Page History

Install PHP

Install the PHP Packages

Introduction

As an application, WordPress is easy to use and feature rich. It has an established community, and in my opinion, the best selection of themes and the most usable blogging cms software package available. 

However, though the initial setup seems fast and easy, as an enterprise administrator, it is very insecure. This article provides instructions on setting up a secure WordPress that caters to multiple clients but with one linux administrator called setupadmin.

This approach to setting up WordPress is,

1. Segregates different clients from each other with multiple WordPress instances.
2. Minimize damage if WordPress itself is hacked.
3. Is Easy to backup and recover.
4. Will not be giving customers console access.

WordPress may use an array of technologies. The stack selected for the Bonsai Framework is,

• Web Server = Apache
• Application Server = PHP
• Database = MySQL
• OS = Ubuntu

Initially I tried to make this work with ACL permissions, but the technology does not work as you would expect and not workable.

Install Packages

Install the packages to run WordPress,

For Ubuntu 16 

sudo apt-get install php # Installs PHP
sudo apt-get install mysql-server # Installs MySQL
sudo apt-get install php-mysql # Libraries to connect PHP to MySQL
sudo apt-get install php-gd # Libraries to allow image editing through browser, "Edit Media"
sudo apt-get install libapache2-mod-php # As of Apache 2.4 php module is no longer installed
sudo apt-get install php7.0-xml # Libraries to allow uploads

For Ubuntu 12 and under run the commands listed below

sudo apt-get install php5 # Installs PHP
sudo apt-get install mysql-server # Installs MySQL
sudo apt-get install php5-mysql # Libraries to connect PHP to MySQL
sudo apt-get install php5-gd # Libraries to allow image editing through browser, "Edit Media"

As of Ubuntu 12 (an maybe even earlier), the installer will automatically restart Apache2 for you.

Verify

Quickly verify that everything works by creating a php info file with your favourite editor,

sudo vi /var/www/info.php # On public site do not use such an obvious file name

Put in the following contents,

<?php
phpinfo();
?> 

Save the file and browser to file using a browser. You can use either the IP Address or the valid Domain Name. For example, http://173.194.75.94/info.php or http://www.krypton.com/info.php which should show a purple and grey PHP informational screen.

Secure the Server

suPHP, LiteSpeed Web Server

Install MySQL

sudo apt-get install mysql-server 

For the root administration database password, use the standard password algorithm based on the server name.

Connect PHP to MySQL

sudo apt-get install php5-mysql 

Create the Accounts in MySQL

Connect into MySQL,

mysql -u root -p 

During the MySQL install, you will be prompted for the root administration database password. If following the Bonsai Framework, use your standard password algorithm based on the server name.

Directory and Permission Structure

This approach is more secure than most WordPress default setups. However, it has some limitations around the security, namely administration of this directory structure is restricted to serveradmin.

For the most part, if the WordPress user administer everything through the WordPress web interface this works perfectly well.

If you want to grant ssh access, then wait for my next article which would allow this, but would require an additional layer of security.

Permission and Group Structure

We want website hosting for two different clients, The Daily Planet and LexCorp. Employees from the respective companies will admin through their respective wordpress instances. Here is how the top level structure looks,

 Directories required for PHP,

These directories are for WordPress,

web Folder

This is where everything starts for web related work,

cd /opt/
sudo mkdir ./web/

# Next set the permissions.
sudo chown -R serveradmin:www-data ./web/
sudo chmod -R u+rwX,g+r-w+X,o-rwX ./web/

php Folders

This is where all php code will execute. In php centric applications this will also be considered the web root for static files too and reflected in the virtual host configuration,

cd /opt/web/
sudo mkdir php
sudo chown -R serveradmin:staff ./php/
sudo chmod -R u+rwX,g+r-w+X,o-r-w+X ./php/

Next we create the php support directories,

cd /opt/web/php/
sudo mkdir ./tmp/ ./logs/
sudo chown -R serveradmin:www-data ./tmp/ ./logs/
sudo chmod -R u+rwX,g+rwX,o-rwx ./tmp/ ./logs/

Note the PHP process runs under Apache as the www-data data which belongs to the www-data group. Giving the www-data group write access effectively grants the PHP process the required write access.

Keep in mind that you can not go into the /opt/web/php directory as a normal staff user. At the same time, if you use serveradmin you do not have access sudo.

Make your staff user part of the serveradmin and www-data group,

sudo usermod -a -G serveradmin bhitch
sudo usermod -a -G www-data bhitch
exit # If you used your own staff account to modify your staff account, you need to exit and log back in.

Finally logoff and log back in with your staff account for the group changes to take effect.

