Wordpress - Revision history

Maltfield: /* MelaPress Login Security */

2025-02-15T22:48:02Z

MelaPress Login Security

← Older revision		Revision as of 22:48, 15 February 2025
Line 49:		Line 49:
	==MelaPress Login Security==		==MelaPress Login Security==

	~~This~~ plugin ~~is used~~ for two purposes		We use the [https://wordpress.org/plugins/melapress-login-security/ MelaPress Login Security plugin] for two purposes:

	# Enforce password min length		# Enforce password min length

Maltfield: removed two security plugins that no longer exist, and were replaced with melapress-login-security

2025-02-15T22:46:34Z

removed two security plugins that no longer exist, and were replaced with melapress-login-security

← Older revision		Revision as of 22:46, 15 February 2025
Line 15:		Line 15:
	# [[#2FA\|Google Authenticator]]		# [[#2FA\|Google Authenticator]]
	# [[#2FA\|Google Authenticator – Encourage User Activation]]		# [[#2FA\|Google Authenticator – Encourage User Activation]]
	# [[#~~Force Strong Passwords~~\|~~Force Strong Passwords]]~~		# [[#MelaPress Login Security\|MelaPress Login Security]]
	~~# [[#Rename wp-login.php\|Rename wp-login.php~~]]
	# [[#Varnish Caching\|Varnish Caching]]		# [[#Varnish Caching\|Varnish Caching]]
	# [[#SSL Insecure Content Fixer\|SSL Insecure Content Fixer]]		# [[#SSL Insecure Content Fixer\|SSL Insecure Content Fixer]]
Line 48:		Line 47:
	For more information, see [[2FA]]		For more information, see [[2FA]]

	==~~Force Strong Passwords~~==		==MelaPress Login Security==

	The wp core software includes a Javascript-powered password strength indicator (based on the [https://github.com/dropbox/zxcvbn zxcvbn Password Strength Estimator by Dropbox] [https://wordpress.org/news/2013/09/wordpress-3-7-beta-1/ since v3.7]), but it does not have a way to enforce passwords to meet the recommended strength.		This plugin is used for two purposes

	~~We use~~ the ~~[https://wordpress.org/plugins/force-strong~~-passwords/ "Force Strong Passwords plugin by Jason Cosper] plugin, which simply leverages the already-built-in zxcvbn Password Strength Estimator, and makes it actually _require_ strong passwords when users (with publish_posts, upload_files and/or edit_published_posts) attempt to create or update their password.		# Enforce password min length
			# Change the login page from wp-login.php

	~~==Rename~~ wp-login.php==		We were detecting dozens of brute-force attacks per day (attackers attempting to login to our site by repeatedly trying common username & password combinations). OSSEC's Active Response (our Host-based Intrusion Detection System) would actively ban these ip addresses & send an alert email. To cut the attack off sooner (and reduce alert email volumes without us ignoring targeted brute-force attacks), this plugin allows us to simply respond with "403 forbidden" (or drop the requests entirely--if the web server supports it) to all requests for 'wp-login.php'.

	~~We use the~~ wordpress plugin [https://~~wordpress~~.~~org~~/plugins/~~rename~~-wp-~~login~~/ ~~"Rename wp-login~~.~~php" by Ella Iseulde Van Dorpe]~~. ~~This is~~ a ~~simple plugin that allows us~~ to ~~change~~ the ~~URL used for logins~~. ~~This~~ is ~~an important mitigation to brute force attacks~~.		Note that there are many "wordpress security suite" plugins that include this feature. This plugin was selected because it's smaller & more lightweight<ref>https://wphive.com/plugins/melapress-login-security/</ref>. The bigger plugins make more sense to implement only if you're on a shared server. In our case, we have a dedicated server with root access, and it therefore makes more sense to implement our security walls at the Apache or OS-level (they're more powerful, flexible, and cut off an attacker earlier). Therefore, a simpler wordpress plugin without the unnecessary features (and runtime overhead) is better.

