Forum Replies Created

Viewing 15 replies - 1 through 15 (of 17 total)
  • Thread Starter ted.byers

    (@tedbyers)

    Thanks a2hostingrj

    Noted. And this led me to a number of additional resources that look useful.

    Have you seen any good references dealing with using WordPress with a site architecture involving a well designed DMZ and vault created using inner and outer firewalls. By this, I mean a discussion, based on practical experience, of how to deploy what in which zone of a secure site that uses, frankly, rather traditional and well established site architectures?

    Thanks again

    Ted

    Thread Starter ted.byers

    (@tedbyers)

    I have to disagree with you. Surely the purpose of especially this forum is to help deal with whatever issue arises in getting any and every part of WordPress to work. To be blunt, I am not looking for instruction on “on web server application configuration and administration”. Rather, although some system administration is necessary, what I am looking for is sufficient information to get all aspects of WordPress to work.

    Right now, the update admin page is not working! That is inexcusable!

    I have sent considerable time, now, ensuring that all the files and directories connected to wordpress have the right owner, and the right group membership, and I have added my sftpwp user to the www-data group. Since all wordpress has been made group writable, that ought to be sufficient to let sftpwp proceed with updating my wordpress installation. And indeed, the latest error that I reported above appears to have been resolved. But the misery continues. Now I get the following error:

    Are you sure you want to do this?

    Please try again.

    What the hell does that mean?

    It gives precisely no information about what failed, or why. The second question is a hyperlink, and I could click on it ’till the cows come home with precisely nothing changing. And the first question is especially annoying because it gives no option for the user to reply ‘YES!’

    I develop software for a living, and if a subordinate developed a module for me that behaved like this, and which was similarly documented, that subordinate would be in serious trouble, at risk of needing to find alternate employment, perhaps as a basket weaver. The failing, in this instance, is in inadequate documentation (I haven’t examined the code, so I can’t comment on the quality of the code, save that error handling in this latest error leaves everything to be desired: yes, in my software, I include a little AI, sufficient to diagnose what may have gone awry and how it may be resolved).

    Cheers

    Ted

    Thread Starter ted.byers

    (@tedbyers)

    UPDATE: Further progress

    I added links (using ln) to place symbolic links in sftpwp’s home directory. Alas, while this gets ride of the error about not being able to find WordPress’ directories (so far – I do not know if it will look for othr directories once I resolve this new problem.), I get a new error, as follows:

    Downloading update from https://downloads.wordpress.org/release/wordpress-3.9.1-partial-0.zip…

    Unpacking the update…

    Could not copy file.: wordpress/wp-admin/includes/update-core.php

    Installation Failed

    How do I proceed now? I have no idea if this is because I restricted sftpwp to only those commands internal to sftp, or to it’s own home directory, or something else.

    I would add that while my issues here are largely administrative, there really ought to be a getting started document for all this. If the person trying to get this set up is a system administrator, he can probably handle anything that may arise while getting this done, but it is decidedly a non-trivial task for anyone who is not an administrator, but rather, a programmer, or worse, a mere user with limited technical knowledge, it is non-trivial at best and a nightmare at worst. Most people I know would just give up. In my view, the ability to easily update is just as important as the ability to easily install it. There is, it seems to me, a pressing need for simple instructions for getting set up for updating, as well as downloading new plugins and themes, &c., whether one is using a hosted solution or installing on localhost (and since SFTP is the most secure option for ftp, according to what I have been reading, focus in such instructions ought to be focused on that, with the sftp user having only those permissions needed to get the job done).

    Thanks

    Ted

    Thread Starter ted.byers

    (@tedbyers)

    Thanks ClaytonJames

    Yes, it is mostly server administration, but taks I would not be trying were I not trying to establish a smoothly operating installation of WordPress.

    After trying to install the ssh2 extension you mentioned, and finding that failing (pecl install couldn’t find a stable release of the ssh2 extension), I found and successfully installed the sftp updater plugin. Alas, I may have an issue with how I configured my sftp user, as I get the following error:

    Unable to locate WordPress Root directory.

    Installation Failed

    After doing that, I did see the appropriate option for using SFTP. (and yes, I was aware tha FTPS and SFTP are different things – I prefer to use SFTP, but will use FTPS if I can’t get SFTP working). In creating my SFTP user, I made a group for SFTP and restricted the membrs of this group to SFTP commands as well as to their own directory tree. I guess the problem becomes how to make a connection between my sftpwp user, which is a member of my new group, it’s home directory, and the wordpress root directory, that it can use. Any idea how I do this? I am hoping this is the final step, as I have the port mapping between my router and this server configured. I really don’t want to open very many ports, lest I make my machine vulnerable.

