CHG-2025-XX-XX migrate store to hetzner3 - Revision history

Maltfield: melapress-login-security by DB (so we can harden nginx to block wp-config.php)

2025-02-16T01:09:44Z

melapress-login-security by DB (so we can harden nginx to block wp-config.php)

@@ Line 292: / Line 292: @@
 # SET PERMISSIONS
+time /usr/local/bin/fix_web_permissions.sh
 # ACTIVATE NEW PLUGINS

Maltfield: melapress-login-security by DB (so we can harden nginx to block wp-config.php)

2025-02-16T01:03:52Z

melapress-login-security by DB (so we can harden nginx to block wp-config.php)

← Older revision		Revision as of 01:03, 16 February 2025
Line 353:		Line 353:
	sudo -u wp -i wp --path="${docrootDir}" plugin activate ${plugin}		sudo -u wp -i wp --path="${docrootDir}" plugin activate ${plugin}
	done		done

			# configure melapress-login-security
			echo 'DELETE FROM wp_options WHERE option_name = "mls_options";' \| mysql -u${dbUser} -p${dbPass} ${dbName}
			echo 'DELETE FROM wp_options WHERE option_name = "mls_setting";' \| mysql -u${dbUser} -p${dbPass} ${dbName}

			cat << EOF \| mysql -u${dbUser} -p${dbPass} ${dbName}
			INSERT INTO wp_options (option_name, option_value) VALUES ('mls_options', 'a:62:{s:13:"master_switch";s:3:"yes";s:26:"activate_password_policies";s:3:"yes";s:37:"activate_password_expiration_policies";s:2:"no";s:34:"activate_password_recycle_policies";s:2:"no";s:16:"enforce_password";s:2:"no";s:10:"min_length";s:2:"20";s:16:"password_history";s:1:"1";s:16:"inherit_policies";s:2:"no";s:15:"password_expiry";a:2:{s:5:"value";s:1:"0";s:4:"unit";s:6:"months";}s:8:"ui_rules";a:7:{s:7:"history";s:2:"no";s:8:"username";s:2:"no";s:6:"length";b:1;s:7:"numeric";s:2:"no";s:8:"mix_case";s:2:"no";s:13:"special_chars";s:2:"no";s:21:"exclude_special_chars";s:2:"no";}s:5:"rules";a:6:{s:6:"length";b:1;s:7:"numeric";s:2:"no";s:10:"upper_case";s:2:"no";s:10:"lower_case";s:2:"no";s:13:"special_chars";s:2:"no";s:21:"exclude_special_chars";s:2:"no";}s:23:"change_initial_password";s:2:"no";s:12:"timed_logins";s:2:"no";s:21:"timed_logins_schedule";a:7:{s:6:"monday";a:7:{s:6:"enable";s:2:"no";s:7:"from_hr";i:0;s:8:"from_min";i:0;s:5:"to_hr";i:11;s:6:"to_min";i:59;s:13:"from_am_or_pm";s:2:"am";s:11:"to_am_or_pm";s:2:"pm";}s:7:"tuesday";a:7:{s:6:"enable";s:2:"no";s:7:"from_hr";i:0;s:8:"from_min";i:0;s:5:"to_hr";i:11;s:6:"to_min";i:59;s:13:"from_am_or_pm";s:2:"am";s:11:"to_am_or_pm";s:2:"pm";}s:9:"wednesday";a:7:{s:6:"enable";s:2:"no";s:7:"from_hr";i:0;s:8:"from_min";i:0;s:5:"to_hr";i:11;s:6:"to_min";i:59;s:13:"from_am_or_pm";s:2:"am";s:11:"to_am_or_pm";s:2:"pm";}s:8:"thursday";a:7:{s:6:"enable";s:2:"no";s:7:"from_hr";i:0;s:8:"from_min";i:0;s:5:"to_hr";i:11;s:6:"to_min";i:59;s:13:"from_am_or_pm";s:2:"am";s:11:"to_am_or_pm";s:2:"pm";}s:6:"friday";a:7:{s:6:"enable";s:2:"no";s:7:"from_hr";i:0;s:8:"from_min";