	~~We were detecting dozens of brute-force attacks per day (attackers attempting to login to our site by repeatedly trying common username & password combinations). OSSEC~~'s ~~Active Response (our Host-based Intrusion Detection System) would actively ban these ip addresses & send an alert email. To cut~~ the ~~attack off sooner (and reduce alert email volumes without us ignoring targeted brute-force attacks),~~ this plugin ~~allows us to simply respond with "403 forbidden" (or drop the requests entirely--if~~ the ~~web server supports it) to all requests for 'wp-login.php'.~~		Here's the steps to configure this plugin from the WUI

	~~Note~~ that ~~there are many~~ "~~wordpress~~ security ~~suite~~" ~~plugins~~ that ~~include this feature~~. ~~This plugin was selected because it's smaller & more lightweight~~. ~~The bigger plugins make more sense to implement only if you're on a shared server~~. ~~In our case~~, ~~we have~~ a ~~dedicated server with root access~~, ~~and~~ it ~~therefore makes more sense~~ to ~~implement our security walls at~~ the ~~Apache or OS~~-~~level (they're more powerful~~, ~~flexible, and cut off an attacker earlier). Therefore, a simpler wordpress plugin without~~ the ~~unnecessary features (and runtime overhead) is better.~~		# "Login Security" -> "Login Security Policies" -> tick the box that said "enable login security policies"
			# "Login Security" -> "Login Security Policies" -> tick the box that said "Activate password policies"
			# "Login Security" -> "Login Security Policies" -> change "Passwords must be X characters minimum" to "20"
			# "Login Security" -> "Login Security Policies" -> uncheck "Password must contain at least one uppercase and one lowercase character. "
			# "Login Security" -> "Login Security Policies" -> uncheck "Password must contain at least one numeric character (0-9)."
			# "Login Security" -> "Login Security Policies" -> uncheck "Password must contain at least one special character, i.e., a character that is not a letter or a umber, such as ( , ? € ! @ # * etc"
			# "Login Security" -> "Login Security Policies" -> check "Reset password on first login "
			# "Login Security" -> "Login Security Policies" -> check "Do not send password reset links "
			# "Login Security" -> "Login Security Policies" -> check "Activate failed login policies "
			# "Login Security" -> "Login Security Policies" -> change "When a user is locked" from "it can be only unlocked by the administrator" to "unlock it after 60 minutes"
			# "Login Security" -> "Login Security Policies" -> uncheck "Require blocked users to reset password on unblock. "
			# Click the "Save Changes" button
			# "Login Security" -> "Login page hardening" -> in the input form next to "Login page URL", I enter "ose-hidden-login"
			# Click the "Save Changes" button

	==Varnish Caching==		==Varnish Caching==
Line 1,191:		Line 1,204:
	*[[Installing Wordpress Plugins]]		*[[Installing Wordpress Plugins]]
	*[[Wordpress Log]]		*[[Wordpress Log]]
			*[https://wphive.com/plugins/melapress-login-security/] Benchmark reports for wordpress plugins

Maltfield: /* Proper File/Directory Ownership & Permissions */

2024-09-29T02:16:21Z

Proper File/Directory Ownership & Permissions

← Older revision		Revision as of 02:16, 29 September 2024
Line 200:		Line 200:

	# Files containing passwords (ie: wp-config.php) should be located outside the wp docroot <ref>https://wordpress.stackexchange.com/questions/58391/is-moving-wp-config-outside-the-web-root-really-beneficial</ref> with not-apache:apache-admins 0040		# Files containing passwords (ie: wp-config.php) should be located outside the wp docroot <ref>https://wordpress.stackexchange.com/questions/58391/is-moving-wp-config-outside-the-web-root-really-beneficial</ref> with not-apache:apache-admins 0040
	# Files in the wp-content/uploads/ dir should be apache:~~apache~~ 0660		# Files in the wp-content/uploads/ dir should be apache:www-data 0660
	# Directories in the wp-content/uploads/ dir should be apache:~~apache~~ 0770		# Directories in the wp-content/uploads/ dir should be apache:www-data 0770
	# All other files in the vhost dir should be not-apache:~~apache~~ 0040		# All other files in the vhost dir should be not-apache:www-data 0040
	# All other directories in the vhost dir should be not-apache:~~apache~~ 0050		# All other directories in the vhost dir should be not-apache:www-data 0050

	This is achievable with the following idempotent commands:		This is achievable with the following idempotent commands:

Maltfield: update permissions commands for debian (instead of CentOS) for hetzner3 migration

