| Warning |
|---|
This approach is not viable. There is a snag with how ACLs work documented in the issues area. Instead, I am going back to a simplified approach which will then make separation of duty achievable by using container technology. What this article and the sub-version 128 is good for, is exploration of ACLs and it's limitations. |
| Table of Contents |
|---|
Introduction
As an application, WordPress is easy to use and feature rich. It has an established community, and in my opinion, the best selection of themes and the most usable blogging cms software package available.
...
- Web Server = Apache
- Application Server = PHP
- Database = MySQL
- OS = Ubuntu
Install Packages
Install the packages to run WordPress,
...
| Note | |||||
|---|---|---|---|---|---|
This article was written and tested against Ubuntu 12.04 which has ACL support built into the kernel. With Ubuntu 12.04, if the ACL packages are not installed the install is straight forward,
Previous versions may be more involved and require modifying the fstab file. |
Setup Directory Structure with ACLs
This security approach works at various levels to contain process and programs to run only within their specified folders and restrict users to their own respective instances of WordPress.
Permission and Group Structure
We want to provide website hosting for two different clients, The Daily Planet and LexCorp. Employees from the respective companies will belong in the system under the following groups, wgdailyplanet and wglexcorp. Here is how the top level structure,
...
Further to this, using normal Unix permissions, all directories will be owned by serveradmin:staff.
web Folder
This is where everything starts for web related work,
...
| Code Block | ||
|---|---|---|
| ||
getfacl --default ./web/ # file: web/ # owner: serveradmin # group: staff user::rwx group::r-x group:www-data:r-x group:staff:r-x mask::r-x other::--- |
php Support Folders
This is where all php code will execute. In php centric applications this will also be considered the web root for static files too and reflected in the virtual host configuration.
Create Folders
PHP requires advanced access to specific folders,
...
The PHP process run under Apache as www-data needs full access to these folder.
Configure PHP to Use Specified Folders
Edit php.ini to make use of the folders.
| Code Block | ||
|---|---|---|
| ||
sudo vi /etc/php5/apache2/php.ini |
Set Running Directory
Search for the open_basedir line and modify to include the directories setup for WordPress,
...
This helps minimizes the amount of damage that can be done in the event that the system is compromised to the specified directory.
Set Temp Directory
Because open_basedir has been set, WordPress no longer has access to the general temporary folder it expects which is required for certain operations (for example to upload plugins through the Administrator web interface).
...
| Code Block |
|---|
; Temporary directory for HTTP uploaded files (will use system default if not ; specified). ; http://php.net/upload-tmp-dir upload_tmp_dir = /opt/web/php/tmp/ |
Make Changes Take Effect
Restart Apache for the changes to take effect,
...
You will now find that php scripts will only run in the designated directories specified in php.ini.
Setup Website Root
Each website will have it's own root folder under /opt/web/php/. To keep things simple we will keep both static and php content inside of this folder.
...
Repeat as needed for each website.
Symbolic Link for Group Accounts
Due to the tight security, the directory listing for /opt/web/ and /opt/web/php/ is restricted. So users will not know about the web root.
...
| Code Block | ||
|---|---|---|
| ||
sudo su - web.master # Log in as web.master cd ~ ln -s /opt/web/php/dailyplanet.com dailyplanet.com ln -s /opt/web/php/lexcorp.com lexcorp.com |
Setup WordPress
WordPress is incredibly easy to setup and there are many shorter tutorials than this.
...
| Warning |
|---|
WordPress out of the box can be very quickly broken into. In fact, I personally go so far as to keep the Ubuntu firewall up with port 80 or 443 closed until WordPress is completely hardened. When the setup steps required using the browser, I use ssh tunnelling to access 80 securely. A writeup of using ssh tunnelling should be added to the Bonsai Framework and linked or included here. |
Apply ACLs to WordPress Folders
Using the serveradmin account, download and decompress WordPress,
...