i:0;s:5:"to_hr";i:11;s:6:"to_min";i:59;s:13:"from_am_or_pm";s:2:"am";s:11:"to_am_or_pm";s:2:"pm";}s:8:"saturday";a:7:{s:6:"enable";s:2:"no";s:7:"from_hr";i:0;s:8:"from_min";i:0;s:5:"to_hr";i:11;s:6:"to_min";i:59;s:13:"from_am_or_pm";s:2:"am";s:11:"to_am_or_pm";s:2:"pm";}s:6:"sunday";a:7:{s:6:"enable";s:2:"no";s:7:"from_hr";i:0;s:8:"from_min";i:0;s:5:"to_hr";i:11;s:6:"to_min";i:59;s:13:"from_am_or_pm";s:2:"am";s:11:"to_am_or_pm";s:2:"pm";}}s:22:"inactive_users_enabled";s:2:"no";s:21:"inactive_users_expiry";a:2:{s:5:"value";i:30;s:4:"unit";s:4:"days";}s:30:"inactive_users_reset_on_unlock";s:2:"no";s:29:"failed_login_policies_enabled";s:3:"yes";s:21:"failed_login_attempts";s:1:"5";s:27:"failed_login_reset_attempts";s:4:"1440";s:27:"failed_login_unlock_setting";s:5:"timed";s:24:"failed_login_reset_hours";s:2:"60";s:29:"failed_login_reset_on_unblock";s:2:"no";s:18:"disable_self_reset";s:3:"yes";s:26:"disable_self_reset_message";b:0;s:27:"deactivated_account_message";s:159:"Your WordPress user has been deactivated. Please contact the <a href="mailto:michael@michaelaltfield.net">website administrator</a> to activate back your user.";s:19:"timed_login_message";b:0;s:30:"locked_user_disable_self_reset";s:2:"no";s:38:"locked_user_disable_self_reset_message";b:0;s:17:"restrict_login_ip";s:2:"no";s:23:"restrict_login_ip_count";i:3;s:22:"restrict_login_message";s:0:"";s:22:"notify_password_expiry";s:2:"no";s:30:"notify_password_reset_on_login";b:0;s:27:"notify_password_expiry_days";i:0;s:27:"notify_password_expiry_unit";s:4:"days";s:26:"restrict_login_credentials";s:7:"default";s:34:"restrict_login_credentials_message";s:0:"";s:24:"enable_sessions_policies";b:0;s:23:"remember_session_expiry";a:2:{s:5:"value";i:14;s:4:"unit";s:4:"days";}s:22:"default_session_expiry";a:2:{s:5:"value";i:2;s:4:"unit";s:4:"days";}s:22:"enable_device_policies";b:0;s:35:"enable_device_policies_admin_alerts";s:2:"no";s:25:"enable_security_questions";b:0;s:17:"enabled_questions";a:0:{}s:36:"device_policies_prompt_email_content";s:0:"";s:41:"device_policies_admin_alert_email_content";s:0:"";s:36:"device_policies_prompt_email_subject";s:0:"";s:41:"device_policies_admin_alert_email_subject";s:0:"";s:25:"min_answered_needed_count";i:3;s:39:"password_reset_request_disabled_message";s:0:"";s:24:"password_expired_message";s:0:"";s:36:"inactive_user_account_locked_message";s:0:"";s:51:"inactive_user_account_locked_reset_disabled_message";s:0:"";s:38:"restrict_logins_prompt_failure_message";s:0:"";s:34:"timed_logins_login_blocked_message";s:0:"";s:39:"restrict_login_ip_login_blocked_message";s:0:"";s:35:"failed_logins_login_blocked_message";s:0:"";s:40:"security_prompt_response_failure_message";s:0:"";s:24:"timed_logins_auto_logout";b:0;s:13:"ppm-user-role";s:0:"";s:22:"excluded_special_chars";s:0:"";}');
			EOF

