"Secure" Word Press on Amazon Linux - Revision history

Michael.mast: /* Install packages */

2019-02-15T23:01:31Z

Install packages

Michael.mast at 18:10, 10 January 2019

2019-01-10T18:10:04Z

Michael.mast: /* IPTABLES */

2018-06-21T14:50:56Z

IPTABLES

Michael.mast: /* Non SELinux */

2018-04-17T16:17:18Z

Non SELinux

Michael.mast at 15:07, 17 April 2018

2018-04-17T15:07:44Z

Show changes

Michael.mast at 04:39, 8 March 2018

2018-03-08T04:39:32Z

Michael.mast at 13:11, 31 December 2017

2017-12-31T13:11:43Z

Michael.mast at 13:09, 31 December 2017

2017-12-31T13:09:22Z

Michael.mast at 13:03, 31 December 2017

2017-12-31T13:03:06Z

Michael.mast at 04:42, 31 December 2017

2017-12-31T04:42:58Z

@@ Line 23: / Line 23: @@
 <pre>
 sudo yum -y update
-sudo yum -y install fail2ban httpd24 mysql mysql-server php70 php70-mysqlnd mod24_ssl yum-cron php70-mbstring php70-zip htop
+sudo yum -y install fail2ban httpd24 mysql mysql-server php70 php70-mysqlnd mod24_ssl yum-cron php70-mbstring php70-zip php-xml htop
 sudo yum -y install https://dl-ssl.google.com/dl/linux/direct/mod-pagespeed-stable_current_x86_64.rpm
 sudo ln -sf /usr/share/zoneinfo/America/New_York /etc/localtime