2024-09-29T02:15:36Z

update permissions commands for debian (instead of CentOS) for hetzner3 migration

← Older revision		Revision as of 02:15, 29 September 2024
Line 208:		Line 208:

	<pre>		<pre>
	~~vhostDir~~="/var/www/html/~~www.opensourceecology.org"~~		wordpress_sites="$(find /var/www/html -type d -wholename *htdocs/wp-content)"
	~~wpDocroot="${vhostDir}/htdocs~~"

	~~# verify~~		for wordpress_site in $wordpress_sites; do
	~~echo "~~$~~{wpDocroot}"~~
	~~ls -lah "${wpDocroot}"~~

	~~chown -R not-apache:apache~~ "${~~vhostDir~~}"		wp_docroot="$(dirname "${wordpress_site}")"
	~~find~~ "$~~{vhostDir}~~" ~~-type d -exec chmod 0050~~ {} \;		vhost_dir="$(dirname "${wp_docroot}")"
	~~find~~ "~~${vhostDir}~~" ~~-type f -exec chmod 0040 {} \;~~

	chown not-apache:~~apache~~-~~admins~~ "${~~vhostDir~~}~~/wp-config.php~~"		chown -R not-apache:www-data "${vhost_dir}"
	chmod ~~0040~~ "${~~vhostDir~~}~~/wp~~-~~config.php"~~		find "${vhost_dir}" -type d -exec chmod 0050 {} \;
			find "${vhost_dir}" -type f -exec chmod 0040 {} \;

	[ -d "${~~wpDocroot~~}/wp-content/uploads" ] \|\| mkdir "${~~wpDocroot~~}/wp-content/uploads"		chown not-apache:apache-admins "${vhost_dir}/wp-config.php"
	chown -R apache:~~apache~~ "${~~wpDocroot~~}/wp-content/uploads"		chmod 0040 "${vhost_dir}/wp-config.php"
	find "${~~wpDocroot~~}/wp-content/uploads" -type f -exec chmod 0660 {} \;
	find "${~~wpDocroot~~}/wp-content/uploads" -type d -exec chmod 0770 {} \;		[ -d "${wp_docroot}/wp-content/uploads" ] \|\| mkdir "${wp_docroot}/wp-content/uploads"
			chown -R not-apache:www-data "${wp_docroot}/wp-content/uploads"
			find "${wp_docroot}/wp-content/uploads" -type f -exec chmod 0660 {} \;
			find "${wp_docroot}/wp-content/uploads" -type d -exec chmod 0770 {} \;

			[ -d "${wp_docroot}/wp-content/tmp" ] \|\| mkdir "${wp_docroot}/wp-content/tmp"
			chown -R not-apache:www-data "${wp_docroot}/wp-content/tmp"
			find "${wp_docroot}/wp-content/tmp" -type f -exec chmod 0660 {} \;
			find "${wp_docroot}/wp-content/tmp" -type d -exec chmod 0770 {} \;

			done
	</pre>		</pre>

Line 231:		Line 238:

	# the 'not-apache' user is a new user that doesn't run any software (ie: a daemon such as a web server) and whose shell is "/sbin/nologin" and home is "/dev/null".		# the 'not-apache' user is a new user that doesn't run any software (ie: a daemon such as a web server) and whose shell is "/sbin/nologin" and home is "/dev/null".
	# the ~~apache~~ user is in the apache-admins group		# the www-data user is in the apache-admins group
	# the ~~apache~~ user is in the ~~apache~~ group		# the www-data user is in the www-data group
	# any human users that need read-only access to the wordpress vhost files for debugging purposes and/or write access to the wp-content/uploads directory (ie: to upload large files that are too large to be handled by the web servers chain), then that user should be added to the 'apache' group		# any human users that need read-only access to the wordpress vhost files for debugging purposes and/or write access to the wp-content/uploads directory (ie: to upload large files that are too large to be handled by the web servers chain), then that user should be added to the 'apache' group
	# any human users that need read-only access to the wordpress vhost files, including config files containing passwords (ie: wp-config.php), should be added to the 'apache-admins' group		# any human users that need read-only access to the wordpress vhost files, including config files containing passwords (ie: wp-config.php), should be added to the 'apache-admins' group

