Wordpress Which Wordpress Plugins use / don't use centmin.sh menu option 22

I understand and agree that security is critical. Still, it makes things very inconvenient sometimes when people don't do things the same way as you... A few quick options can make it much easier and save a lot of time for many many people.. Its not a bad thing.

In my experience, having the default options that WP makes available on install (choose username, choose password, no htaccess) is a fair option.

Lately, I find myself migrating many WP sites over to centmin mod based servers. But these migrations require a lot of finesse and tweaking to get going for a server move... Adding in all of these centminmod 'features' makes the process much more cumbersome, as I spend a lot of time undoing all of the security, so I can properly migrate... This is why I prefer to have the option to make things a bit simpler.

---

 

My first suggestion to make wp-login.php password protection optional. Submitted pull request on github. optional wp-login.php password protection by ethanpil · Pull Request #50 · centminmod/centminmod · GitHub

 

Also, I think these questions should default N

Set custom WP Admin Display Name ? [y/N]:
Install Wordpress in subdirectory /blog ? [y/N]:

If I submit a PR to allow custom admin username and pw, will you consider this?

 

I just built a new node with the latest beta and menu option 22 with the new parameters. I selected the option to use Cache Enabler instead of super cache, to try it out.. After the install was complete, nginx failed to start. Looks like an issue with the cache config... see below

Starting nginx (via systemctl): Job for nginx.service failed because the control process exited with error code. See "systemctl status nginx.service" and "journalctl -xe" for details.
[FAILED]
[root@localhost ~]# journalctl -xe
--
-- Unit nginx.service has begun starting up.
Jan 11 23:23:37 -.com nginx[549]: Starting nginx: nginx: [emerg] unknown "cache_enabler_uri" variable
Jan 11 23:23:37 -.com nginx[549]: [FAILED]
Jan 11 23:23:37 -.com systemd[1]: nginx.service: control process exited, code=exited status=1
Jan 11 23:23:37 -.com systemd[1]: Failed to start SYSV: Nginx is an HTTP(S) server, HTTP(S) reverse proxy and IMAP/POP3 proxy server.
​

I also noticed an error in the confirmation email regarding php mailparse module... see below

Gracefully shutting down php-fpm . done
Starting php-fpm [11-Jan-2016 23:21:56] NOTICE: PHP message: PHP Warning: PHP Startup: Unable to load dynamic library '/usr/local/lib/php/extensions/no-debug-non-zts-20121212/mailparse.so' - /usr/local/lib/php/extensions/no-debug-non-zts-20121212/mailparse.so: cannot open shared object file: No such file or directory in Unknown on line 0
done
​

Update:
I deleted the original site that used the Cache Enabler option and then added a new site with the same options except Cache Enabler, and nginx was able to start. So we can confirm its related to the Cache Enabler option. The PHP-FPM error remains.

​

 

The pull was made about an hour before my post. I would guess about 6-8 hours ago. I used the bash command for "latest 1.2.3-eva2000.09 beta" from the readme.md on github. Everything was default settings on a clean Centos 7 install. I only updated the hostname and then ran menu option 22.

I just wiped the VM and pulled again. Its installing now, and I will try once again, and post logs shortly.

 

Just finished the second attempt. Same results. Nginx wont start. Also mailparse Php error.

[root@localhost conf]# cat wpsupercache_testdomain.com.conf

set $cache_uri $request_uri;

if ($request_method = POST) { set $cache_uri 'null cache'; }

if ($query_string != "") { set $cache_uri 'null cache'; }

if ($request_uri ~* "/(\?add-to-cart=|cart|my-account|checkout|addons|wp-admin/.*|xmlrpc\.php|wp-.*\.php|index\.php|feed/|sitemap(_index)?\.xml|[a-z0-9_-]+-sitemap([0-9]+)?\.xml)") { set $cache_uri 'null cache'; }

if ($http_cookie ~* "comment_author|wordpress_[a-f0-9]+|wp-postpass|wordpress_logged_in") { set $cache_uri 'null cache'; }


[root@localhost conf]# cat wpcacheenabler_testdomain.com.conf
set $cache_uri $request_uri;

# bypass cache if POST requests or URLs with a query string
if ($request_method = POST) {
set $cache_uri 'nullcache';
}
if ($query_string != "") {
set $cache_uri 'nullcache';
}

# bypass cache if URLs containing the following strings
if ($request_uri ~* "(/wp-admin/|/xmlrpc.php|/wp-(app|cron|login|register|mail).php|wp-.*.php|/feed/|index.php|wp-comments-popup.php|wp-links-opml.php|wp-locations.php|sitemap(_index)?.xml|[a-z0-9_-]+-sitemap([0-9]+)?.xml)") {
set $cache_uri 'nullcache';
}

# bypass cache if the cookies containing the following strings
if ($http_cookie ~* "comment_author|wordpress_[a-f0-9]+|wp-postpass|wordpress_logged_in") {
set $cache_uri 'nullcache';
}

# custom sub directory e.g. /blog
set $custom_subdir '';

# default html file
set $cache_enabler_uri '${custom_subdir}/wp-content/cache/cache-enabler/${http_host}${cache_uri}index.html';

# webp html file
if ($http_accept ~* "image/webp") {
set $cache_enabler_uri '${custom_subdir}/wp-content/cache/cache-enabler/${http_host}${cache_uri}index-webp.html';
}

​

 

Looks like I have identified the nginx issue, its in the main conf file for the domain. Its applying the wrong cache include file.

