mosso is a Rackspace company, so their legendary “fanatical support” is extended to Mosso clients as well. I have worked with Rackspace a lot in the past, so there is a comfort level there. Mosso is also geared at developers, which is nice for a number of reasons, not the least of which being that when I call them, they know I have a clue and treat me appropriately.
Using Mosso, I can create as many individual sites as I want, including some for clients with hosting billing packages built right in. Moss takes care of emailing them a billing reminder, accepting the payment, and then they transfer the money to you. There is a fraud-prevention hold period that prospective customers should be aware of – when the client pays their bill, you don’t see the money right away. Of course, you can always disable billing and ask your customers to send you a check or pay you directly through some other method if that’s an issue for you. For me, remembering to bill my hosting clients was where I really sucked, so this feature was a definite plus. Getting my money a month or two later – as opposed to never getting it because I forgot to bill them – is an okay plan to me. Plus it saves me the hassle of getting another merchant account, which just isn’t worth it for me for the limited number of paid hosting clients I have on the account.
I chatted with some of the guys from Mosso on Twitter for a few weeks, and perhaps more importantly, I listened. I was watching how they interacted with customers, and what their customers were saying about them. I talked to friends who had made the switch, and pinged people I didn’t know who were using Mosso. This move is a BFD, and not a decision I could take lightly. I’d be moving around 5 very active and important websites with heavy customization and big fat databases, as well as a hundred smaller, less critical ones.
Finally we arranged a call. (I have never actually been given the option of spending a half hour on the phone with someone from a hosting company before buying in, so that it and of itself was new.) When the call was done, I had pretty much run out of reasons not to switch.
My two primary apprehensions were that Mosso does not support ssh, and that I didn’t know what my monthly bandwidth was for the box I’m currently on, so I couldn’t determine whether I would be in danger of going over straight out of the starting gate. Truthfully, the only times I usually need ssh are when something has gone wrong – I don’t use it that often, and Mosso does support SSHFs. As for bandwidth, I’m still not 100% sure on that end, but I talked to the fellow that handles my colo box and he said he didn’t think it went over 500GB per month, which is Mosso’s limit before they charge you extra. Most of the traffic on my server comes from my non-profit organization website, however, and Mosso will apparently comp bandwidth overages for the non-profit.
Sold – So what’s next?
So, I’ve been trying to migrate sites over, a few more every day. I have thirty-something moved over so far, but I’m taking it slowly so I don’t kill myself over it and don’t make mistakes. Its a lot of work, and being that I work full-time, commute 4.5 hours a day and run a non-profit, I’m beat by the time I get home.
So far, the migrations have been flawless. A few sites have had databases that were too large to import using phpmyadmin, but I just clicked on the “support > live chat” option in my admin, connected with a tech, and asked them to import it. Less than a minute later, it was done. It took longer to upload the sql dump than it did for the entire customer service experience. Moving this site took a little longer, just because of a larger database – but one of the other WordPress sites I host went over in literally 5 minutes or less, including the initial download of files from the old server. A few quick changes to the config file with new database credentials and it was done.
There are a few differences in their control panel compared to what I’m used to, some good, some not as good. Some usability stuff, which I’ll probably mention to them at some point but are not that big of a deal. Having a view-all option (or user configured preference for number returned) for clients or website listings, instead of 10 per page, would be stellar. When you have 200 domain names, that’s a lot of clicking. Their control panel is home grown, and a helluva lot more usable than many I’ve seen (SO much more user-friendly than cpanel or webmin), but it could use a little tweaking. Still one of the best I’ve seen, and I’ve seen a lot.
When you create an account in Mosso’s control panel, it automagically creates a top-level testing domain, which is a huge help. For example, immediately after I created the snipe.net domain in the Mosso control panel, the control panel gave me link to my testing url. Since it’s a sub-domain of one of theirs, it won’t break any “/” links or image paths you might have in the page, and you can kick the tires thoroughly before you pull the DNS trigger and switch things over.
They didn’t have an email migration script when I signed up, but one of their techs took it upon himself to write one. It’s in testing now. I have several email accounts with over 100k messages, and although I use imap, if there is an easier way than spending the next two weeks downloading my imap map and copying it over to the new imap account, I’d be really thrilled with that. And it looks like there is. So yay.
It’s early to tell yet, but I like what I’ve seen so far. Their support has been quick to respond and very helpful. Server speeds seem just fine, email is working as expected. Really, I don’t have any complaints. Of course, the paranoid side of me will keep my old server in colo for another month or two, just for the peace of mind that I can switch DNS back if I need to, but I’m not expecting to have to do that anytime soon.
If you’re interested in giving Mosso a shot, they offer a 30 day risk-free trial (money back guarantee) – and if you use the promotional code REF-SNIPE, you’ll get a $25 rebate/refund on your first month’s bill. If you’re still not sure or you have more questions, follow @mosso on twitter. They’re very responsive, and often quite funny.
While talking to them on Twitter before I signed on, I told @mosso, “You guys are like the Obama of website hosting. I’m excited about the possibilities but praying you don’t dick me over.”
So far, so good – for both 😀