			cat << EOF \| mysql -u${dbUser} -p${dbPass} ${dbName}
			INSERT INTO wp_options (option_name, option_value) VALUES ('mls_setting', 'a:62:{s:18:"send_summary_email";s:3:"yes";s:8:"exempted";a:1:{s:5:"users";a:0:{}}s:21:"use_custom_from_email";s:13:"default_email";s:10:"from_email";s:0:"";s:17:"from_display_name";s:0:"";s:26:"terminate_session_password";s:2:"no";s:16:"stop_pw_generate";s:2:"no";s:25:"users_have_multiple_roles";s:2:"no";s:19:"multiple_role_order";a:0:{}s:13:"clear_history";s:2:"no";s:22:"excluded_special_chars";s:0:"";s:25:"password_reset_key_expiry";a:2:{s:5:"value";i:24;s:4:"unit";s:5:"hours";}s:20:"enable_wp_reset_form";s:3:"yes";s:22:"enable_wp_profile_form";s:3:"yes";s:18:"enable_wc_pw_reset";s:2:"no";s:22:"enable_wc_checkout_reg";s:2:"no";s:18:"enable_bp_register";s:2:"no";s:19:"enable_bp_pw_update";s:2:"no";s:18:"enable_ld_register";s:2:"no";s:18:"enable_um_register";s:2:"no";s:19:"enable_um_pw_update";s:2:"no";s:24:"enable_bbpress_pw_update";s:2:"no";s:20:"enable_mepr_register";s:2:"no";s:21:"enable_mepr_pw_update";s:2:"no";s:19:"enable_edd_register";s:2:"no";s:20:"enable_edd_pw_update";s:2:"no";s:19:"enable_pmp_register";s:2:"no";s:20:"enable_pmp_pw_update";s:2:"no";s:19:"enable_pmp_pw_reset";s:2:"no";s:28:"enable_profilepress_register";s:2:"no";s:29:"enable_profilepress_pw_update";s:2:"no";s:28:"enable_profilepress_pw_reset";s:2:"no";s:16:"custom_login_url";s:16:"ose-hidden-login";s:21:"custom_login_redirect";s:0:"";s:24:"enable_login_allowed_ips";b:0;s:26:"restrict_login_allowed_ips";s:0:"";s:27:"restrict_login_redirect_url";s:0:"";s:26:"restrict_login_bypass_slug";s:0:"";s:24:"send_user_unlocked_email";s:3:"yes";s:25:"send_user_unblocked_email";s:3:"yes";s:24:"send_user_pw_reset_email";s:3:"yes";s:26:"send_user_pw_expired_email";s:3:"yes";s:16:"login_geo_method";s:7:"default";s:16:"login_geo_action";s:11:"deny_to_url";s:19:"login_geo_countries";s:0:"";s:22:"login_geo_redirect_url";s:0:"";s:25:"login_geo_blocked_message";s:0:"";s:16:"iplocate_api_key";s:0:"";s:19:"gdpr_banner_message";s:0:"";s:18:"enable_gdpr_banner";b:0;s:33:"disable_user_password_reset_email";s:2:"no";s:41:"disable_user_delayed_password_reset_email";s:2:"no";s:29:"disable_user_pw_expired_email";s:2:"no";s:40:"disable_user_unlocked_reset_needed_email";s:2:"no";s:36:"disable_device_policies_prompt_email";s:2:"no";s:42:"disable_device_policies_prompt_admin_email";s:2:"no";s:27:"disable_user_imported_email";s:2:"no";s:40:"disable_user_imported_forced_reset_email";s:2:"no";s:27:"disable_user_unlocked_email";s:2:"no";s:24:"user_unlocked_email_body";s:0:"";s:25:"user_unblocked_email_body";s:0:"";s:32:"user_reset_next_login_email_body";s:0:"";}');
			EOF
	</pre>		</pre>

Line 374:		Line 386:
	# "Settings" -> "General" -> "Choose a Site Icon" -> Select "OSE-logo-blueprint-bg-v3-1blarge.jpg", cropped such that there is only a small buffer on the left & right of the text		# "Settings" -> "General" -> "Choose a Site Icon" -> Select "OSE-logo-blueprint-bg-v3-1blarge.jpg", cropped such that there is only a small buffer on the left & right of the text