| Code Block | ||
|---|---|---|
| ||
file: blog/ # owner: serveradmin # group: staff user::rwx group::r-x group:www-data:r-x group:staff:r-x group:wgmainframe:rwx mask::rwx other::--- default:user::rwx default:group::r-x default:group:www-data:r-x default:group:staff:r-x default:group:wgmainframe:rwx default:mask::rwx default:other::--- |
ACLs Do not Work as Thought
| Warning | |||||
|---|---|---|---|---|---|
March 25, 2013 Ok, how about watching a directory and adjusting permissions whenever a file is changed or updated, http://askubuntu.com/questions/43846/how-to-put-a-trigger-on-a-directory March 22, 2013 This IBM article shows how to change the sftp umask for specific groups using 5.4p1 or higher,
BUT, after testing, realized, I cannot use the umask on sftp to change the permission on a file to be less restrictive than the original file. March 19, 2013 OK more bad news, sftp and scp use root's umask. There's is a way to globally set the umask but that's not what I want and causes security issues. This link which talks about chrooting specific sftp groups for no shell access looks promising possibly in concert with PAM. Otherwise I might look at file watchers. March 18, 2013 Evening Finally found the answer and it's ACLs will not work. Per this post which points out that in the man documentation for ACL(5) in the paragraph OBJECT CREATION AND DEFAULT, the access of ACL of a file ojbect is initialized only when create(), mkdir(), mknod(), mkfifo(), or open() functions are used. In other words default ACLs are only applied when using create. Otherwise it will be a XOR of the existing user mask and default acl mask of the user doing the copy, unzip, untarred ect...) followed by the usual calculation done by subtracting the current umask from 0666 for a file and 0777 for a directory. This is why the #effective permission comment appears. March 18, 2013 Morning Found mask of newly created files in the directory are alright. The problem is copying files from another directory where the mask by default is more restrictive. Maybe I need to set sticky bits. Set sticky bits and it did not make a difference. This article explains how ACL permissions are calculated and how to determine what a command like touch or cp does, http://unix.stackexchange.com/questions/56278/can-not-explain-acl-behavior March 17, 2013 Verified his is due to an incorrect mask.... need to run a test but this should work after. March 14, 2013 According to this article the problem is the mask in the ACL. It says the mask for user, group or default shown shows the maximum permissions allowed. Even when set higher the mask downgrades the permissions to what the mask allows. OK so how to change the mask and if say I set the mask to rwx, does that make it too open or does the ACL kick in and overrides? Doing more testing creating new files under ../blog/ as the mf.webmaster user belonging to wgmaingrame, I notice the permissions are not correct. More of the effective problem. Directories seem to be fine though. March 13, 2013 Notice that the mask also changed from r-x to rwx. This might be the key. Actually more test shows a copy of some default created folders and files still has problem and it points to "cp -R" with the "-R" or "-r" both being problems by not respecting ACLs or bringing in the default unix permissions as the problem. |
Further Refine File Permissions
Here are how the file permissions will look,
...
The ACLs ensures that WordPress can install plugins and themes.
Configure MySQL
Secure MySQL
As a staff user run the Secure Installation script included with MySQL,
...
For now that's it to securing MySQL.
Connect
Connect into MySQL,
| Code Block | ||
|---|---|---|
| ||
mysql -u root -p |
...
The remainder of this section happens inside of the mysql shell.
Create the WordPress Database and Accounts in MySQL
List the databases to makes sure what you want to create does not already exists,
...
| Tip |
|---|
Database Admins will not like granting all privileges. After the initial setup is done we will restrict to more minimal privileges. |
Exit MySQL Shell
Exit the MySQL shell,
| Code Block | ||
|---|---|---|
| ||
EXIT |
Configure WordPress
Create Config File for Database Access
Launch a browser and hit the WordPress setup page for your machine at http://dailyplanet.com/blog/wp-admin/install.php and you will be prompted to create a configuration file.
...
Click, "Install WordPress" which should result in a success screen. At this point you are actually done the setup. Do not click "Log In".
Customize WordPress
At this point WordPress is already working. There are two urls to take note of,
...
If you have the Install WordPress Success Screen still up, click "Log In" will take you to the Word Press Administration url or use the url in the table above.
Minimal Security - Block Login Attacks
WordPress out of the box can be easily broken into with a brute force dictionary attack for the following combined reasons,
...
Should have link to how to ssh in to disable plugins if they misbehave.
Set Up Users
The default user created is an administrator and has more privileges than necessary. The very first step is to create users with specific roles provided by WordPress. The roles are outlined below in order of most privileges to least.
...
| Warning |
|---|
Past this point is not yet organized or complete. |
Lock Down WordPress
WordPress and PHP simply due to the model is inherently insecure when compared to more Enterprise solutions.
...
| Warning |
|---|
WordPress updates through the built in admin interface will fail unless the restrictions are relaxed. With this security approach, privileges must be temporarily be granted as part of the upgrade process. |
Restrict WordPress Database Account
Now that WordPress is setup we can lock down the application database account. As part of good application security, the WordPress application database account should only be granted minimal privileges. Note that during upgrades you will have to increases privileges again.
...
| Warning |
|---|
This point onwards still needs to be flushed out. |
File Permissions
From the WordPress article Hardening WordPress we will want to take the approach of creating accounts for select developers or release managers.
...
| Note |
|---|
Covered on the Ubuntu WordPress guide, for automatic updates to occur, the folder and all its files and sub-folders must be owned by www-data with write access. The Bonsai Framework does not endorse this approach. Client administering the WordPress requiring this functionality should understand the security implications. |
...
Writing Next Topics
- Repeat for the second instance.
- Upgrades and Updates
FAQ
Why do some of the php5 installations say to use install libapache2-mod-php5?
...
Nothing I can see. It just looks like php5 is an overarching package name.
References
Setup
Ubuntu Server Documentation - https://help.ubuntu.com/12.04/serverguide/php5.html
Security
Has some ok details around suPHP - https://help.ubuntu.com/community/ApacheMySQLPHP#Installing_MYSQL_with_PHP_5
...