Possible security issue – website defaced
-
Here’s my website:
https://www.infrasupport.comTake a look at “Greg’s Blog” and you’ll find a bunch of posts about computer troubleshooting and IT issues. But a few posts about wigs and prom dresses and other stuff also ended up in my blog. Posted by user “WordPress.”
OK, admittedly, this is partially my fault for having a weak password for user wordpress, “wordpress”. I just fixed that. But the thing is, this is a self hosted website and nobody outside my own subnet can launch wp-admin. So my security should not depend on passwords – nobody outside these walls should even be able to attempt a login. So something else is going on.
I noticed I need to allow POST operations to a file named /usr/share/wordpress/wp-admin/admin-ajax.php to make some plugins and maybe other stuff work. Could somebody be crafting a malicious string and POSTing it here? Somehow, some way, somebody is getting through a first layer of security and making me depend on a password. This makes me nervous.
How do we fix this?
Here is a copy of my infrasupport.conf file:
[root@www conf.d]# more infrasupport.conf ##<VirtualHost www.infrasupport.com:80> <VirtualHost *:80> ServerAdmin [email protected] DocumentRoot /usr/share/wordpress ServerName www.infrasupport.com ## ErrorLog "/usr/share/wordpress/logs/error_log.log" ## CustomLog "/usr/share/wordpress/logs/access_log.log" combined Alias /wordpress /usr/share/wordpress <Directory /usr/share/wordpress> # # Directives to support Permalink settings by post name instead of the default . # See Settings...Permalinks. # <IfModule mod_rewrite.c> RewriteEngine On RewriteBase / RewriteRule ^index\.php$ - [L] RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule . /index.php [L] </IfModule> AllowOverride Options <IfModule mod_authz_core.c> # Apache 2.4 ##Require local Require all granted </IfModule> <IfModule !mod_authz_core.c> # Apache 2.2 Order Deny,Allow Deny from All Allow from 127.0.0.1 Allow from ::1 </IfModule> </Directory> <Directory /usr/share/wordpress/wp-content/plugins/akismet> <FilesMatch "\.(php|txt)$"> Order Deny,Allow Deny from all </FilesMatch> </Directory> # # Need this for the ReallySimple CAPTCHA plugin # <Directory /usr/share/wordpress/wp-content/uploads/wpcf7_captcha> Order deny,allow Deny from all <Files ~ "^[0-9A-Za-z]+\.(jpeg|gif|png)$"> Allow from all </Files> </Directory> <Directory /usr/share/wordpress/wp-admin> ## AllowOverride Options AllowOverride All <IfModule mod_authz_core.c> # Apache 2.4 ##Require local Require ip 10.10.10 ##Require all granted </IfModule> <IfModule !mod_authz_core.c> # Apache 2.2 Order Deny,Allow Deny from All Allow from 127.0.0.1 Allow from ::1 Allow from 10.10.10 </IfModule> <Files "admin-ajax.php"> <IfModule mod_authz_core.c> # Apache 2.4 Require all granted </IfModule> <IfModule !mod_authz_core.c> # Apache 2.2 Order Deny,Allow Allow from All </IfModule> </Files> </Directory> </VirtualHost> [root@www conf.d]#thanks
– Greg Scott
- The topic ‘Possible security issue – website defaced’ is closed to new replies.