6.x WordPress v0.1 - ACLs Fail

Introduction

As an application, WordPress is easy to use and feature rich. It has an established community, and in my opinion, the best selection of themes and the most usable blogging cms software package available. 

However, though the initial setup seems fast and easy, as an enterprise administrator, it is very insecure. This article provides instructions on setting up a secure WordPress that caters to multiple clients. A simpler single client setup will be drawn out of this article.

This approach to setting up WordPress is complex because it focuses on Information Security and uses ACLs. As a trade for the complexity, you end up with a WordPress environment that,

1. Segregates different clients from each other.
2. Minimizes damage if WordPress itself is hacked.
3. Has Two Factor Authentication.
4. Scales quickly.
5. Is Easy to backup and recover.

Though all the steps here show how to do the work, it is helpful to have a good understanding of basic Unix permissions and go through the ACLs tutorial.

WordPress may use an array of technologies. The stack selected for the Bonsai Framework is,

• Web Server = Apache
• Application Server = PHP
• Database = MySQL
• OS = Ubuntu

Install Packages

Install the packages to run WordPress,

sudo apt-get install php5 # Installs PHP
sudo apt-get install mysql-server # Installs MySQL
sudo apt-get install php5-mysql # Libraries to connect PHP to MySQL

As of Ubuntu 12 (an maybe even earlier), the installer will automatically restart Apache2 for you.

During the MySQL install, you will be prompted for the root administration database password. If following the Bonsai Framework, use your standard password algorithm based on the server name.

sudo apt-get install acl

Setup Directory Structure with ACLs

This security approach works at various levels to contain process and programs to run only within their specified folders and restrict users to their own respective instances of WordPress.

Permission and Group Structure

We want to provide website hosting for two different clients, The Daily Planet and LexCorp. Employees from the respective companies will belong in the system under the following groups, wgdailyplanet and wglexcorp. Here is how the top level structure,

We do not want employees from different companies access or even have awareness of each others web directory. At the same time, the Apache Server running as user www-data belonging to group www-data also needs access to the directories. We also want to grant users of the staff group read access for support purposes. Finally, we want all subsequent directories and files under the respective Web Root Directories to inherit the same permissions.

This is just not possible using standard Unix permissions.

As such we will require ACLs. Here is what each directory will look like and how the main user types will interact with directories and files,

Further to this, using normal Unix permissions, all directories will be owned by serveradmin:staff.

web Folder

This is where everything starts for web related work,

cd /opt/
sudo mkdir ./web/
sudo chown -R serveradmin:staff ./web/
#sudo chmod -R g+s ./web/ # Subsequent files and folder should inherit group. Ask DK if this is a good idea.
#sudo chmod -R u+s ./web/ # Subsequent files and folder should inherit user but this does not seem to work. Ask DK if this is a good idea.
# Next set the permissions.
sudo chmod u+rwX,g+r-w+X,o-rw+X ./web/
# Give other groups the appropriate access via acls.
sudo setfacl -Rm g:www-data:rX ./web/
sudo setfacl -Rm g:staff:rX ./web/
# With ACLs the mask sets the maximum permissions allowed. 
# Even if other entries, such as giving a group rwX are set higher, permissions will be downgraded to what the mask allows. 
# This is what causes the Effective comment seen when mask collides with umask.
# sudo setfacl -Rm m:rwx ./web/

Verify permissions for the web folder,

getfacl web
# file: web
# owner: serveradmin
# group: staff
user::rwx
group::r-x
group:www-data:r-x
group:staff:r-x
mask::r-x
other::---

Now look at the defaults of the folder the default affects the folders and files created within this folder,

getfacl --default web
# file: web
# owner: serveradmin
# group: staff

To apply the permissions set to the folder to defaults,

getfacl --access ./web/ | sudo setfacl -d -RM - ./web/

getfacl --access =  retrieves the ACL the permissions applied to the directory only (default permissions are not returned). The details are then piped to setfacl and the parameters read,

-d = Change default permissions for newly created files and folder.
-M = Take as input files. Because the dash is used, the file is instead standard input.
R  = Apply changes recursively to folders and files.

The default ACLs should now be changed,

getfacl --default ./web/
# file: web/
# owner: serveradmin
# group: staff
user::rwx
group::r-x
group:www-data:r-x
group:staff:r-x
mask::r-x
other::---

php Support Folders

This is where all php code will execute. In php centric applications this will also be considered the web root for static files too and reflected in the virtual host configuration.

Create Folders

PHP requires advanced access to specific folders,

cd /opt/web/
sudo mkdir php
sudo chown -R serveradmin:staff ./php/
sudo chmod -R u+rwX,g+r-w+X,o-r-w+X ./php/

Notice the ACLs step is skipped. The php folder will inherit the permissions of allowing www-data access from the default ACLs defined in the web folder.

