WordPress for SysAdmins

puerto:22
WORDPRESS
FOR SYSADMINS
Javier Arturo Rodríguez
@codehead
javier.rodriguez@puerto22.com

puerto:22
MYTHS AND
MISCONCEPTIONS

puerto:22
MYTHS AND
MISCONCEPTIONS
• WordPress is:
• Troublesome to install
• Hard to maintain
• Impossible to secure

puerto:22
IN FACT,
• WordPress is:
• Troublesome Trivial to install
• Hard Easy to maintain
• Hard to secure Securable

puerto:22
WP-CLI
Image: Petr Kratochvil (PD)

puerto:22
DOWNLOAD WP-CLI
$ curl -O https://raw.githubusercontent.com/
wp-cli/builds/gh-pages/phar/wp-cli.phar

puerto:22
VERIFY YOUR
CHECKSUMS!

puerto:22
VERIFY WP-CLI
$ md5sum wp-cli.phar
8c9113f5de2a892837771fdacf6f8c16 wp-cli.phar

puerto:22
---
- name: wordpress - install wp-cli
get_url: url=https://raw.githubusercontent.com/wp-cli/builds/e94cf3fd57116b84c86a2578a0c66757fa77a592/phar/wp-cli.phar
sha256sum=b4dd0b82df6ffd3ccbedcd9d2789dbc9f26fd21c86fc62b6f9f524d1775c9fd3
dest=/usr/local/bin/wp-0180
owner=root
group=root
mode=0755
Known commit
Known version Known hash

puerto:22
INSTALL WP-CLI
$ chmod +x wp-cli.phar
$ sudo mv wp-cli.phar /usr/local/bin/wp
$ wp --info
WP-CLI 0.18.0

puerto:22
INSTALL WITH WP-CLI
$ wp core download [{arguments}]
$ wp core config {arguments}
$ wp core install {arguments}

puerto:22
DOWNLOAD
wp core download
[--path=<path>]
[--locale=<locale>]
[--version=<version>]
[--force]

puerto:22
CREATE WP-CONFIG.PHP
wp core config
--dbname=<dbname>
--dbuser=<dbuser>
[--dbpass=<dbpass>]
[--dbhost=<dbhost>]
[--dbprefix=<dbprefix>]
[--dbcharset=<dbcharset>]
[--dbcollate=<dbcollate>]
[--locale=<locale>]
[--extra-php]
[--skip-salts]
[--skip-check]

puerto:22
CREATE TABLES
wp core install
--url=<url>
--title=<site-title>
--admin_user=<username>
--admin_password=<password>
--admin_email=<email>

puerto:22
https://codex.wordpress.org/Installing_WordPress#Famous_5-Minute_Install

puerto:22
WPMU DEV
https://www.youtube.com/watch?v=ell0SiTZyX8
https://codex.wordpress.org/Installing_WordPress#Famous_5-Minute_Install

puerto:22
$ time ~/wordpress-install
/home/admin/wordpress.config
Downloading WordPress 4.2 (en_US)...
Using cached file '/home/admin/.wp-cli/cache/core/en_US-4.2.tar.gz'...
Success: WordPress downloaded.
Success: Generated wp-config.php file.
Success: WordPress installed successfully.
!
real 0m2.715s
user 0m0.460s
sys0m0.232s

puerto:22
OTHER WP-CLI
COMMANDS
$ wp plugin install
$ wp theme install

puerto:22
BACKUP
$ wp export
$ wp db export

puerto:22
RESTORE
$ wp db import
$ wp import

puerto:22
MULTISITE
$ wp core multisite-convert
$ wp core multisite-install

puerto:22
LANGUAGE
$ wp core multisite-convert
$ wp core multisite-install

puerto:22
INTEGRITY CHECK
$ wp core verify-checksums

puerto:22
(FROM A SYSADMIN
PERSPECTIVE)

puerto:22
91.200.12.56 - - [22/Apr/2015:06:06:36 +0000] "POST /wp-login.php HTTP/1.1" 302 - "-" "Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.0" "-"
POST /wp-login.php HTTP/1.1