/usr/local/nginx/conf/conf.d/testdomain.conf​

We have:

#include /usr/local/nginx/conf/wpcacheenabler_testdomain.com.conf;
include /usr/local/nginx/conf/wpsupercache_testdomain.com.conf;​

I switched it to the following and started nginx successfully:

include /usr/local/nginx/conf/wpcacheenabler_testdomain.com.conf;
#include /usr/local/nginx/conf/wpsupercache_testdomain.com.conf;​

 

Researching the mailparse issue, I found the following in centminmod_1.2.3-eva2000.09_120116-024704_install.log

Code:

installpythonfuct
mailparseinstall
1
Check for php extensions

*************************************************
* Installing mailparse PHP Extension
*************************************************
/svr-setup/csf
cd /svr-setup
inc/mailparse.inc: line 37: cd: mailparse-2.1.6: No such file or directory
Cannot find config.m4.
Make sure that you run '/usr/local/bin/phpize' in the top level source directory of the module

inc/mailparse.inc: line 42: ./configure: No such file or directory
make: *** No targets specified and no makefile found.  Stop.
make: *** No rule to make target `install'.  Stop.
grep: /etc/centminmod/php.d/mailparse.ini: No such file or directory

Copying mailparse.ini > /etc/centminmod/php.d/mailparse.ini

service php-fpm restart
Gracefully shutting down php-fpm . done
Starting php-fpm [12-Jan-2016 03:05:11] NOTICE: PHP message: PHP Warning:  PHP Startup: Unable to load dynamic library '/usr/local/lib/php/extens
ions/no-debug-non-zts-20121212/mailparse.so' - /usr/local/lib/php/extensions/no-debug-non-zts-20121212/mailparse.so: cannot open shared object fi
le: No such file or directory in Unknown on line 0
done
*************************************************
* mailparse PHP installed
*************************************************
imagickinstall

 

wpcacheenabler_testdomain.com.conf

Code:

[root@localhost conf]# cat wpcacheenabler_testdomain.com.conf
set $cache_uri $request_uri;

# bypass cache if POST requests or URLs with a query string
if ($request_method = POST) {
set $cache_uri 'nullcache';
}
if ($query_string != "") {
set $cache_uri 'nullcache';
}

# bypass cache if URLs containing the following strings
if ($request_uri ~* "(/wp-admin/|/xmlrpc.php|/wp-(app|cron|login|register|mail).php|wp-.*.php|/feed/|index.php|wp-comments-popup.php|wp-links-opml.php|wp-locations.php|sitemap(_index)?.xml|[a-z0-9_-]+-sitemap([0-9]+)?.xml)") {
set $cache_uri 'nullcache';
}

# bypass cache if the cookies containing the following strings
if ($http_cookie ~* "comment_author|wordpress_[a-f0-9]+|wp-postpass|wordpress_logged_in") {
set $cache_uri 'nullcache';
}

# custom sub directory e.g. /blog
set $custom_subdir '';

# default html file
set $cache_enabler_uri '${custom_subdir}/wp-content/cache/cache-enabler/${http_host}${cache_uri}index.html';

# webp html file
if ($http_accept ~* "image/webp") {
set $cache_enabler_uri '${custom_subdir}/wp-content/cache/cache-enabler/${http_host}${cache_uri}index-webp.html';
}

The nginx problem is located in /usr/local/nginx/conf/conf.d/testdomain.conf

We have:

Code:

#include /usr/local/nginx/conf/wpcacheenabler_testdomain.com.conf;
include /usr/local/nginx/conf/wpsupercache_testdomain.com.conf;

I switched it to the following and started nginx successfully:

Code:

include /usr/local/nginx/conf/wpcacheenabler_testdomain.com.conf;
#include /usr/local/nginx/conf/wpsupercache_testdomain.com.conf;

 

Just tested once again on a fresh node. Everything as expected this time. Thanks!!

 

Hi, I just tested the WP install from menu 22 (using 123.09beta01 from the status as it was at commit eae3114)

Evething pretty much went fine except for credentials, which WP admin username came with the character "+" in it (both in output and in log).
At first I didn't notice but the provided credentials were rejected. So I tried to remove the "+" and it worked.
Thought it may be usefull to report this here.

I am using Centos 6.7 64bits inside 1G VMware VPS.

As a side note, FWIW, so far so goog regarding ModSecurity installation discussed in this thread (default rules), this including with the defaut WP install.
I haven't tested intensivelly, but I can navigate in the admin, create post or page without any issue with some quick tests (I read before about false positive with modsec in WP admin, none so far here).
On the other hand ModSec properly blocks (= 403 redirection) urls with XSS or SQL injection like content and also blocked a couple of scans amongts those done by a WPScan that I run against the test site.

So it is very early to tell, but first impressions are not bad regarding ModSec.

I hope I don't hijack the thread with this later info, but since I am testing ModSec for some use with WP I thought that might be usefull to report it. Yet I have to go beyound this and test with some more advanced theme and probably a few additionnal plugins that I will use on my actual site.

Also I had many php-fpm segfault reported in logs with default php-5.5.31. I updated to v 5.6.17 and it seems OK now. Not sure why this.

Hope this helps.