CHG-2017-09-25 migrate obi to hetzner2 - Revision history

Maltfield: Maltfield moved page CHG-2017-09-25 to CHG-2017-09-25 migrate obi to hetzner2

2020-04-23T12:48:16Z

Maltfield moved page CHG-2017-09-25 to CHG-2017-09-25 migrate obi to hetzner2

← Older revision	Revision as of 12:48, 23 April 2020
(No difference)

Maltfield at 20:29, 3 October 2017

2017-10-03T20:29:30Z

← Older revision		Revision as of 20:29, 3 October 2017
Line 1:		Line 1:
	=Status=		=Status=

			==2017-10-02 21:15 UTC==
			Catarina confirmed that changing a few links from 'http' to 'https' fixed all known issues, confirmed that the change was successful, and that the content freeze can be lifted.

	==2017-09-25 23:00 UTC==		==2017-09-25 23:00 UTC==

Maltfield at 20:31, 30 September 2017

2017-09-30T20:31:00Z

← Older revision		Revision as of 20:31, 30 September 2017
Line 364:		Line 364:

	</pre>		</pre>

			[[Category: CHGs]]

Maltfield: /* Apply to Production */

2017-09-25T23:06:45Z

Apply to Production

← Older revision		Revision as of 23:06, 25 September 2017
Line 173:		Line 173:
	ServerName openbuildinginstitute.org		ServerName openbuildinginstitute.org
	ServerAlias www.openbuildinginstitute.org		ServerAlias www.openbuildinginstitute.org
	Redirect / https://openbuildinginstitute.org/		Redirect permanent / https://openbuildinginstitute.org/
	</VirtualHost>		</VirtualHost>

Maltfield: /* Apply to Production */

2017-09-25T23:05:51Z

Apply to Production

← Older revision		Revision as of 23:05, 25 September 2017
Line 169:		Line 169:
	# change vhost file to change to https		# change vhost file to change to https
	mv /etc/httpd/conf.d/obi.conf /etc/httpd/conf.d/obi.conf.$stamp.bak		mv /etc/httpd/conf.d/obi.conf /etc/httpd/conf.d/obi.conf.$stamp.bak
	cat << EOF > /etc/httpd/conf.d/openbuildinginstitute.org.conf		cat << EOF > /etc/httpd/conf.d/00-openbuildinginstitute.org.conf
	<VirtualHost 138.201.84.223:80>		<VirtualHost 138.201.84.223:80>
	ServerName ~~www.~~openbuildinginstitute.org		ServerName openbuildinginstitute.org
	ServerAlias openbuildinginstitute.org		ServerAlias www.openbuildinginstitute.org
	Redirect / https://~~www.www.~~openbuildinginstitute.org/		Redirect / https://openbuildinginstitute.org/
	</VirtualHost>		</VirtualHost>

	Listen ~~138~~.~~201.84.223~~:443		Listen openbuildinginstitute.org:443
	<VirtualHost ~~138~~.~~201.84.223~~:443>		<VirtualHost openbuildinginstitute.org:443>
	ServerName ~~www.~~openbuildinginstitute.org		ServerName openbuildinginstitute.org
	ServerAlias openbuildinginstitute.org		ServerAlias www.openbuildinginstitute.org
	DocumentRoot "/var/www/html/openbuildinginstitute.org/htdocs"		DocumentRoot "/var/www/html/openbuildinginstitute.org/htdocs"

			Include /etc/httpd/conf.d/ssl.openbuildinginstitute.org

	# disable mod_security with rules as needed		# disable mod_security with rules as needed
Line 216:		Line 218:

	</Directory>		</Directory>

	~~EOF~~

	#<LocationMatch .*wp-login.php>		#<LocationMatch .*wp-login.php>

Maltfield: /* Status */

2017-09-25T23:04:24Z

Status

← Older revision		Revision as of 23:04, 25 September 2017
Line 1:		Line 1:
	=Status=		=Status=

			==2017-09-25 23:00 UTC==
			Change completed successfully. There's a few issues with mixed content warning (and refusals to load) from browsers. Catarina confirmed that she will look into them in the morning. A content freeze (for non-trivial content) will remain in effect until Monday Oct 2nd.

			==2017-09-25 21:25 UTC==
			Change started after green-light from Catarina.

	==2017-09-25 19:41 UTC==		==2017-09-25 19:41 UTC==

Maltfield: /* Apply to Production */

2017-09-25T21:45:16Z

Apply to Production

← Older revision		Revision as of 21:45, 25 September 2017
Line 78:		Line 78:

	# verify the first 2 (non-comment) occurances of $dbName meet the naming convention of "<siteName>_db"		# verify the first 2 (non-comment) occurances of $dbName meet the naming convention of "<siteName>_db"
			cp $dbName.$stamp.sql $dbName.$stamp.sql.bak
	vim $dbName.$stamp.sql		vim $dbName.$stamp.sql

Maltfield: /* Apply to Production */

2017-09-25T21:44:15Z

Apply to Production

← Older revision		Revision as of 21:44, 25 September 2017
Line 163:		Line 163:
	mv /etc/httpd/conf.d/obi.conf /etc/httpd/conf.d/obi.conf.$stamp.bak		mv /etc/httpd/conf.d/obi.conf /etc/httpd/conf.d/obi.conf.$stamp.bak
	cat << EOF > /etc/httpd/conf.d/openbuildinginstitute.org.conf		cat << EOF > /etc/httpd/conf.d/openbuildinginstitute.org.conf
			<VirtualHost 138.201.84.223:80>
			ServerName www.openbuildinginstitute.org
			ServerAlias openbuildinginstitute.org
			Redirect / https://www.www.openbuildinginstitute.org/
			</VirtualHost>