	# ~~"Login Security"~~ -~~> "Login Security Policies"~~ -~~> tick the box that said "enable login~~ security ~~policies"~~		# quick confirmation of 'melapress-login-security'
	# "Login Security" -> "Login Security Policies~~" -> tick the box that said "Activate password policies~~"		# "Login Security" -> "Login Security Policies"
	# ~~"Login Security" -~~> ~~"Login Security Policies" -> change "Passwords must be X characters minimum" to "~~20"		# Make sure password polices are enabled, and >20 chars are required
	# "Login Security" -> "Login ~~Security Policies" -> uncheck "Password must contain at least one uppercase and one lowercase character.~~ "		# "Login Security" -> "Login page hardening"
	# "Login ~~Security" -> "Login Security Policies" -> uncheck "Password must contain at least one numeric character (0-9)."~~		# Make sure "Login page URL" is set to "ose-hidden-login"
	~~# "Login Security" -> "Login Security Policies" -> uncheck "Password must contain at least one special character, i.e., a character that is not a letter or a umber, such as ( , ? € ! @ # * etc"~~
	~~# "Login Security" -> "Login Security Policies" -> check "Reset password on first login "~~
	~~# "Login Security" ->~~ "~~Login Security Policies" -> check "Do not send password reset links "~~
	~~# "Login Security" -> "Login Security Policies" -> check "Activate failed login policies "~~
	~~# "Login Security" -> "Login Security Policies" -> change "When a user~~ is ~~locked" from "it can be only unlocked by the administrator"~~ to ~~"unlock it after 60 minutes"~~
	~~# "Login Security" -> "Login Security Policies" -> uncheck "Require blocked users to reset password on unblock. "~~
	~~# Click the "Save Changes" button~~
	~~# "Login Security" -> "Login page hardening" -> in the input form next to "Login page URL", I enter~~ "ose-hidden-login"
	~~# Click the "Save Changes" button~~

	# "Settings" -> "Google Authenticator" -> Check every box under "Roles requiring Google Authenticator Enabled"		# "Settings" -> "Google Authenticator" -> Check every box under "Roles requiring Google Authenticator Enabled"

Maltfield: bump version of 'woocommerce-gateway-stripe' to v9.1.1 after 3TOFU

2025-02-08T19:36:32Z

bump version of 'woocommerce-gateway-stripe' to v9.1.1 after 3TOFU

← Older revision		Revision as of 19:36, 8 February 2025
Line 67:		Line 67:
	# install plugin 'smart-slider-3' v3.5.1.25		# install plugin 'smart-slider-3' v3.5.1.25
	# install plugin 'spam-destroyer' v2.1.4		# install plugin 'spam-destroyer' v2.1.4
	# install plugin 'woocommerce-gateway-stripe' v9.0.0		# install plugin 'woocommerce-gateway-stripe' v9.1.1
	# install plugin 'woocommerce-multilingual' v5.3.9		# install plugin 'woocommerce-multilingual' v5.3.9
	# install plugin 'wordpress-seo' v24.0		# install plugin 'wordpress-seo' v24.0

Maltfield: updated plugin versions

2025-01-29T17:23:13Z

updated plugin versions

← Older revision		Revision as of 17:23, 29 January 2025
Line 75:		Line 75:
	# install plugin 'wp-pgp-encrypted-emails' v0.8.0		# install plugin 'wp-pgp-encrypted-emails' v0.8.0
	# install plugin 'wp-qrcode' v1.1.1		# install plugin 'wp-qrcode' v1.1.1