Configure PHP to Use Specified Folders

Edit php.ini to make use of the folders.
Ubuntu 16 

sudo vi /etc/php/7.0/cli/php.ini

Ubuntu 12

sudo vi /etc/php5/apache2/php.ini

Set Running Directory

Search for the open_basedir line and modify to include the directories setup for WordPress,

; open_basedir, if set, limits all file operations to the defined directory
; and below.  This directive makes most sense if used in a per-directory
; or per-virtualhost web server configuration file. This directive is
; *NOT* affected by whether Safe Mode is turned On or Off.
; http://php.net/open-basedir
open_basedir = /opt/web/php/

This helps minimizes the amount of damage that can be done in the event that the system is compromised to the specified directory.

Set Temp Directory

Because open_basedir has been set, WordPress no longer has access to the general temporary folder it expects which is required for certain operations (for example to upload plugins through the Administrator web interface).

Modify php.ini further by modifying the upload_tmp_dir line,

; Temporary directory for HTTP uploaded files (will use system default if not
; specified).
; http://php.net/upload-tmp-dir
upload_tmp_dir = /opt/web/php/tmp/

Increasing The Upload Limit

The default upload limit is 2mb, the limit must be increased for uploads higher than 2mb or else they will fail when you try to upload.

; Maximum allowed size for uploaded files.
; http://php.net/upload-max-filesize
upload_max_filesize = 2M 

This function displays the max size allowed to upload.without editing this the changes will not take on increasing filesize.

; Maximum size of POST data that PHP will accept.
; http://php.net/post-max-size
post_max_size = 2M

Make Changes Take Effect

Restart Apache for the changes to take effect,

sudo service apache2 restart

You will now find that php scripts will only run in the designated directories specified in php.ini.

Setup Website Root

Each website will have it's own root folder under /opt/web/php/,

sudo mkdir /opt/web/php/dailyplanet.com
sudo chown -R serveradmin:www-data /opt/web/php/dailyplanet.com/
sudo chmod -R u+rwX,g+r-w+X,o-rwX /opt/web/php/dailyplanet.com/

Setup Apache Virtual Host

Setup your Apache Virtual Hosts with the website root.

Setup WordPress

Make sure you are logged in a sudo enabled user. Setup WordPress as follows,

sudo su - serveradmin
cd ~
wget http://wordpress.org/latest.tar.gz
tar -xvpf latest.tar.gz
mv ./wordpress/ ./blog/ # Rename as we not need to make the technology obvious.

Finally move WordPress to the proper directory,

cd /opt/web/php/dailyplanet.com/
cp -R /home/serveradmin/blog/ ./
exit # To go back to your staff account.
sudo chown -R serveradmin:www-data /opt/web/php/dailyplanet.com/blog/
sudo chmod -R u+rwX,g+r-w+X,o-rwX /opt/web/php/dailyplanet.com/blog/

This step is essential for WordPress to be able to install plugins through the web admin interface,

sudo chown -R www-data:serveradmin /opt/web/php/dailyplanet.com/blog/wp-admin/
sudo chown -R www-data:serveradmin /opt/web/php/dailyplanet.com/blog/wp-content/
sudo chmod -R g+w /opt/web/php/dailyplanet.com/blog/wp-admin/
sudo chmod -R g+w /opt/web/php/dailyplanet.com/blog/wp-content/

Configure MySQL

Secure MySQL

As a staff user run the Secure Installation script included with MySQL,

sudo mysql_secure_installation

The prompts are very straightforward. Except for "Change the Root password?", answer yes to all prompts by hitting Enter,

NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MySQL
      SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!

In order to log into MySQL to secure it, we'll need the current
password for the root user.  If you've just installed MySQL, and
you haven't set the root password yet, the password will be blank,
so you should just press enter here.
Enter current password for root (enter for none): 
OK, successfully used password, moving on...
Setting the root password ensures that nobody can log into the MySQL
root user without the proper authorisation.
You already have a root password set, so you can safely answer 'n'.
Change the root password? [Y/n] n
 ... skipping.
By default, a MySQL installation has an anonymous user, allowing anyone
to log into MySQL without having to have a user account created for
them.  This is intended only for testing, and to make the installation
go a bit smoother.  You should remove them before moving into a
production environment.
Remove anonymous users? [Y/n] 
 ... Success!
Normally, root should only be allowed to connect from 'localhost'.  This
ensures that someone cannot guess at the root password from the network.
Disallow root login remotely? [Y/n] 
 ... Success!
By default, MySQL comes with a database named 'test' that anyone can
access.  This is also intended only for testing, and should be removed
before moving into a production environment.
Remove test database and access to it? [Y/n] 
 - Dropping test database...
 ... Success!
 - Removing privileges on test database...
 ... Success!
Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.
Reload privilege tables now? [Y/n] 
 ... Success!
Cleaning up...
All done!  If you've completed all of the above steps, your MySQL
installation should now be secure.
Thanks for using MySQL! 

For now that's it to securing MySQL.