    Thanks

    Ted

    Thread Starter ted.byers

    (@tedbyers)

    UPDATE: I found how to change the port for VSFTP, but that still laves the problem of how to tell WordPress update to use whatever port I select for the purpose. And, I am troubled that I do not yet know how to place appropriate restrictions on whatever user I create to use vsftp services (and only those services: e.g. I do not want that user to have shell access of acquire enhanced privileges using su/sudo, or to be able to log in using telnet or ssh).

    But the main problem(s) remain as to how to tell WordPress to use SFTP, or what port to use.

    Thanks

    Ted

    Thread Starter ted.byers

    (@tedbyers)

    I do not have cpanel.

    The line that is being un/commenting is:

    define( 'SUBDOMAIN_INSTALL', true );

    That immediately follows the define for WP_ALLOW_MULTISITE, and before that for DOMAIN_CURRENT_SITE.

    I found the error, though. I had somehow missed the following.

    define('MULTISITE', true);

    Adding that makes it all work OK.

    Thanks for your time.

    Ted

    Thread Starter ted.byers

    (@tedbyers)

    You are right. I did neglect to mention my creation of my network.

    Before I began, I did create my network. I forgot, though, to add the ServerAlias value in apache2.conf. That is now done, though, and did not change anything.

    I used dsnmasq to create the wildcard DNS. Those lines are:

    listen-address=127.0.0.1
    address=/.byerspublishing.com/127.0.0.1

    But now, I am not sure that I ought to be using 127.0.0.1 or 1292.168.2.2/3/4/5 (I am not sure of the syntax, and that server has 4 nics).

    Would that be why wordpress an’t access the DB?

    I do notice that if multisite is properly configured, there should be a ‘sites’ item in the menu, and so far, tht item is not present on my system.

    Thanks

    Ted

    Thread Starter ted.byers

    (@tedbyers)

    Yep!

    /*
    define('SUBDOMAIN_INSTALL', true);
    define('DOMAIN_CURRENT_SITE', 'byerspublishing.com');
    define('PATH_CURRENT_SITE', '/');
    define('SITE_ID_CURRENT_SITE', 1);
    define('BLOG_ID_CURRENT_SITE', 1);
    */

    Commenting out the above lines there is no problem with connecting to the database! Now, the question becomes, “WHY, and how is this to be fixed?” What do these defines actually do and how, are they needed for proper subdomain multisite funtionality, and how do we have both database access and these defines?

    Thanks,

    Ted

    Thread Starter ted.byers

    (@tedbyers)

    Actually, the mysql client does not want a space between ‘-p’ and the password.Of course, I checked that. I use that syntax, with and without, the host specification, depending on which database I am accessing, every day.

    There is no doubt that the credentials for the wordpress user are set correctly, as my connection to the database using the mysql client shows.

    It may be a coincidence, but WordPress’ capability to connect broke once I did the configuration to add support for a multisite installation. The line ‘define( ‘WP_ALLOW_MULTISITE’, true );’ did not break connection to the database, but I wonder if the other multisite define statements might have broken it, with the wordpress user connecting only from localhost. Does mysql see the wordpress user connecting from localhost, as it ought, or from some domain from the WWW (as it probably shouldn’t)?

    Thanks

    Ted

    Thread Starter ted.byers

    (@tedbyers)

    OK, here is wp-config.php:

    <?php
    /**
     * The base configurations of the WordPress.
     *
     * This file has the following configurations: MySQL settings, Table Prefix,
     * Secret Keys, WordPress Language, and ABSPATH. You can find more information
     * by visiting {@link http://codex.wordpress.org/Editing_wp-config.php Editing
     * wp-config.php} Codex page. You can get the MySQL settings from your web host.
     *
     * This file is used by the wp-config.php creation script during the
     * installation. You don't have to use the web site, you can just copy this file
     * to "wp-config.php" and fill in the values.
     *
     * @package WordPress
     */
    
    // ** MySQL settings - You can get this info from your web host ** //
    /** The name of the database for WordPress */
    define('DB_NAME', 'wordpress');
    
    /** MySQL database username */
    define('DB_USER', <em>[redacted</em>]);
    
    /** MySQL database password */
    define('DB_PASSWORD', '<em>[redacted</em>]);
    
    /** MySQL hostname */
    define('DB_HOST', 'localhost');
    