	# change theme from 'oshin' to 'twentyseventeen'		# change theme from 'oshin' to 'twentyseventeen'
	# update theme '~~storefront~~' from v6.6.4.4 to v7.2.1		# update theme 'oshin' from v6.6.4.4 to v7.2.1
	# update theme 'twentyeleven' from v3.2 to v4.7		# update theme 'storefront' from v2.4.5 to v4.6.0
	# update theme 'twentyfifteen' from v2.4 to v3.8		# update theme 'twentyeleven' from v3.2 to v4.8
	# update theme 'twentyfourteen' from v2.6 to v4.0		# update theme 'twentyfifteen' from v2.4 to v3.9
			# update theme 'twentyfourteen' from v2.6 to v4.1
	# update theme 'twentynineteen' from v1.3 to v2.9		# update theme 'twentynineteen' from v1.3 to v2.9
	# update theme 'twentyseventeen' from v2.1 to v3.7		# update theme 'twentyseventeen' from v2.1 to v3.8
	# update theme 'twentysixteen' from v1.9 to v3.3		# update theme 'twentysixteen' from v1.9 to v3.4
	# update theme 'twentyten' from v2.8 to v4.2		# update theme 'twentyten' from v2.8 to v4.3
	# update theme 'twentythirteen' from v2.8 to v4.2		# update theme 'twentythirteen' from v2.8 to v4.3
	# update theme 'twentytwelve' from v2.9 to v4.3		# update theme 'twentytwelve' from v2.9 to v4.4

	~~TODO: add new plugins & versions~~

	==Points of Contact==		==Points of Contact==

Maltfield: update plugin versions

2025-01-29T17:16:19Z

update plugin versions

← Older revision		Revision as of 17:16, 29 January 2025
Line 29:		Line 29:
	# eliminates subversion from the docroot (which has security issues because the releases are not signed and lacks 3TOFU)		# eliminates subversion from the docroot (which has security issues because the releases are not signed and lacks 3TOFU)
	# update plugin 'akismet' from v4.1.1 to v5.3.3		# update plugin 'akismet' from v4.1.1 to v5.3.3
	# ~~uninstall~~ plugin 'be-gdpr'		# update plugin 'be-gdpr' from v1.0.0 to v1.1.6
	# uninstall plugin 'be-portfolio-post'		# uninstall plugin 'be-portfolio-post'
	# update plugin 'classic-editor' from v1.4 to v1.6.5		# update plugin 'classic-editor' from v1.4 to v1.6.5
Line 37:		Line 37:
	# update plugin 'google-authenticator' from v0.48 to 0.54		# update plugin 'google-authenticator' from v0.48 to 0.54
	# uninstall plugin 'masterslider'		# uninstall plugin 'masterslider'
	# update plugin 'meta-box' from v4.17.3 to v5.10.2		# update plugin 'meta-box' from v4.17.3 to v5.10.5
	# ~~uninstall~~ plugin 'meta-box-conditional-logic'		# update plugin 'meta-box-conditional-logic' from v1.3 to v1.6.23
	# ~~uninstall~~ plugin 'meta-box-show-hide'		# update plugin 'meta-box-show-hide' from v1.0.2 to v1.3.1
	# ~~uninstall~~ plugin 'meta-box-tabs'		# update plugin 'meta-box-tabs' from v1.0.0 to v1.1.18
	# ~~uninstall~~ plugin 'oshine-core'		# update plugin 'oshine-core' from v1.3.4 to v1.6.1
	# ~~uninstall~~ plugin 'oshine-modules'		# update plugin 'oshine-modules' from v2.2.5 to v3.3.8
	# uninstall plugin 'redux-vendor-support'		# uninstall plugin 'redux-vendor-support'
	# uninstall plugin 'rename-wp-login'		# uninstall plugin 'rename-wp-login'
	# ~~uninstall~~ plugin 'revslider'		# update plugin 'revslider' from v5.4.7.4 to 6.7.25
	# ~~uninstall~~ plugin 'tatsu'		# update plugin 'tatsu' from v2.6.8 to v3.5.3
	# uninstall plugin 'typehub'		# uninstall plugin 'typehub'
	# update plugin 'vaching' from v1.6.9 to v1.8.3		# update plugin 'vaching' from v1.6.9 to v1.8.3
	# update plugin 'woocommerce' from v3.5.7 to v9.3.3		# update plugin 'woocommerce' from v3.5.7 to v9.5.1
	# update plugin 'coingate-for-woocommerce' from v1.2.2 to v2.1.1		# update plugin 'coingate-for-woocommerce' from v1.2.2 to v2.1.1