Connect

Connect into MySQL,

mysql -u root -p

The password to use is the password set during the MySQL install. If everything goes well you will be in the MySQL shell,

Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 36
Server version: 5.5.24-0ubuntu0.12.04.1 (Ubuntu)
Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql>

The remainder of this section happens inside of the mysql shell.

Create the WordPress Database and Accounts in MySQL

List the databases to makes sure what you want to create does not already exists,

SHOW DATABASES;
mysql> SHOW DATABASES;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| mysql              |
| performance_schema |
+--------------------+
3 rows in set (0.16 sec)

In our case we should have nothing other than the three default databases.

Enter the following MySQL commands,

CREATE DATABASE wordpresskryptondbwpdailyplanetdb;
GRANT ALL PRIVILEGES ON wordpresskryptondbwpdailyplanetdb.* TO "wpkryptonuser"@"localhost"'wpdpdbuser'@'localhost' IDENTIFIED BY "'password"';
FLUSH PRIVILEGES;
EXIT

Explain variables on a table, wordpresskryptondb, wpkryptonuser, localhost, password.

Adjust the variables for your application.

wpdailyplanetdb - Name of the database for the WordPress application instance. We use the domain name of the website.

wpdpdbuser - User account for accessing the database cannot be longer than 16 characters

localhost - Address of the database server. In this example, the database is on the same server so use localhost.

password - Change to password using algorithm based on name of the primary website domain, in this case dailyplanet.

Exit MySQL Shell

Exit the MySQL shell,

EXIT

Configure WordPress

Create Config File for Database Access

Launch a browser and hit the WordPress setup page for your machine at http://dailyplanet.com/blog/wp-admin/install.php and you will be prompted to create a configuration file.

Click the button, "Create a Configuration File".

The next prompt reminds you of all the critical information you will need.

Note, the message,

If for any reason this automatic file creation doesn’t work, don’t worry. All this does is fill in the database information to a configuration file. You may also simply open wp-config-sample.php in a text editor, fill in your information, and save it as wp-config.php.

The Bonsai Framework takes a high security posture, so the automatic file creation should not work. Click the "Let's go!" button.

Enter the required information and click "Submit",

It is expected that you will receive a message that WordPress can not write the wp-config file and the following prompt will appear on screen,

Copy the generated wp-config.php file.

Go to your shell, load your favourite editor and paste the contents of the wp-config.php file,

su - serveradmin # If you are not already serveradmin
vi /opt/web/php/dailyplanet.com/blog/wp-config.php

Once you have saved the file, go back to your browser and click "Run the install".

Enter Site Information

Finally enter the site information,

Click, "Install WordPress" which should result in a success screen. At this point you are actually done the setup. Do not click "Log In".

If everything went well you will see a "Success!" message.

Customize WordPress

At this point WordPress is already working. There are two urls to take note of,

If you have the Install WordPress Success Screen still up, click "Log In" will take you to the Word Press Administration url or use the url in the table above.

Minimal Security - Block Login Attacks

WordPress out of the box can be easily broken into with a brute force dictionary attack for the following combined reasons,

1. The administrator account is available on the public portion of the blog as part of the default sample content.
2. Nothing prevents the brute force attack from trying again and again on the WordPress Administration login page.
3. The Administration page well known.

For these reasons it is best to not make the website publicly available until secured or at least, as mentioned choose a very complex password.

For a more secure setup, consider Installing one of these plugins,

Should have link to how to ssh in to disable plugins if they misbehave.

Set Up Users

The default user created is an administrator and has more privileges than necessary. The very first step is to create users with specific roles provided by WordPress. The roles are outlined below in order of most privileges to least.

Keep in mind that when creating accounts, Wordpress requires unique email addresses.

Create your first user,

FAQ

Why do some of the php5 installations say to use install libapache2-mod-php5?

No need, The instructions may be old. At least with Ubuntu 12.04 there is no need for this package because it is included with the php5 package.

...

Nothing I can see. It just looks like php5 is an overarching package name.

References

Setup

Ubuntu Server Documentation - https://help.ubuntu.com/12.04/serverguide/php5.html

Security

Has some ok details around suPHP - https://help.ubuntu.com/community/ApacheMySQLPHP#Installing_MYSQL_with_PHP_5

Some good notes on securing PHP from Symantec - http://www.symantec.com/connect/articles/securing-php-step-step

Start some good security practices for WordPress - http://www.howtospoter.com/web-20/wordpress/triple-p-of-total-wordpress-security

Wordpress discussion on permissions, based their recomendations for suPHP the community does not really understand permissions - http://codex.wordpress.org/Changing_File_Permissions

This restricts the php process to specific directories - http://help.godaddy.com/article/1616

At least by looks this looks like it may be a good guide to securing wordpress - http://wpsecure.net/basics/

Wordpress' official article to getting started after setup - http://codex.wordpress.org/First_Steps_With_WordPress

Article which resolved manual upload issue - http://www.charleshooper.net/blog/wordpress-auto-upgrade-and-dumb-permissions/