← Older revision		Revision as of 18:10, 10 January 2019
Line 214:		Line 214:
	##Amount of time a user is locked out : 30 minutes		##Amount of time a user is locked out : 30 minutes
	##Immediately lock out invalid usernames : Check this box		##Immediately lock out invalid usernames : Check this box
−
−	~~==Process that is just wrong==~~
−	~~<br>~~
−	~~<b>!!!!IGNORE THIS AS IT DOES NOT WORK!!!!! Bad practices and steps that simply do not work!!!!!!</b>~~
−	~~<br>~~
−	~~These instructions follow my attempts for a generally "locked down" instance for running Word Press without losing sleep.<br>~~
−	~~<br>~~
−	~~Version I am working with before updates<br>~~
−	~~Linux ip-172-26-9-250 4.9.51-10.52.amzn1.x86_64 #1 SMP Fri Sep 29 01:16:19 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux~~
−	~~<br>~~
−	~~<br>~~
−	~~<ref>https://www.tecmint.com/hide-apache-web-server-version-information/</ref><ref>https://www.tecmint.com/hide-php-version-http-header/</ref>~~
−	~~<pre>~~
−	~~sudo yum -y update~~
−	sudo yum -y install libselinux libselinux-utils selinux-policy-minimum selinux-policy-mls selinux-policy-targeted policycoreutils fail2ban httpd24 mysql mysql-server php70 php70-mysqlnd mod24_ssl yum-cron
−	~~sudo ln -sf /usr/share/zoneinfo/America/New_York /etc/localtime~~
−	~~sudo sed -i 's/selinux=/selinux=1\ security=selinux\ enforcing=1/' /etc/grub.conf~~
−	~~sudo sed -i 's/selinux=/selinux=1\ security=selinux\ enforcing=1/' /boot/grub/menu.lst~~
−	~~sudo echo -e "ServerTokens Prod\nServerSignature Off" >> /etc/httpd/conf/httpd.conf~~
−	~~sudo rm -f /etc/httpd/conf.d/welcome.conf~~
−	sudo sed -i 's/expose_php\ =\ On/expose_php\ =\ off/; s/upload_max_filesize\ =\ 2M/upload_max_filesize\ =\ 128M/; s/post_max_size\ =\ 8M/post_max_size\ =\ 64M/; s/max_execution_time\ =\ 30/max_execuion_time\ =\ 60/' /etc/php.ini
−	~~sudo sed -i 's/update_cmd\ =\ default/update_cmd\ =\ security/' /etc/yum/yum-cron.conf~~
−	~~</pre>~~
−	*<ref>https://premium.wpmudev.org/blog/increase-memory-limit/</ref>Loosen PHP for the admins, this was done with previous sed command.
−	~~upload_max_filesize = 128M<br>~~
−	~~post_max_size = 64M<br>~~
−	~~memory_limit = 128M<br>~~
−	~~<pre>~~
−	~~sudo chkconfig fail2ban on~~
−	~~sudo chkconfig mysqld on~~
−	~~sudo chkconfig httpd on~~
−	~~sudo chkconfig yum-cron on~~
−	~~sudo touch /.autorelabel~~
−	~~sudo reboot~~
−	~~</pre>~~
−	*After logging back in make sure services are started.
−	~~<pre>~~
−	~~sudo service httpd status~~
−	~~sudo service mysqld status~~
−	~~sudo service fail2ban status~~
−	~~</pre>~~
−	*Prepare MySQL for Word Press by creating a database.
−	~~<pre>~~
−	~~sudo mysql_secure_installation~~
−	~~mysql -uroot -p~~
−	~~</pre>~~
−	*Grab Word Press and install in the appropriate location
−	~~<pre>~~
−	~~wget https://wordpress.org/latest.tar.gz~~
−	~~mkdir build~~
−	~~cd build~~
−	~~tar -xf ../latest.tar.gz~~
−	~~sudo mv wordpress /var/www/html/wordpress~~
−	~~</pre>~~
−	*There are many ways to make this work, I prefer vhosts and sub directories. This will get us up and running with a self signed cert for initial configuration. Afterwards the cert should be updated.
−	~~<pre>~~
−	~~sudo mv /etc/httpd/conf.d/ssl.conf ./~~
−	echo -e "LoadModule ssl_module modules/mod_ssl.so\nListen 443\nSSLPassPhraseDialog builtin\nSSLSessionCache shmcb:/var/cache/mod_ssl/scache(512000)\nSSLSessionCacheTimeout 300\nSSLMutex default\nSSLRandomSeed startup file:/dev/urandom 256\nSSLRandomSeed connect builtin\nSSLCryptoDevice builtin\n\n<VirtualHost :80>\nRewriteEngine On\nRewriteCond %{HTTPS} off\nRewriteRule (.) https://%{HTTP_HOST}:443%{REQUEST_URI}\n</VirtualHost>\n\n<VirtualHost _default_:443>\nDocumentRoot /var/www/html/wordpress\nErrorLog logs/ssl_error_log\nTransferLog logs/ssl_access_log\nLogLevel warn\nSSLEngine on\nSSLCertificateFile /etc/pki/tls/certs/localhost.crt\nSSLCertificateKeyFile /etc/pki/tls/private/localhost.key\n</VirtualHost>" > /etc/httpd/conf.d/vhost.conf
−	~~</pre>~~
−	~~Since echo can not write to the destination file, here is the entry formatted for copy and past into a conf file~~
−	~~<pre>~~
−	~~LoadModule ssl_module modules/mod_ssl.so~~
−	~~Listen 443~~
−	~~SSLPassPhraseDialog builtin~~
−	~~SSLSessionCache shmcb:/var/cache/mod_ssl/scache(512000)~~
−	~~SSLSessionCacheTimeout 300~~
−	~~SSLMutex default~~
−	~~SSLRandomSeed startup file:/dev/urandom 256~~
−	~~SSLRandomSeed connect builtin~~
−	~~SSLCryptoDevice builtin~~
−
−	~~<VirtualHost *:80>~~
−	~~RewriteEngine On~~
−	~~RewriteCond %{HTTPS} off~~
−	~~RewriteRule (.*) https://%{HTTP_HOST}:443%{REQUEST_URI}~~
−	~~</VirtualHost>~~
−
−	~~<VirtualHost _default_:443>~~
−	~~DocumentRoot /var/www/html/wordpress~~
−	~~ErrorLog logs/ssl_error_log~~
−	~~TransferLog logs/ssl_access_log~~
−	~~LogLevel warn~~
−	~~SSLEngine on~~
−	~~SSLCertificateFile /etc/pki/tls/certs/localhost.crt~~
−	~~SSLCertificateKeyFile /etc/pki/tls/private/localhost.key~~
−	~~</VirtualHost>~~
−	~~</pre>~~
−	*Restart Apache
−	~~sudo apachectl graceful~~
−	*<ref>https://codex.wordpress.org/Hardening_WordPress</ref><b>This needs to be updated</b>: Allow the web server to write to the uploads directory for automatic updates. This first chown command shouldn't be needed, I will be doing further testing to ensure it can be removed.
−	~~<pre>~~
−	sudo chown -R apache:apache /var/www/html/wordpress/*
−	sudo chcon -R -t httpd_sys_rw_content_t /var/www/html/wordpress/wp-content/uploads/*
−	~~sudo setsebool -P httpd_read_user_content on~~
−	~~sudo setsebool -P httpd_can_network_connect_db on~~
−	~~</pre>~~
−	*Make sure that you use 172.0.0.1 for the database server, instead of localhost (it gets complicated otherwise)
−	*Add various contextual permissions (need to research this. Optionally you could enable httpd_unified, but this is not the best idea)
−	~~<pre>~~
−	~~allow httpd_t etc_mail_t:dir { search getattr };~~
−	~~allow httpd_t http_port_t:tcp_socket name_connect;~~
−	~~allow httpd_t httpd_sys_content_t:dir write;~~
−	~~allow httpd_t initrc_t:unix_stream_socket connectto;~~
−	~~allow httpd_t user_home_t:file read;~~
−	~~</pre>~~
−	*Fail2ban policy
−	~~<pre>~~
−	~~sudo setsebool -P authlogin_nsswitch_use_ldap on~~
−	~~sudo semodule -i fail2ban.pp~~
−	~~</pre>~~
−	*Make sure Amazon has the access it needs
−	~~<pre>~~
−	~~sudo sudo setsebool -P authlogin_nsswitch_use_ldap on~~
−	~~sudo grep shutdown /var/log/audit/audit.log \| audit2allow -M shutdown~~
−	~~sudo semodule -i shutdown.pp~~
−	~~</pre>~~
−	*Reboot again just for the fun of it.
−	*Install Wordfence Security plugin. Modify settings to fit your needs.
−	~~==SELinux Notes==~~
−	*From before making any changes.
−	~~<pre>~~
−	~~#============= httpd_t ==============~~
−	~~#!!!! This avc can be allowed using one of the these booleans:~~
−	~~# httpd_can_network_relay, httpd_graceful_shutdown, allow_ypbind, httpd_can_network_connect~~
−
−	~~allow httpd_t http_port_t:tcp_socket name_connect;~~
−	~~#!!!! This avc can be allowed using one of the these booleans:~~
−	~~# httpd_read_user_content, httpd_enable_homedirs~~
−
−	~~allow httpd_t user_home_t:dir getattr;~~
−
−	~~</pre>~~
−	sudo semanage fcontext -a -t httpd_sys_rw_content_t "/path(/.)?"