Maltfield: since 3TOFU

2025-01-28T23:06:16Z

since 3TOFU

← Older revision		Revision as of 23:06, 28 January 2025
Line 58:		Line 58:
	# install plugin 'bulk-media-register' v1.40		# install plugin 'bulk-media-register' v1.40
	# install plugin 'enable-media-replace' v4.1.5		# install plugin 'enable-media-replace' v4.1.5
	# install plugin 'extensions-leaflet-map' v4.4		# install plugin 'extensions-leaflet-map' v4.4.3
	# install plugin 'hcaptcha-for-forms-and-more' v4.8.0		# install plugin 'hcaptcha-for-forms-and-more' v4.8.0
	# install plugin 'include-mastodon-feed' v1.9.9		# install plugin 'include-mastodon-feed' v1.9.9

Maltfield: bump wordpress version since latest 3TOFU

2025-01-28T23:05:21Z

bump wordpress version since latest 3TOFU

← Older revision		Revision as of 23:05, 28 January 2025
Line 26:		Line 26:
	# changes site from php v5.6 to v8.2		# changes site from php v5.6 to v8.2
	# changes site from using mod_php to php-fpm		# changes site from using mod_php to php-fpm
	# update core wp from v5.1.1 to v6.6.1		# update core wp from v5.1.1 to v6.7.1
	# eliminates subversion from the docroot (which has security issues because the releases are not signed and lacks 3TOFU)		# eliminates subversion from the docroot (which has security issues because the releases are not signed and lacks 3TOFU)
	# update plugin 'akismet' from v4.1.1 to v5.3.3		# update plugin 'akismet' from v4.1.1 to v5.3.3

Maltfield at 04:04, 30 December 2024

2024-12-30T04:04:40Z

← Older revision		Revision as of 04:04, 30 December 2024
Line 132:		Line 132:
	source /root/backups/backup.settings		source /root/backups/backup.settings
	stamp=`date +%Y%m%d`		stamp=`date +%Y%m%d`
	backupDir_hetzner2="/var/tmp/~~backups_for_migration_to_hetzner2~~/${vhost_name}_${stamp}"		backupDir_hetzner2="/var/tmp/backups_for_migration_to_hetzner3/${vhost_name}_${stamp}"
	backupDir_hetzner3="/var/tmp/backups_for_migration_from_hetzner2/${vhost_name}_${stamp}"		backupDir_hetzner3="/var/tmp/backups_for_migration_from_hetzner2/${vhost_name}_${stamp}"
	backupFileName_db_hetzner2="mysqldump_${vhost_name}.${stamp}.sql.bz2"		backupFileName_db_hetzner2="mysqldump_${vhost_name}.${stamp}.sql.bz2"

Maltfield: /* Change Steps */ find was missing semicolon

2024-12-26T03:56:52Z

Change Steps: find was missing semicolon

← Older revision		Revision as of 03:56, 26 December 2024
Line 209:		Line 209:

	# remove '.svn' dirs (we no longer use svn, for security)		# remove '.svn' dirs (we no longer use svn, for security)
	find ${docrootDir} -iname '.svn' -exec rm -rf '{}' \		find ${docrootDir} -iname '.svn' -exec rm -rf '{}' \;

	# add wordpress bug fix		# add wordpress bug fix

Maltfield: /* Change Steps */ missing dir broke the rsync

2024-12-26T03:52:32Z

Change Steps: missing dir broke the rsync

← Older revision		Revision as of 03:52, 26 December 2024
Line 133:		Line 133:
	stamp=`date +%Y%m%d`		stamp=`date +%Y%m%d`
	backupDir_hetzner2="/var/tmp/backups_for_migration_to_hetzner2/${vhost_name}_${stamp}"		backupDir_hetzner2="/var/tmp/backups_for_migration_to_hetzner2/${vhost_name}_${stamp}"
			backupDir_hetzner3="/var/tmp/backups_for_migration_from_hetzner2/${vhost_name}_${stamp}"
	backupFileName_db_hetzner2="mysqldump_${vhost_name}.${stamp}.sql.bz2"		backupFileName_db_hetzner2="mysqldump_${vhost_name}.${stamp}.sql.bz2"
	backupFileName_files_hetzner2="${vhost_name}_files.${stamp}.tar.gz"		backupFileName_files_hetzner2="${vhost_name}_files.${stamp}.tar.gz"