Wordpress Blog Site (Tool) - Revision history

Ed: /* Upgrading the blog */

2017-10-19T04:31:23Z

Upgrading the blog

2017-10-19T03:56:20Z

Upgrading the blog

2017-10-19T03:48:27Z

The Plan

2017-10-19T03:46:12Z

The Plan

2017-10-19T03:38:51Z

Turning the FTP server on and off

2017-10-19T03:17:19Z

The Plan

2017-10-19T01:40:06Z

Pharma Hack

2017-10-19T01:37:06Z

Upgrading the blog

2017-10-18T23:43:08Z

Finding the backdoor

2017-10-18T23:35:03Z

← Older revision		Revision as of 04:31, 19 October 2017
Line 293:		Line 293:

	I also installed the free version of WordFence. It wouldn't have stopped our last malware, most likely, but it should stop at least some of the future annoyances. I went with the basic config. The notifications are sent to mcnair@rice.edu		I also installed the free version of WordFence. It wouldn't have stopped our last malware, most likely, but it should stop at least some of the future annoyances. I went with the basic config. The notifications are sent to mcnair@rice.edu
		+
		+	===Still to do===
		+
		+	We should consider some extra hardening! See, for example, https://codex.wordpress.org/Hardening_WordPress
		+
		+	That we really can't update our theme is an ongoing issue...

	[[Category: McNair Admin]]		[[Category: McNair Admin]]

← Older revision		Revision as of 03:56, 19 October 2017
Line 289:		Line 289:

	Image upload was tested and worked fine, and a new plugin was also installed fine.		Image upload was tested and worked fine, and a new plugin was also installed fine.
		+
		+	===Installing WordFence===
		+
		+	I also installed the free version of WordFence. It wouldn't have stopped our last malware, most likely, but it should stop at least some of the future annoyances. I went with the basic config. The notifications are sent to mcnair@rice.edu

	[[Category: McNair Admin]]		[[Category: McNair Admin]]

@@ Line 276: / Line 276: @@
 *Remove disused user accounts (any contributions set to Anne Dayton)
 *Changed permissions of all users to author, except Tay to editor, and left just Ed and Anne to admin
 ===Changing permissions===

@@ Line 273: / Line 273: @@
 *Upgrade wordpress and its plugins. Note: DO NOT UPDATE THEMES!!!
 *Turned off the FTP Server
-*Lock down directory permissions more tightly
+*Locked down directory permissions more tightly (see below)
-*Remove disused user accounts
+*Remove disused user accounts (any contributions set to Anne Dayton)
 [[Category: McNair Admin]]

@@ Line 66: / Line 66: @@
 To start the service, restore the conf file first:
   mv /etc/init/vsftpd.conf.stop /etc/init/vsftpd.conf
-  service vsftpd stop
+  service vsftpd start
 ==Update Wordpress==

@@ Line 268: / Line 268: @@
 ===The Plan===
-*Fix corrupted files but copying them over with clean versions from /var/lib/wordpress_bak/
+*Fixed corrupted files but copying them over with clean versions from /var/lib/wordpress_bak/
-*Remove dodgy .htaccess file
+*Renamed dodgy .htaccess file
-*Turn on the FTP
+*Turned on the FTP Server
-*Upgrade wordpress and its plugins
+*Upgrade wordpress and its plugins. Note: DO NOT UPDATE THEMES!!!
 *Lock down directory permissions more tightly
 *Remove disused user accounts

@@ Line 201: / Line 201: @@
   grep -r "wp_class_support"
 returns no results!
 Checking the files:
@@ Line 241: / Line 243: @@
 Both wp-content/themes and wp-content/plugins have an Oct 18 date on them. But both have subdirs with older access dates and seem clean. And the directory 2017/10 has Oct 4th dates on it but is empty. This is consistent with a numerically named php file being executed from here and then deleted.
-According the malware report it should target two additional files. We don't have WordFence, so only one is relevant:
+According to the malware report it should target two additional files. We don't have WordFence, so only one is relevant:
   locate wfScanEngine.php
   locate class-wp-upgrader.php

@@ Line 211: / Line 211: @@
   -rwxr-xr-x  1 www-data root      1627 Oct  4 06:16 wp-blog-header.php
-In wp-includes we also have (despite the directory having an older mod stamp)
+In wp-includes we also have (despite the directory having an older mod stamp), but for now let's treat this as irrelevant.
   -rwxr-xr-x  1 www-data root        619 Sep 20 04:08 version.php
   -rwxr-xr-x  1 www-data root     144389 Sep 20 04:08 class-wp-customize-manager.php
@@ Line 254: / Line 254: @@
 ===Upgrading Ubuntu's packages===
-To start upgrade ubuntu's packages so that everything is fresh and new.
+To start, upgrade ubuntu's packages so that everything is fresh and new.
   apt-get updates
   (maybe need to do a separate dpkg --configure -a)
@@ Line 266: / Line 266: @@
 ===The Plan===
-*Fix corrupted files
+*Fix corrupted files but copying them over with clean versions from /var/lib/wordpress_bak/
 *Remove dodgy .htaccess file
 *Turn on the FTP
-*Upgrade wordpress and plugins
+*Upgrade wordpress and its plugins
-*Look down directory permissions more tightly
+*Lock down directory permissions more tightly
 *Remove disused user accounts
 [[Category: McNair Admin]]

← Older revision		Revision as of 23:43, 18 October 2017
Line 263:		Line 263:
	===Finding the backdoor===		===Finding the backdoor===

		+	It really isn't clear how this thing got in, beyond being in the uploads directory at some point and having enough permissions to create a .htaccess file that it left behind. Most likely we had a vulnerable plugin. There are no anomalous user accounts but we should delete and clean up anyway.

		+	===The Plan===
		+	*Fix corrupted files
		+	*Remove dodgy .htaccess file
		+	*Turn on the FTP
		+	*Upgrade wordpress and plugins
		+	*Look down directory permissions more tightly
		+	*Remove disused user accounts


	[[Category: McNair Admin]]		[[Category: McNair Admin]]

@@ Line 147: / Line 147: @@
 Add a custom (text/html) widget from the widgets to put in the 'Contact Us' and social media icons.
-== Requirements ==
+== Styling ==
-== Design ==
+The styling involves LOTS of changes to various php and (some) css files. Generally, if you see a file with a .bak extension then changes have been made to it. The changes were too extensive to document.
 === Image Uploads ===
 *Images uploaded, both attached to posts and unattached, are added to the media library.
 *They are categorized in the backend per the month and the year in which they are uploaded.
@@ Line 170: / Line 168: @@
 **** find images from Creative Commons
 **** add these images for each post - the Pixabay button can be seen next to the Add Media button on the create post screen.
 ==Adding pluggins==
@@ Line 198: / Line 185: @@
 *https://help.ubuntu.com/lts/serverguide/ftp-server.html
 *http://askubuntu.com/questions/666858/vsftpd-service-will-not-start-for-14-04
 [[Category: McNair Admin]]