Maltfield: /* WP-CLI */

2024-09-28T03:39:36Z

WP-CLI

← Older revision		Revision as of 03:39, 28 September 2024
Line 354:		Line 354:
	<pre>		<pre>
	adduser wp --disabled-password --gecos ''		adduser wp --disabled-password --gecos ''
	gpasswd -a wp ~~apache~~		gpasswd -a wp www-data
	gpasswd -a wp apache-admins		gpasswd -a wp apache-admins
	su - wp		su - wp

Maltfield: /* WP-CLI */

2024-09-28T03:39:14Z

WP-CLI

← Older revision		Revision as of 03:39, 28 September 2024
Line 353:		Line 353:

	<pre>		<pre>
	~~useradd~~ wp		adduser wp --disabled-password --gecos ''
	gpasswd -a wp apache		gpasswd -a wp apache
	gpasswd -a wp apache-admins		gpasswd -a wp apache-admins

Maltfield: /* WP-CLI */

2024-09-28T03:36:30Z

WP-CLI

← Older revision		Revision as of 03:36, 28 September 2024
Line 359:		Line 359:
	mkdir -p $HOME/.wp-cli		mkdir -p $HOME/.wp-cli
	cd $HOME/.wp-cli		cd $HOME/.wp-cli
			curl -O https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar.asc
	curl -O https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar		curl -O https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar

			# check signature
			# !! WARNING: DO NOT PROCEED IF THE SIGNATURE IS NOT "GOOD" !!
			gpg --verify wp-cli.phar.asc

	mkdir -p $HOME/bin		mkdir -p $HOME/bin
	ln -s $HOME/.wp-cli/wp-cli.phar $HOME/bin/wp		ln -s $HOME/.wp-cli/wp-cli.phar $HOME/bin/wp

Maltfield: fix syntax error casuing running italic text

2024-09-10T22:25:02Z

fix syntax error casuing running italic text

← Older revision		Revision as of 22:25, 10 September 2024
Line 176:		Line 176:

	==WP_HTTP_BLOCK_EXTERNAL==		==WP_HTTP_BLOCK_EXTERNAL==
	At a firewall level, we block the webservers from making external requests to the Internet (by uid in iptables). This effectively cuts the legs off of many malicious software. A web <em>server<em> should <em>serve</em> requests, not make them.		At a firewall level, we block the webservers from making external requests to the Internet (by uid in iptables). This effectively cuts the legs off of many malicious software. A web <em>server</em> should <em>serve</em> requests, not make them.

	Consequently, wordpress sits & spins on-login when failing to "call home." Adding this option speeds-up logins.		Consequently, wordpress sits & spins on-login when failing to "call home." Adding this option speeds-up logins.

Marcin: /* Links */

2019-10-15T18:43:19Z

Links

← Older revision		Revision as of 18:43, 15 October 2019
Line 1,175:		Line 1,175:

	=Links=		=Links=
			*[[Wordpress Instructions]] - for posting events.
	*[[Installing Wordpress Plugins]]		*[[Installing Wordpress Plugins]]
	*[[Wordpress Log]]		*[[Wordpress Log]]

Marcin: /* About */

2019-09-10T18:17:10Z

About

← Older revision		Revision as of 18:17, 10 September 2019
Line 250:		Line 250:
	==About==		==About==

	~~OSE is currently using~~ WordPress 4.9.4 running Enigmatic theme.		*Current Update -
			*Last Update - WordPress 4.9.4 running Enigmatic theme.

	First of all, it is not uncommon for an attempt to update wordpress to result in an entirely broken site. If you do not have linux and bash literacy, do not attempt to update wordpress. Moreover, you should be well-versed in how to work with mysqldump, tar, rsync, chmod, chown, & sudo. If you are not confident in how all of these commands work, do not proceed. Hire someone with sysops experience to follow this guide; it should take them less than a couple hours to update and/or revert if the update fails.		First of all, it is not uncommon for an attempt to update wordpress to result in an entirely broken site. If you do not have linux and bash literacy, do not attempt to update wordpress. Moreover, you should be well-versed in how to work with mysqldump, tar, rsync, chmod, chown, & sudo. If you are not confident in how all of these commands work, do not proceed. Hire someone with sysops experience to follow this guide; it should take them less than a couple hours to update and/or revert if the update fails.