Next create the php support directories,

cd /opt/web/php
sudo mkdir ./tmp/ ./logs/
sudo chown serveradmin:staff ./tmp/ ./logs/
sudo chmod -R u+rwX,g+r-w+X,o-rwx ./tmp/ ./logs/
 
sudo setfacl -Rm g:www-data:rwX ./tmp/ ./logs/
getfacl --access ./tmp/ | sudo setfacl -d -RM - ./tmp/ ./logs/

The PHP process run under Apache as www-data needs full access to these folder.

Configure PHP to Use Specified Folders

Edit php.ini to make use of the folders.

sudo vi /etc/php5/apache2/php.ini

Set Running Directory

Search for the open_basedir line and modify to include the directories setup for WordPress,

; open_basedir, if set, limits all file operations to the defined directory
; and below.  This directive makes most sense if used in a per-directory
; or per-virtualhost web server configuration file. This directive is
; *NOT* affected by whether Safe Mode is turned On or Off.
; http://php.net/open-basedir
open_basedir = /opt/web/php

This helps minimizes the amount of damage that can be done in the event that the system is compromised to the specified directory.

Set Temp Directory

Because open_basedir has been set, WordPress no longer has access to the general temporary folder it expects which is required for certain operations (for example to upload plugins through the Administrator web interface).

Modify php.ini further by modifying the upload_tmp_dir line,

; Temporary directory for HTTP uploaded files (will use system default if not
; specified).
; http://php.net/upload-tmp-dir
upload_tmp_dir = /opt/web/php/tmp/

Make Changes Take Effect

Restart Apache for the changes to take effect,

sudo service apache2 restart

You will now find that php scripts will only run in the designated directories specified in php.ini.

Setup Website Root

Each website will have it's own root folder under /opt/web/php/. To keep things simple we will keep both static and php content inside of this folder.

Each website specific folder will only allow users belonging to the correct group to enter and work with the directory,

cd /opt/web/php
sudo mkdir dailyplanet.com
sudo chown -R serveradmin:staff dailyplanet.com

Now to add the necessary groups to their respective virtual hosts,

sudo setfacl -Rm g:wgdailyplanet:rwX dailyplanet.com
sudo getfacl --access ./dailyplanet.com/ | sudo setfacl -d -RM - ./dailyplanet.com/

Repeat as needed for each website.

Symbolic Link for Group Accounts

Due to the tight security, the directory listing for /opt/web/  and /opt/web/php/ is restricted. So users will not know about the web root.

There are a few solutions to this. In the case where users should only be working with a specific website, that users home directory can be set to the web root.

In some cases, you may have more than one site be managed by the same work group. In that case, it is simpler to create symbolic link in that user's home directory.

In this example, there is a general web master user, web.master who belongs to both the wgdailyplanet and wglexcorp groups. As a sudo enabled user,

sudo su - web.master # Log in as web.master
cd ~
ln -s /opt/web/php/dailyplanet.com dailyplanet.com
ln -s /opt/web/php/lexcorp.com lexcorp.com

Setup WordPress

WordPress is incredibly easy to setup and there are many shorter tutorials than this.

This tutorial, takes a more secure approach

Apply ACLs to WordPress Folders

Using the serveradmin account, download and decompress WordPress,

cd ~
wget http://wordpress.org/latest.tar.gz
tar -xvpf latest.tar.gz
mv ./wordpress/ ./blog/ # Rename as we not need to make the technology obvious.

# We MUST give group read, execute and write access. We want, using ACLs, to grant respective client's group full access to modify files. Because ACLs are limited by the mask, the group mask needs to be open.
sudo chmod -R u+rwX,g+rwX,o-rwx ./blog/

umask 0002 # Again we need the umask open for ACLs.
cp -R ./blog/ /opt/web/php/dailyplanet.com/ # Copy NOT move so default ACLs defined in /opt/web/php/ are applied.

As a staff user with sudo access,

sudo chown -R serveradmin:staff /opt/web/php/dailyplanet.com/blog/

........

....... Below this is being rewritten ....

.........

At this point the blog directory should be setup with the correct permissions inherited, however, there is some kind of odd behaviour,

sudo getfacl ./blog/
# file: blog
# owner: serveradmin
# group: staff
user::rwx
group::r-x
group:www-data:r-x
group:staff:r-x
group:wgdailyplanet:rwx        #effective:r-x
mask::r-x
other::---
default:user::rwx
default:group::r-x
default:group:www-data:r-x
default:group:staff:r-x
default:group:wgdailyplanet:rwx
default:mask::rwx
default:other::--x

Notice the #effective:r-x comment prevents users from wgailyplanet to be able to write to the blog directory.