	Listen 138.201.84.223:443		Listen 138.201.84.223:443
	<VirtualHost 138.201.84.223:443>		<VirtualHost 138.201.84.223:443>

Maltfield at 20:38, 25 September 2017

2017-09-25T20:38:37Z

@@ Line 168: / Line 168: @@
          ServerAlias openbuildinginstitute.org
          DocumentRoot "/var/www/html/openbuildinginstitute.org/htdocs"
 </VirtualHost>
-<Directory "/var/www/html/obi/htdocs">
+<Directory "/var/www/html/openbuildinginstitute.org/htdocs">
          Options -Indexes -Includes
          AllowOverride All
@@ Line 184: / Line 203: @@
 </Directory>
 EOF

Maltfield at 20:30, 25 September 2017

2017-09-25T20:30:44Z

← Older revision		Revision as of 20:30, 25 September 2017
Line 20:		Line 20:
	# install & activate plugin 'rename-wp-login' to obfuscate the wordpress login page (reduces server load & alert emails from HIDS blocking brute force attempts)		# install & activate plugin 'rename-wp-login' to obfuscate the wordpress login page (reduces server load & alert emails from HIDS blocking brute force attempts)
	# updates the vhost config to block all access to ".*wp-login.php"		# updates the vhost config to block all access to ".*wp-login.php"
			# enable https

	=Points of Contact=		=Points of Contact=
Line 34:		Line 35:
	# set variables #		# set variables #
	#################		#################
	vhostDir=/var/www/html/~~obi~~		vhostDir=/var/www/html/openbuildinginstitute.org
	dbName=obi_db		dbName=obi_db
	dbUser=obi_db_user		dbUser=obi_db_user
Line 42:		Line 43:
	stamp=`date +%Y%m%d_%T`		stamp=`date +%Y%m%d_%T`

	vhostDirMovedTo="~~${vhostDir}~~.${stamp}.bak"		vhostDirMovedTo="/var/www/html/obi.${stamp}.bak"

	################		################
Line 70:		Line 71:

	# files backup		# files backup
	rsync -av --progress "~~${vhostDir}~~" "vhostDir.${stamp}.bak/"		rsync -av --progress "/var/www/html/obi" "vhostDir.${stamp}.bak/"

	#############		#############
Line 93:		Line 94:
	################		################

	mv "~~${vhostDir}~~" "${vhostDirMovedTo}"		mv "/var/www/html/obi" "${vhostDirMovedTo}"
	mkdir -p "${vhostDir}/htdocs"		mkdir -p "${vhostDir}/htdocs"
	pushd "${vhostDir}/htdocs"		pushd "${vhostDir}/htdocs"
Line 158:		Line 159:

	# add deny for 'wp-login.php' _inside_ the VirtualHosts block of the vhost config file		# add deny for 'wp-login.php' _inside_ the VirtualHosts block of the vhost config file
			# add deny for svn-related files, and a host of other sensitive dot-files. Again, put this _inside_ the VirtualHosts block
			# change vhost file to change to https
			mv /etc/httpd/conf.d/obi.conf /etc/httpd/conf.d/obi.conf.$stamp.bak
			cat << EOF > /etc/httpd/conf.d/openbuildinginstitute.org.conf
			Listen 138.201.84.223:443
			<VirtualHost 138.201.84.223:443>
			ServerName www.openbuildinginstitute.org
			ServerAlias openbuildinginstitute.org
			DocumentRoot "/var/www/html/openbuildinginstitute.org/htdocs"
			</VirtualHost>

			<Directory "/var/www/html/obi/htdocs">
			Options -Indexes -Includes
			AllowOverride All
			Require all granted

			Order allow,deny
			Allow from all

			# Harden vhost docroot by blocking all request types except the 3 essentials
			<LimitExcept GET POST HEAD>
			deny from all
			</LimitExcept>

			</Directory>

			# disable mod_security with rules as needed (found by logs in:
			# /var/log/httpd/modsec_audit.log
			<Location "/wp-admin/">
			<IfModule security2_module>
			#SecRuleEngine Off
			SecRuleRemoveById 960015 981173 960024 960904 960015 960017 970901 950109
			</IfModule>
			</Location>

			EOF

	#<LocationMatch .*wp-login.php>		#<LocationMatch .*wp-login.php>
	# Deny From All		# Deny From All
Line 163:		Line 201:
	vim /etc/httpd/conf.d/TODO		vim /etc/httpd/conf.d/TODO

	~~# add deny for svn-related files, and a host of other sensitive dot-files. Again, put this _inside_ the VirtualHosts block~~
	#<LocationMatch .\.(svn\|git\|hg\|bzr\|cvs\|ht)/.>		#<LocationMatch .\.(svn\|git\|hg\|bzr\|cvs\|ht)/.>
	# Deny From All		# Deny From All
	#</LocationMatch>		#</LocationMatch>
			vim /etc/httpd/conf.d/TODO


	vim /etc/httpd/conf.d/TODO		vim /etc/httpd/conf.d/TODO