@@ Line 172: / Line 172: @@
 sudo /sbin/iptables -A INPUT -m state --state  ESTABLISHED -j ACCEPT
 sudo /sbin/iptables -P INPUT DROP
 </pre>

@@ Line 5: / Line 5: @@
 ==Non SELinux==
 When this was written, we started using PHP 7 and needed Apache 2.4. Neither of these are standard installs for Amazon Linux.
 ===OS Prep===
 ====Create SWAP====

@@ Line 1: / Line 1: @@
 WORK IN PROGRESS: Amazon only allows ssh access, without a console you can easily get yourself locked out.<br>
 These instructions follow my attempts for a generally "locked down" instance for running Word Press without losing sleep.<br>
 <br>

@@ Line 84: / Line 84: @@
 *Restart Apache
   sudo apachectl graceful
-*Allow the web server to write to the uploads directory for automatic updates. This first chown command shouldn't be needed, I will be doing further testing to ensure it can be removed.
+*<ref>https://codex.wordpress.org/Hardening_WordPress</ref><b>This needs to be updated</b>: Allow the web server to write to the uploads directory for automatic updates. This first chown command shouldn't be needed, I will be doing further testing to ensure it can be removed.
 <pre>
 sudo chown -R apache:apache /var/www/html/wordpress/*

@@ Line 1: / Line 1: @@
-WORK IN PROGRESS<br>
+WORK IN PROGRESS: Amazon only allows ssh access, without a console you can easily get yourself locked out.<br>
 These instructions follow my attempts for a generally "locked down" instance for running Word Press without losing sleep.<br>
 <br>
@@ Line 16: / Line 16: @@
 sudo rm -f /etc/httpd/conf.d/welcome.conf
 sudo sed -i 's/expose_php\ =\ On/expose_php\ =\ off/; s/upload_max_filesize\ =\ 2M/upload_max_filesize\ =\ 128M/; s/post_max_size\ =\ 8M/post_max_size\ =\ 64M/; s/max_execution_time\ =\ 30/max_execuion_time\ =\ 60/' /etc/php.ini
 </pre>
 *<ref>https://premium.wpmudev.org/blog/increase-memory-limit/</ref>Loosen PHP for the admins, this was done with previous sed command.
@@ Line 25: / Line 26: @@
 sudo chkconfig mysqld on
 sudo chkconfig httpd on
 sudo touch /.autorelabel
 sudo reboot

@@ Line 15: / Line 15: @@
 sudo echo -e "ServerTokens Prod\nServerSignature Off" >> /etc/httpd/conf/httpd.conf
 sudo rm -f /etc/httpd/conf.d/welcome.conf
-sudo sed -i 's/expose_php\ =\ On/expose_php\ =\ off/' /etc/php.ini
+sudo sed -i 's/expose_php\ =\ On/expose_php\ =\ off/; s/upload_max_filesize\ =\ 2M/upload_max_filesize\ =\ 128M/; s/post_max_size\ =\ 8M/post_max_size\ =\ 64M/; s/max_execution_time\ =\ 30/max_execuion_time\ =\ 60/' /etc/php.ini
 </pre>
-*<ref>https://premium.wpmudev.org/blog/increase-memory-limit/</ref>Loosen PHP for the admins. Need to confirm if post and memory sizes really need to be that high (I doubt it)
+*<ref>https://premium.wpmudev.org/blog/increase-memory-limit/</ref>Loosen PHP for the admins, this was done with previous sed command.
-upload_max_filesize = 256M<br>
+upload_max_filesize = 128M<br>
-post_max_size = 128M<br>
+post_max_size = 64M<br>
-memory_limit = 256M<br>
+memory_limit = 128M<br>
 <pre>
 sudo chkconfig fail2ban on