Fix this,

sudo setfacl -Rm g:wgdailyplanet:rwX ./blog/
sudo getfacl --access ./blog/ | sudo setfacl -d -RM - ./dailyplanet.com/
# Still investigating...
# Strangely doing the above using the group www-data also fixed the problem... retest at exactly what point...

Now it's fixed,

 file: blog/
# owner: serveradmin
# group: staff
user::rwx
group::r-x
group:www-data:r-x
group:staff:r-x
group:wgmainframe:rwx
mask::rwx
other::---
default:user::rwx
default:group::r-x
default:group:www-data:r-x
default:group:staff:r-x
default:group:wgmainframe:rwx
default:mask::rwx
default:other::---

ACLs Do not Work as Thought

Match Group  <group name>
ForceCommand  internal-sftp  -u 73

Further Refine File Permissions

Here are how the file permissions will look,

To setup these permissions with ACLs as a staff user,

cd /opt/web/php/dailyplanet.com/blog/
sudo setfacl -Rm g:www-data:rwX ./wp-content/
getfacl --access ./wp-content/ | sudo setfacl -d -RM - ./wp-content/

The ACLs ensures that WordPress can install plugins and themes.

Configure MySQL

Secure MySQL

As a staff user run the Secure Installation script included with MySQL,

sudo mysql_secure_installation

The prompts are very straightforward. Except for "Change the Root password?", answer yes to all prompts by hitting Enter,

NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MySQL
      SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!

In order to log into MySQL to secure it, we'll need the current
password for the root user.  If you've just installed MySQL, and
you haven't set the root password yet, the password will be blank,
so you should just press enter here.
Enter current password for root (enter for none): 
OK, successfully used password, moving on...
Setting the root password ensures that nobody can log into the MySQL
root user without the proper authorisation.
You already have a root password set, so you can safely answer 'n'.
Change the root password? [Y/n] n
 ... skipping.
By default, a MySQL installation has an anonymous user, allowing anyone
to log into MySQL without having to have a user account created for
them.  This is intended only for testing, and to make the installation
go a bit smoother.  You should remove them before moving into a
production environment.
Remove anonymous users? [Y/n] 
 ... Success!
Normally, root should only be allowed to connect from 'localhost'.  This
ensures that someone cannot guess at the root password from the network.
Disallow root login remotely? [Y/n] 
 ... Success!
By default, MySQL comes with a database named 'test' that anyone can
access.  This is also intended only for testing, and should be removed
before moving into a production environment.
Remove test database and access to it? [Y/n] 
 - Dropping test database...
 ... Success!
 - Removing privileges on test database...
 ... Success!
Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.
Reload privilege tables now? [Y/n] 
 ... Success!
Cleaning up...
All done!  If you've completed all of the above steps, your MySQL
installation should now be secure.
Thanks for using MySQL! 

For now that's it to securing MySQL.

Connect

Connect into MySQL,

mysql -u root -p

The password to use is the password set during the MySQL install. If everything goes well you will be in the MySQL shell,

Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 36
Server version: 5.5.24-0ubuntu0.12.04.1 (Ubuntu)
Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql>

The remainder of this section happens inside of the mysql shell.

Create the WordPress Database and Accounts in MySQL

List the databases to makes sure what you want to create does not already exists,

SHOW DATABASES;
mysql> SHOW DATABASES;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| mysql              |
| performance_schema |
+--------------------+
3 rows in set (0.16 sec)

In our case we should have nothing other than the three default databases.

Enter the following MySQL commands,

CREATE DATABASE wpdailyplanetdb;
GRANT ALL PRIVILEGES ON wpdailyplanetdb.* TO 'wpdpdbuser'@'localhost' IDENTIFIED BY 'password';
FLUSH PRIVILEGES;

Adjust the variables for your application.

wpdailyplanetdb - Name of the database for the WordPress application instance. We use the domain name of the website.

wpdpdbuser - User account for accessing the database cannot be longer than 16 characters

localhost - Address of the database server. In this example, the database is on the same server so use localhost.

password - Change to password using algorithm based on name of the primary website domain, in this case dailyplanet.

Exit MySQL Shell

Exit the MySQL shell,

EXIT

Configure WordPress

Create Config File for Database Access

Launch a browser and hit the WordPress setup page for your machine at http://dailyplanet.com/blog/wp-admin/install.php and you will be prompted to create a configuration file.

Click the button, "Create a Configuration File".

The next prompt reminds you of all the critical information you will need. The Bonsai Framework takes a high security posture, so the automatic file creation should not work. Click the "Let's go!" button.

Enter the required information and click "Submit",

It is expected that you will receive a message that WordPress can not write the wp-config file and the following prompt will appear on screen,

Copy the generated wp-config.php file.