    /** Database Charset to use in creating database tables. */
    define('DB_CHARSET', 'utf8');
    
    /** The Database Collate type. Don't change this if in doubt. */
    define('DB_COLLATE', '');
    
    /**#@+
     * Authentication Unique Keys and Salts.
     *
     * Change these to different unique phrases!
     * You can generate these using the {@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service}
     * You can change these at any point in time to invalidate all existing cookies. This will force all users to have to log in again.
     *
     * @since 2.6.0
     */
    
    define('AUTH_KEY',         'Ld99#/|^!*l@4ibWX16-vA.nYxe-/3vvJSUyDGf(2OO!3w+nx/_1Xn ruUA_A.M');
    define('SECURE_AUTH_KEY',  '|>]9wNZVC =6v0uxC^*})d+[msd1=ixuy~x6w};3 9T:+3}Cf49)O:0~WIZ)63sK');
    define('LOGGED_IN_KEY',    '[B<s*Ut)cPA-+SY)iYyRU^=a9S>K*qe9-Zk5]TO&-uHL6AV 8{|%ur>lap^9zGd');
    define('NONCE_KEY',        '-:!#%XedZ,(#/{AK:Oc{x<+7ddN ~;=/j,|-w[]UqB<fZ:.4N}&23 xA@euhCi1~');
    define('AUTH_SALT',        'Ev].<QXr#QLo;-WG1o%n?mg(JDc|$)kRB]#ir|h|.T};K|:s{tCo.+Ke%lXl3/H');
    define('SECURE_AUTH_SALT', 'h +(!--A6]|.pxGQ#MP
    
    Eqf!Y.mO@U+/A#Vj<k]K((>I/r/QWHma3o-G|-$l>8+9');
    define('LOGGED_IN_SALT',   '<x<J>8S:Mrua-|AeSh&HeRk!R%9>Yio]oUq+R)(WT9/K#er@(+!fQ{@x@UT=7WUs');
    define('NONCE_SALT',       '0i|SF<gpr{ AZ/B2H^BR1i_k~]5K=vAOS{~2cTHq:hgnjHQDoS q{iL~8lTfyk(');
    
    /**#@-*/
    
    /**
     * WordPress Database Table prefix.
     *
     * You can have multiple installations in one database if you give each a unique
     * prefix. Only numbers, letters, and underscores please!
     */
    $table_prefix  = 'wp_';
    
    /**
     * WordPress Localized Language, defaults to English.
     *
     * Change this to localize WordPress. A corresponding MO file for the chosen
     * language must be installed to wp-content/languages. For example, install
     * de_DE.mo to wp-content/languages and set WPLANG to 'de_DE' to enable German
     * language support.
     */
    define('WPLANG', '');
    
    /**
     * For developers: WordPress debugging mode.
     *
     * Change this to true to enable the display of notices during development.
     * It is strongly recommended that plugin and theme developers use WP_DEBUG
     * in their development environments.
     */
    define('WP_DEBUG', false);
    
    /* Multisite */
    define( 'WP_ALLOW_MULTISITE', true );
    define('SUBDOMAIN_INSTALL', true);
    define('DOMAIN_CURRENT_SITE', 'byerspublishing.com');
    define('PATH_CURRENT_SITE', '/');
    define('SITE_ID_CURRENT_SITE', 1);
    define('BLOG_ID_CURRENT_SITE', 1);
    
    /* That's all, stop editing! Happy blogging. */
    
    /** Absolute path to the WordPress directory. */
    if ( !defined('ABSPATH') )
    	define('ABSPATH', dirname(__FILE__) . '/');
    
    /** Sets up WordPress vars and included files. */
    require_once(ABSPATH . 'wp-settings.php');

    And heree is my latest session, showing that the credentials entered into wp-config.php are correct and working:

    ted@Ubuntu-Server:~$ mysql -u wordpress -pDidr39Qcab wordpress
    Reading table information for completion of table and column names
    You can turn off this feature to get a quicker startup with -A
    
    Welcome to the MySQL monitor.  Commands end with ; or \g.
    Your MySQL connection id is 59
    Server version: 5.5.35-0ubuntu0.12.04.2 (Ubuntu)
    
    Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.
    
    Oracle is a registered trademark of Oracle Corporation and/or its
    affiliates. Other names may be trademarks of their respective
    owners.
    
    Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
    
    mysql> exit
    Bye
    ted@Ubuntu-Server:~$

    So, no, the database details have not been changed.

    What else can/should be checked?

    Thanks

    Ted

    PS: I suppose I will need to change the user name and password, having posted this. Right?

