{bjørn:johansen}

Section

Posts

85 posts Feed
  1. 2015

    Restrict allowed HTTP methods in Nginx

    Security vulnerabilities are often exploits of software that fails when trying to deal with unexpected input. Other times they are exploits of a misconfiguration or a service that unintentionally was open to the public. For the above reasons, we should limit as much as possible what services are exposed to the public and limit as much as possible what they do and accept from the visitors. To follow those security principles, we should only allow the HTTP methods for which we, in fact, provide services. Under all normal circumstances, that would be the methods `GET`, `POST` and `HEAD`.
  2. 2015

    Block access to PHP files on your WordPress site with Nginx

    In your WordPress site, there are directories that include PHP files that visitors should never be able to access directly. They are only there for WordPress to function as an application that runs on your server. But because of WordPress’ directory and file structure, they are kind of accessible to the public. All of them are meant to be part of a larger application – WordPress, that is – and should not cause any harm if called directly – that we know. Some of the files execute some code even when ran standalone. An attacker might know of a clever way to make that code run in an unexpected manner, causing harm. To be on the safe side, we should deny access to all these PHP files from the outside world. Since we block access to them in our Nginx configuration, PHP will still run them as usual and WordPress will work just fine.
  3. 2015

    Restrict access to the WordPress dashboard by IP address in Nginx

    If you have a static IP address, like from your office, or [your own private VPN](https://www.bjornjohansen.com/setting-up-your-own-pptp-vpn), you can increase your security tremendously by restricting all logins to that IP address. The effect is that even if an attacker knows your login credentials, they will not be able to log in or access any part of the WordPress Dashboard.
  4. 2015

    Redirect all HTTP requests to HTTPS with Nginx

    All login credentials transferred over plain HTTP can easily be sniffed by an MITM attacker, but is is not enough to encrypt the login forms. If you are visiting plain HTTP pages while logged in, your session can be hijacked, and not even [two-factor authentication](https://www.bjornjohansen.com/two-factor-authentication-for-wordpress) will protect you. To protect all info sent between your visitors – which includes you – and your web server, we will redirect all requests that are coming over plain HTTP to the HTTPS equivalent.
  5. 2015

    Strict file ownership for your WordPress installation

    WordPress requires write access to one directory, and that one directory only: the directory returned by `wp_upload_dir()`. By default, this is `/wp-content/upload`, but it can be configured to anything that is beneath your document root, like `/media`, if you want to.
  6. 2015

    Exclude certain requests from the Nginx access log

    Logs are nice and all that, but sometimes certain entries are there just to fill up the logs or are cluttering them. Here’s a few ways to exclude requests – by URL or visitor IP – from the Nginx access log.
  7. 2015

    Configure your local Postfix to relay through a transactional email service

    Using Postfix with specialized, transactional email services like SendGrid or Mandrill is excellent for not only for optimizing email deliverability, but they usually also offer some nice features.
  8. 2015

    Two Factor Authentication for WordPress

    If you’re using a strong password, brute-forcing is a very inefficient way of breaking into your WordPress account, and if it is really strong, dictionary attacks won’t help much either. However, there are are other, easier, ways for a mischievous person to get their hands on your login credentials e.g. with phishing, keyloggers or a MITM attack. By using a two-factor solution, you will increase your login security by an order of magnitude.
  9. 2015

    SSH timeout prevention – keep SSH sessions alive

    SSH timeout due to inactivity is annoying. Here’s how to keep your SSH sessions alive and prevent the SSH timeout:
  10. 2015

    WordPress behind Big-IP

    To be honest, I don’t exactly know too much about Big-IP, but I’ve come across someone who use it. They terminate HTTPS in Big-IP and WordPress runs on plain HTTP on port 80 on the backend nodes. By default, this makes WordPress confused, so you can’t login to the WordPress dashboard.