| | 2 | |
| | 3 | == Control Panel Installation == |
| | 4 | |
| | 5 | Enable control panel installation of WordPress and Drupal via control panel. This step helps us keep track of which sites are running Drupal and WordPress so we can properly upgrade them and check them for compromises. |
| | 6 | |
| | 7 | We currently allow for Drupal 7 installation via the Control panel, but not Drupal 8 (see #11601) |
| | 8 | |
| | 9 | WordPress is almost ready ( ) |
| | 10 | |
| | 11 | == General web app maintenance == |
| | 12 | |
| | 13 | The script `mf-check-web-app` automates the maintenance of Drupal and WordPress sites on our servers. |
| | 14 | |
| | 15 | Usage is: |
| | 16 | |
| | 17 | {{{ |
| | 18 | Usage |
| | 19 | |
| | 20 | /usr/local/bin/mf-check-web-app --path [PATH] --action [ACTION] --quiet |
| | 21 | |
| | 22 | PATH |
| | 23 | |
| | 24 | auto - check all directories on the server based on web-app-security directory files |
| | 25 | otherwise, only check the single path provided |
| | 26 | default is current working directory |
| | 27 | |
| | 28 | ACTION |
| | 29 | |
| | 30 | integrity - check file integrity |
| | 31 | core - means upgrade just core |
| | 32 | plugins - upgrade just third party plugins, modules and themes |
| | 33 | auto - do whatever is defined in the web-app-security directory |
| | 34 | default is integrity |
| | 35 | |
| | 36 | QUIET |
| | 37 | |
| | 38 | Output nothing. Check logs. |
| | 39 | }}} |
| | 40 | |
| | 41 | It lives in /usr/local/bin and can be run as root (in which case it drops privileges to the owner of the Drupal or Wordpress site) or as the user that owns the site. |
| | 42 | |
| | 43 | The default action (when run with no arguments) is to run an integrity check on the current workding directory. |
| | 44 | |
| | 45 | When operating in "auto" mode, it finds web apps by searching for the files `/home/members/*/sites/*/.red/web-app-security/{drupal,wordpress}-{core,plugins,integrity}`. |
| | 46 | |
| | 47 | If it finds files, it runs according to the file included. |
| 7 | | The monitor script mf-monitor-webapps executes the script mf-check-webapps and triggers a Nagios warning if it finds any web app sites that fail the test. |
| 8 | | |
| 9 | | == Search server for compromised sites == |
| 10 | | |
| 11 | | The script `mf-check-webapps` searches the given server for any web app that has been compromised. |
| 12 | | |
| 13 | | It finds web apps by searching for the files `/home/members/*/sites/*/.red/web-app-security/{drupal,wordpress}-core`. |
| 14 | | |
| 15 | | If it finds either file, it runs a check to see if the specified web app has been compromised. |
| 16 | | |
| 17 | | In normal mode, it outputs each site that has checked and the status of the site. In quiet mode, this output is supressed. |
| 18 | | |
| 19 | | Once the run is complete, it either: |
| 20 | | |
| 21 | | * Returns no output and the exit code 0 to indicate that no sites show signs of compromise |
| 22 | | * One line with a comma separate list of site names that are compromised and the exit code 1 to indicate a compromise |
| 23 | | * Error output and the exit code 255 to indicate an error prevented the script from running properly. |
| 24 | | |
| 25 | | == Control Panel Installation == |
| 26 | | |
| 27 | | Enable control panel installation of WordPress and Drupal via control panel. |
| | 53 | In process, see #13159. |