    Thread Starter ted.byers

    (@tedbyers)

    Yes, I know that, but that can not be the case here, because the data for the database are correct, and in fat have not been changed since before I installed WordPress in the first place. And, during the initial installation, it had no problem connecting to the database. So, what else can cause this kind of failure?

    Thanks

    Ted

    Thread Starter ted.byers

    (@tedbyers)

    Thanks Senff. That was it.

    Alas, fixing that reveals another problem. I now get a new error, now: “Error establishing a database connection“. What makes this more odd is that there is no coresponding error in either the apache2 logs nor the MySQL logs. Further adding to the weirdness is that I can connect to the wordpress DB user/schema using the credentials I have in my wp-config.php file. So, what could possibly cause problem establishing a database connection when the database is up and running, and the credentials wordpress is configured to use work fine, in the mysql client? The wordpress installation script had no problem establushing a connection, to create all those tables that it did.

    How do I force it to give me more detail as to why it couldn’t connect, and how do I fix it?

    Thanks

    Ted

    Thread Starter ted.byers

    (@tedbyers)

    Thanks for the feedback jkhongusc

    Alas, you slightly misread what I wrote. I said I had studied the five minute install. I thus knew very well that it is for a single instance WP as well as why I went looing for the multisite information. I did not say that that had failed. Rather, when I went beyond it to the multisite install, and had edited the wp-config.php file, as directed, at first it seemed to have worked, but the network tool told me that the server name was localhost and that therefore I was restricted to the path variant of the multisite install. All my attempts subsequently were focussed on resolving that (and as I said, I began each new attempt with a clean install).

    I gave no specific errors because WP did not give me any. All I had to go on was apparent misbehaviour. The latest of which involved the install.php being loaded but not doing anything.

    BTW: I see an option that will give me a limited variant of my final goal. I have another server, and can set up that server (which has but a single NIC that is connected), and can configure that to act as a proxy, sending each domain I want to a different private IP address (which leaves me at 4 possible domanins), and configure the multiple HTTPS virtual hosts to their own private IP address). I would expect that WP should work fine when routed through a proxy. Right? That ought to be no different from another production system that has been working fine (with my own web app), in which the server has multiple NICs, with private IPs, and the router (which has multiple public IP addresses) sends requests on each public IP to its own private IP on the server (and my app rebrands itself depending on the domain to which the request was sent – obviously each public address the router has is connected to a different domain). This other system has been working flawlessly like this for a couple years now. WP is the first web app written by someone other than me that I have tried working with (and it is especially strange as I usually do my web programming either in Java (using JSP/JSF or Perl – PHP is familiar because of it’s similarity to Perl, but also something I haven’t tried programming with).

    Thanks

    Ted

    Thread Starter ted.byers

    (@tedbyers)

    Actually, it seems it gets more complicated, as I found http://codex.wordpress.org/Hardening_WordPress and it talks about group ownership, and that I hould retain ownership of some selection of the WordPress files. While the basic concepts are clear enough, it is looking more complex if one wants to be sure the wole site is as secure as it can be made. I don’t understand the documentation for chown and chmd well enough to be able to see how to follow the directions provided on the Hardening Wordpess page when it comes to file permissions, and still have the update work properly. A little extra guidance is needed.

    Thanks

    Ted

    Thread Starter ted.byers

    (@tedbyers)

    OK, good so far, but how do I find out what the user name is that the web server operates under (is thee a command I can issue in a terminal that will tell me)? The WordPress says the owner is usually the ftp user that uploade the files, but I didn’t use ftp. I used wget in my own account. So, I guess I am the owner of all the wordpress files in my Downloads directory. How, then, would I give ownership of WordPress files to the use that apache runs under (after I find out what that user name is), and which files? Certainly not all, right? Or is it safe to give ownership of all the files in the WordPress distribution to the web server user? And, then, how do I ensure that in trying to get this done, I do not open up security vulnerabilities (more likely by mistake as I am a programmer, not a system administrator).

    Might I suggest adding a couple lines to the documentation, both for the install and for the upgrade, to show the commands (specific to Linux as I doubt Windows is so picky/secure) to do it right while keeping the system/webapp as secure as is practicable. (In the past two weeks, I have been told by colleagues of their WordPress systems having been hacked; though in one case, it was apparently so bad that it is more likely that the server was hacked, and the WordPress files getting mangled after the hacker got root access). Hence my concern to be sure to get it done right.

    Thanks

    Ted

Viewing 15 replies - 1 through 15 (of 17 total)