puerto:22
A BRUTE-FORCE ATTACK
IS A BRUTE-FORCE ATTACK
IS A BRUTE-FORCE ATTACK

puerto:22
Apr 21 05:40:03 myserver sshd[540]: Failed password for root from 43.255.190.187 port 40036 ssh2

puerto:22
FAIL2BAN
$ wp plugin install --activate wp-fail2ban

puerto:22
/VAR/LOG/AUTH.LOG
Apr 21 19:09:07 blog wordpress(my.wordpress.install)[9298]: Authentication failure for vubpuhttcp from 110.80.74.204
Apr 21 20:39:45 blog wordpress(my.wordpress.install)[9562]: Authentication failure for vubpglyghg from 110.80.74.204
Apr 21 21:11:31 blog wordpress(my.wordpress.install)[12395]: Authentication failure for mougcersdlcrh from 176.97.116.134
Apr 21 21:11:35 blog wordpress(my.wordpress.install)[8190]: Authentication failure for mougcersdvooi from 176.97.116.134
Apr 21 21:51:34 blog wordpress(my.wordpress.install)[12395]: Authentication failure for zeeidrwz54 from 199.168.141.171
Apr 21 22:05:35 blog wordpress(my.wordpress.install)[9562]: Authentication failure for carteykilolye from 176.97.116.134
Apr 21 22:06:36 blog wordpress(my.wordpress.install)[11573]: Authentication failure for dkbzhydsxlmnvj from 176.97.116.134
Apr 22 02:28:46 blog wordpress(my.wordpress.install)[12028]: Authentication failure for gerberktzksy from 176.97.116.134
Apr 22 02:28:47 blog wordpress(my.wordpress.install)[10641]: Authentication failure for carteykilojht from 176.97.116.134

puerto:22
/ETC/FAIL2BAN/JAIL.LOCAL
# Fail2Ban configuration file
#
# Author: Charles Lecklider
#
!
[INCLUDES]
!
before = common.conf
!
!
[Definition]
_daemon = wordpress
failregex = ^%(__prefix_line)sAuthentication failure for .* from <HOST>$
^%(__prefix_line)sBlocked authentication attempt for .* from <HOST>$
^%(__prefix_line)sBlocked user enumeration attempt from <HOST>$
!
ignoreregex =

puerto:22
/ETC/FAIL2BAN/JAIL.LOCAL
[wordpress]
enabled = true
filter = wordpress
logpath = /var/log/auth.log
port = http,https
bantime = 3600

puerto:22
TELNET?
$ telnet wordpress
Trying 173.194.65.104...
Connected to wordpress.
Escape character is '^]'.
Debian GNU/Linux 7
wordpress login:

puerto:22
SSH!
$ ssh wordpress
Host key fingerprint is
e0:84:30:20:97:36:53:f1:69:12:7a:fe:5d:32:8d:30
+--[ RSA 2048]----+
|o.+o+. |
|..=+ + . |
| ..o+ E |
| o = + o |
| . . S o |
| . . + |
| . . |
| |
| |
+-----------------+
!
javier@wordpress password:

puerto:22
http://my.wordpress.com/wp-login.php

puerto:22
$ wp plugin install --activate wordpress-https

puerto:22
https://my.wordpress.com/wp-login.php

puerto:22
TWO-FACTOR
AUTHENTICATION

puerto:22
$ wp plugin install --activate google-authenticator

puerto:22
SECURITY
IS NOT
AN ADD-ON

puerto:22
FILESYSTEM
PERMISSIONS

puerto:22
USER ACCOUNTS
Account type Administrative Web daemon
uid conﬁgmgr www-data
Permissions Read/Write Read-only

puerto:22
FILE OWNERSHIP
Directory Owner
htdocs/ conﬁgmgr
htdocs/wp-content/uploads/ www-data

puerto:22
$ chown -R configmgr.wheel htdocs/
$ chown -R www-data.www-data
htdocs/wp-content/uploads

puerto:22
NOEXEC
# Prevent malicious scripts in upload dirs
<Directory …/htdocs/wp-content/uploads>
Options -Indexes -ExecCGI
SetHandler None
RemoveHandler .php .php3 .php4 .phps
php_flag engine off
</Directory>

puerto:22
BUT THIS BREAKS
AUTO-UPDATE!

