On the morning of July 20, we discovered that several of our hosted Connect IN sites had been affected by a recently disclosed security vulnerability in WordPress.

This vulnerability allowed outside attackers to gain administrative access without first knowing a valid username or password. They used that access to create unauthorized administrator accounts and install fake plugins. These plugins could allow someone to run commands on the web server and make additional changes to the affected sites.

After identifying the affected WordPress sites, we took the following steps:

• Identified the IP addresses associated with the malicious plugins in the server’s access logs and banned them from accessing the server.
• Removed the fake plugins from the active plugin folders.
• Deleted the unauthorized administrator accounts created by the attackers.
• Invalidated existing WordPress login sessions.
• Force-updated all hosted WordPress sites to version 7.0.2, which contains the security fix.
• Verified the WordPress core files and reviewed the sites for additional signs of unauthorized changes.

This incident is an important reminder that website security issues can affect more than the appearance of a site. A vulnerability may allow someone to create accounts, install files, or make changes behind the scenes without immediately disrupting the public website. Promptly installing security updates and monitoring for unusual activity help reduce that risk.

Because all hosted Connect IN sites were updated as part of this response, some sites may experience unexpected issues with older themes or plugins. If you notice anything that is not working correctly on your WordPress site, please submit a Helpdesk ticket and we’d be happy to investigate further.

Connect IN Technical Support

In order to maintain a secure environment, Connect IN must upgrade its servers before the current OS loses security update support.  Upgrading the OS will also require an upgrade from PHP 7.4 to PHP 8.1, which could break some sites/plugins.

If you are noticing any issues with your site, please submit a Connect IN Helpdesk ticket, and we will investigate and determine what might no longer be compatible with this newer version of PHP.  PHP 8.1 has been around for some time now, and any themes or plugins not supporting it will be considered a security risk.

Thank you,
Indiana State Library Connect IN Support

The Connect IN Mail service provides free email addresses to any public library in Indiana that requests it.  As a free service, we must limit the storage space used by each email address, as the Connect IN project shares server space with several other Indiana State Library projects.

Thus, we currently limit the storage allotment, or quota, for each email address to 10 GB.  Increasing this limit would also increase the limit available to all Connect IN email addresses.  Because of this, we do not recommend using Connect IN Mail for any kind of document or file storage.  We recommend saving large attachments separately and removing any emails that have them.  This includes emails with large attachments that may be kept in the Sent folder.  When a mail account reaches 95% of this quota, a weekly reminder will be sent to reduce usage.  Exceeding the quota will result in bouncing messages after 5 days.

If a library requires a Connect IN Mail account to have more than 10 GB of storage, the Connect IN Mail address can be affiliated with another service, such as a Gmail account, but we recommend having someone familiar with this process perform this task, as the training required to use this goes beyond the scope of the Connect IN program.

The Connect IN program maintains being a free service by using already existing resources of the Indiana State Library.  By design, it includes specific limitations to remain a free service.  In doing so, Connect IN provides public libraries with limited resources access to Web and Mail service with their own domain that they otherwise would not have.

At 5pm on Sunday, Dec 29, 2019, the Indiana State Library will be performing Server Maintenance, during which both the Connect IN Web and Mail servers will be down for several hours.

Please direct any questions pertaining to this to ConnectIN@library.in.gov.

The Indiana State Library has received several inquiries concerning site statistics on Connect IN sites.  Since self-hosted WordPress sites (such as those used by Connect IN) do not automatically track site statistics, each library will need to implement their own preferred method in order to do so.

Currently, the Indiana State Library recommends using the Jetpack plugin by Automattic, which is also the parent company of WordPress.com.  In order to use Jetpack effectively, the library will also need to connect their plugin to a WordPress.com account.

Any library needing assistance in doing this can contact the Connect IN Helpdesk.

Those who have upgraded to WordPress 5 may have noticed a radical change to its editor.  The new editor, known as “Gutenberg,” allows for a more modern site design using a new design technique called “blocks.”  More information on Gutenberg can be found on its WordPress reference site.

Unfortunately, having a new editor does require additional training, and tutorials will need time to catch up.  In the meantime, WordPress has established the Classic Editor plugin, which we recommend to all WordPress users until they have the opportunity to learn Gutenberg.

Adding the Classic Editor can be done via the Plugins section, using the “Add New” button, searching for “Classic Editor,” clicking the “Install Now” button, and finally clicking the “Activate” button.

With the recent push towards secure web browsing, all Connect IN sites will now be served over HTTPS.  Previously, HTTPS had been reserved either for user logins or for libraries who had already chosen to switch.  As concerns grow over sites’ authenticity, Connect IN is proactively taking this step towards a more secure experience.

At this time, HTTPS has already been enabled for all Connect IN sites.  Due to this, it is possible that some sites might need some touch ups if there are specific HTTP-sourced images, linked CSS or javascript, or other tags.  In most cases, this only requires changing the http in the source URL to https.  In addition, some browsers—such as Microsoft Edge—may even go so far as to say an HTTPS connection is not secure if some of the images use an HTTP source.

Any inquiries on how to make these changes can be sent to the Connect IN Heldpesk.

Thank you for helping us maintain secure browsing for our patrons.

Corresponding the with Evergreen Indiana data center transition, Connect IN servers will be taken offline on Sunday, March 18, at approximately 9am and will not be available again until later that afternoon.

In Dec 2016, we added required password rules for new Connect IN Email accounts and password resets.  At that time, however, we did not force users to change their existing passwords.

As part of a Security Audit of Connect IN services, we now ask that those who have not changed their Connect IN Email password since before Dec 2016 to please do so before February 1, 2018.

Any Connect IN Email accounts with passwords that have not been changed since before Dec 2016 will lose access on Feb 1, 2018, requiring your Email Administrator to change the password in order to regain access.

To change your Connect IN Email password, please visit the following site:

https://connect.lib.in.us/mail/admin/users

Thank you for your assistance in keeping Connect IN secure.

Given that Connect IN is run on free software, some additional steps are needed for certain password resets.  We ask that libraries using Connect IN keep the following in mind.

Password resets for a Connect IN Email address are to be handled by the appropriate Library’s designated contact for Connect IN, via the Connect IN Email Administration console.  In the event that the designated contact cannot access the Administration console, new passwords to the console will only be provided over the phone after a verification process.

Password resets for the Connect IN Web service are initially only allowed to be sent to existing Connect IN Email addresses.  In order to allow other email addresses to receive password reset requests, a plugin (such as WP Mail SMTP) must be installed and configured with an existing email account.