Go to your shell, load your favourite editor and paste the contents of the wp-config.php file,

vi /opt/web/php/dailyplanet.com/blog/wp-config.php

Also while you are there add the following to the bottom of the file,

# WordPress determines write access when it finds a match between the Web Server ID and the directory being written too.
# This approach does not work with ACLs. During manual file upload the failure results in a prompt for FTP login information.
# Because we are using ACLs, override the write check by forcing a direct write.
define('FS_METHOD', 'direct');

This is to allow the ACL approach. Yes we could make the owner of the wp-content directory www-data, but that breaks the general approach by the Bonsai Framework.

Once you have saved the file, go back to your browser and click "Run the install".

Enter Site Information

Finally enter the site information,

Click, "Install WordPress" which should result in a success screen. At this point you are actually done the setup. Do not click "Log In".

Customize WordPress

At this point WordPress is already working. There are two urls to take note of,

If you have the Install WordPress Success Screen still up, click "Log In" will take you to the Word Press Administration url or use the url in the table above.

Minimal Security - Block Login Attacks

WordPress out of the box can be easily broken into with a brute force dictionary attack for the following combined reasons,

1. The administrator account is available on the public portion of the blog as part of the default sample content.
2. Nothing prevents the brute force attack from trying again and again on the WordPress Administration login page.
3. The Administration page well known.

For these reasons it is best to not make the website publicly available until secured or at least, as mentioned choose a very complex password.

Install one of these plugins.

Should have link to how to ssh in to disable plugins if they misbehave.

Set Up Users

The default user created is an administrator and has more privileges than necessary. The very first step is to create users with specific roles provided by WordPress. The roles are outlined below in order of most privileges to least.

Keep in mind that when creating accounts, Wordpress requires unique email addresses.

(explain why we do not use the first admin account we created) Creat the real administrator account,

...

Lock Down WordPress

WordPress and PHP simply due to the model is inherently insecure when compared to more Enterprise solutions.

As such the Bonsai Framework takes an administrator approach to managing and securing WordPress. Though these instructions allow for multiple clients to co-host, it is recommended to not use a co-hosting model for clients that require enterprise privacy. This is especially problematic if clients are granted shell access. It becomes very complex to protect one client from gaining access to another client's WordPress data.

Restrict WordPress Database Account

Now that WordPress is setup we can lock down the application database account. As part of good application security, the WordPress application database account should only be granted minimal privileges. Note that during upgrades you will have to increases privileges again.

Connect into MySQL,

mysql -u root -p 

Enter the following MySQL commands,

REVOKE ALL PRIVILEGES, GRANT OPTION FROM 'wpdpdbuser'@'localhost';
GRANT SELECT, INSERT, UPDATE ON wpdailyplanetdb.* TO 'wpdpdbuser'@'localhost' IDENTIFIED BY 'password';
FLUSH PRIVILEGES;

Adjust the variables for your application.

wpdailyplanetdb - Name of the database for the WordPress application instance. We use the domain name of the website.

wpdpdbuser - User account for accessing the database.

localhost - Address of the database server. In this example, the database is on the same server so use localhost.

password - Change to password using algorithm based on name of the website domain, in this case dailyplanet.

Verify the changes took effect,

SHOW GRANTS FOR 'wpdpdbuser'@'localhost';

File Permissions

From the WordPress article Hardening WordPress we will want to take the approach of creating accounts for select developers or release managers.

wp-config.php - holds the database password and should be locked down (it is thanks to the ACLs)

...

Writing Next Topics

• Repeat for the second instance.
• Upgrades and Updates

FAQ

Why do some of the php5 installations say to use install libapache2-mod-php5?

The instructions may be old. At least with Ubuntu 12.04 there is no need for this package because it is included with the php5 package.

What is the difference between the php5  and libapache2-mod-php5 packages?

Nothing I can see. It just looks like php5 is an overarching package name.

References

Setup

Ubuntu Server Documentation - https://help.ubuntu.com/12.04/serverguide/php5.html

Security

Has some ok details around suPHP - https://help.ubuntu.com/community/ApacheMySQLPHP#Installing_MYSQL_with_PHP_5

Some good notes on securing PHP from Symantec - http://www.symantec.com/connect/articles/securing-php-step-step

Start some good security practices for WordPress - http://www.howtospoter.com/web-20/wordpress/triple-p-of-total-wordpress-security

Wordpress discussion on permissions, based their recomendations for suPHP the community does not really understand permissions - http://codex.wordpress.org/Changing_File_Permissions

This restricts the php process to specific directories - http://help.godaddy.com/article/1616

At least by looks this looks like it may be a good guide to securing wordpress - http://wpsecure.net/basics/

Wordpress' official article to getting started after setup - http://codex.wordpress.org/First_Steps_With_WordPress

Article which resolved manual upload issue - http://www.charleshooper.net/blog/wordpress-auto-upgrade-and-dumb-permissions/