puerto:22
$ wp core update
$ wp core update-db
$ wp plugin update --all
$ wp theme update --all

puerto:22
/USR/LOCAL/BIN 
/WP-UPDATE
#!/bin/sh -
cd /var/www
wp core update
wp core update-db
wp plugin update --all
wp theme update --all

puerto:22
/ETC/CRON.D/WP
0 3 * * * configmgr /usr/local/bin/wp-update

puerto:22
SQL INJECTION
Comic: Rockin’ Randall Munroe, XKCD 327 (CC)

puerto:22
MOD_SECURITY
# apt-get install libapache2-modsecurity
# a2enmod mod-security

puerto:22
Image: GirlieMac, http://httpcats.herokuapp.com/403

puerto:22
BUT I GET FALSE
POSITIVES!

puerto:22
APACHE2.CONF
# Mod_security tweaks
<IfModule mod_security2.c>
# wp-login.php should allow redirects
<LocationMatch "^/(wp-login.php)">
SecRuleRemoveById 950901
</LocationMatch>
</IfModule>

puerto:22
APACHE2.CONF
</LocationMatch>
# Images are (mostly) harmless
<FilesMatch ".(gif|jpe?g|png)$">
SecRuleEngine Off
</FilesMatch>
</IfModule>

puerto:22
APACHE2.CONF
</LocationMatch>
# Images are (mostly) harmless
<FilesMatch ".(gif|jpe?g|png)$">
SecRuleEngine Off
</FilesMatch>
# wp-admin/ is a protected area
<LocationMatch "^/(wp-admin/)">
SecRuleEngine Off
</LocationMatch>
</IfModule>
!
# Enable Basic Auth on /wp-admin/ to discourage attacks
<Location /wp-admin/>
AuthType Basic
AuthName "Restricted Area"
AuthUserFile /etc/wpadmin.passwd
Require valid-user
</Location>

puerto:22
SPAM
Image: Der Hupe (CC)

puerto:22
Image: Der Hupe (CC)

puerto:22
$ wp plugin install --activate akismet
$ wp plugin install --activate google-captcha

puerto:22
.HTACCESS
SetEnvIfNoCase Via evil-spam-proxy spammer=yes
SetEnvIfNoCase Referer evil-spam-domain.com spammer=yes
SetEnvIfNoCase Referer evil-spam-keyword spammer=yes
SetEnvIfNoCase Via pinappleproxy spammer=yes
SetEnvIfNoCase Referer semalt.com spammer=yes
SetEnvIfNoCase Referer poker spammer=yes
...
Order allow,deny
Allow from all
Deny from env=spammer
https://wordpress.org/support/topic/how-to-block-semaltcom-from-visiting-your-wordpress-website

puerto:22
CREEPY CRAWLERS
Image: David Featherston (CC)

puerto:22
ROBOTS.TXT
User-agent: *
Crawl-delay: 30

puerto:22
MOD_QOS
# apt-get install libapache2-mod-qos
# a2enmod qos

puerto:22
<IfModule qos_module>
# minimum request rate (bytes/sec at request reading):
QS_SrvRequestRate 120
!
# limits the connections for this virtual host:
QS_SrvMaxConn 100
!
# allows keep-alive support till the server reaches 600 connections:
QS_SrvMaxConnClose 80
!
# allows max 50 connections from a single ip address:
QS_SrvMaxConnPerIP 10
</IfModule>

puerto:22
SEE ALSO
• wplib
• mod_evasive
• Bedrock

puerto:22
SUMMARY
• wp-cli for the win
• WordPress can be managed like any other system
• WordPress security can be managed at the system level
• Automate!

puerto:22
THANK YOU!
Javier Arturo Rodríguez
@codehead
http://scribd.com/javierrgz/

WordPress for SysAdmins

More Related Content

Similar to WordPress for SysAdmins (20)

More from Javier Arturo Rodríguez (9)

Recently uploaded (20)

WordPress for SysAdmins