Howto Install WordPress 4 on Centos Linux 6

WordPress in a PHP based content management system licensed under GPL v2. Since it has been around for a long time, there are many forums, blogs and video to help users and developers.

Functions:

1. Create web pages without needing to know HTML
2. Provide blog tools
3. Themes to quickly create different look and feel
4. Plugins to extend its functionalities
5. Mobile ready site
6. Provide multiple authors to manage their own contents.

WordPress 4.3 has just been released and here is a guide to install on Centos 6.4

Pre-installation recommendation
PHP 5.4 (works on 5.3.3)
MySQL 5.5 (works on 5.1)
mod_rewrite in Apache module
Bind-utils (works on 9.8.2)

Step 1: Obtain WordPress

Open a terminal and download the WordPress installation file.

$ wget --no-check-certificate https://wordpress.org/latest.tar.gz
$ tar xvzf latest.tar.gz
$ ls wordpress

Copy the whole folder to the web server directory. Example if the web server runs with permission for user apache.
$ mkdir /var/www/html/wp1
$ cp -r wordpress/* /var/www/html/wp1
$ chown -R apache.apache /var/www/html/wp1

Read the readme.html file with a web browser.

Step 2: Configure MySQL and create wp-config.php

Create the database wp1 in MySQL
$ mysql -u root -p
> create database wp1;
> /q

Open a web browser with URL to the installed page of WordPress.

http://servername/wp/
or
http://servername/wp/wp-admin/install

Fill the fields and click Submit.

Click Run the Install.

Fill the 5-minutes WordPress Install information

• Site Title
• Username
• Password
• Confirm password
• Your E-mail
• Privacy

Click Install WordPress.

Click Log In.

Enter the admin username and password.

View the admin user's dashboard.

Restart apache web server.
$ sudo service httpd restart

Step 3: View the site

Enter in the web browser URL

http://servername/wp1

The default left panel list;

1. Site name
2. Search tool
3. Recent post
4. Recent comments
5. Archives
6. Categories
7. Meta (Site Admin, Logout, Entries RSS, Comments RSS, WordPress.org)

Troubleshoot

Problem 1: When choosing to add a new theme, the following error is displayed.
"unexpected error occurred. Something may be wrong with WordPress.org or this server’s configuration. If you continue to have problems, please try the support forums."

Solution: Ensure the server can connect to https://downloads.wordpress.org site. Restart Apache web server.

Problem 2: Pages are blank, and there are no error or warning messages.

Solution: Turn on the debug by changing the value false to true in /var/www/html/wp1/wp-config.php

define('WP_DEBUG', true);

Done.

Howto Install Joomla 3 on MS Windows 8

Content Management Systems (CMS) provides a simple framework to focus on developing a web site to deliver specific contents. Basic stuff like user authentication, layout and web standards will be handled by the CMS while more important stuffs like getting the message across and providing a specific service can be the main focus.

Yes, gain insights of experts and community around the world by using a CMS like Joomla! that practices use of open source software (OSS) license.

Installation was done based on notes from docs.joomla.org at https://docs.joomla.org/Use_Joomla!_on_your_own_computer

Following are my notes on installation of Joomla! 3.3.6 on Windows 8. Before going to step 1, ensure the web server has;

Apache 2.4
PHP 5.4 (min 5.3.10), enable following PHP modules

• Magic Quotes GPC Off
• Register Globals Off   
• Zlib Compression Support 
• XML Support   
• Database Support: (mysql, mysqli, pdo)  
• MB Language is Default 
• MB String Overload Off  
• INI Parser Support    
• JSON Support  
• configuration.php Writeable

MySQL 5.5

Step 1: Getting Joomla!

Download Joomla! from http://www.joomla.org/download.html and extract it to a folder, e.g. myjoomla.
Copy this to your web folder. e.g. C:\apache24htdocs

Step 2: Preparation

Create a MySQL database called myjoomla3. Login to MySQL client and type;

CREATE database myjoomla3;

 And logout.

Step 3: Installation

Open a web browser and enter URL Address. E.g. http://localhost/myjoomla and enter details. Complete the sections for "Configuration", "Database", "Overview".

Configuration

I choose to create the default Administrator username as "admin".



Database
Ensure the configuration for database created is entered correctly. Choose MYSQLi if you are prompted to do so.

Overview
Choose Install Sample Data: Default English (GB) Sample Data

Click "Install". When installation is completed, you will receive the confirmation message "Congratulations! Joomla! is now installed."

Open Windows Explorer and remove the installation folder in joomla named installation. E.g. C:\Apache24\htdocs\myjoomla\installation

Step 4: Post installation

Test the installation with a web browser as;

1.  front-end page  at http://localhost/myjoomla/
2.  site administration page  at http://localhost/myjoomla/administrator/

First access: Front-end on desktop

First access: Front-end on mobile

First access:Administration page

Step 5: Choosing a template

This is an extra step for looks. In a web browser open the Administration page, e.g. http://localhost/myjoomla/administrator

In the default Administration page, observer the left column and click "Template Manager". In the left menu choose "Styles". There are 4 styles available for you;

1. Beez3 (for Front-end)
2. Hathor (for Administration page)
3. isis (Default for Administration page)
4. protostar (Default for Front-end)

 Try to click on Hathor, notice the page has changed. Click Beez3, and in Front-end see the changes.


Done.

Installing Plone 4 on Centos 6

Plone 4 is based on Python and Zope and provides its own little database.

Installation on Centos 6.3 was pretty straight forward in the standalone mode. Alternative, mode is as ZEO Cluster or a single running instance.

Step 1: Download the Unified installer (comes with Python and Zope) for Plone.

Download from Plone.org (https://launchpad.net/plone/4.2/4.2.1/+download/Plone-4.2.1-UnifiedInstaller.tgz) with a file size of approx 50MB.

See http://plone.org/products/plone/releases/4.2.1

Step 2: Install dependency files.
Most of these are already installed if Centos was installed with the development tools.
Add the RPMForge repo;

wget http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.2-2.el6.rf.i686.rpm
rpm -ivh rpmforge-release-0.5.2-2.el6.rf.i686.rpm

yum install gcc gcc-g++ make tar bzip2 gzip
yum install readline libgsf
yum install wv

If there is problem with the wv package, download wv from EPEL or http://wvware.sourceforge.net and install with RPM.

rpm -ivh wv-1.2.7-2.el6.i686.rpm


Step 3: Extract & Install Plone
Enter the directory with the UnifiedInstaller (Download directory).

tar zxvf Plone-4.2.1-UnifiedInstaller.tar.gz
cd plone-4.2.1
./install.sh standalone
cd /usr/local/Plone/zinstance

Identify which port (default 8080) will be used for Plone. If needed, change the port then apply changes by typing

bin/buildout

Step 4: Start/Stop Plone
The Plone server can be started or stop with following command (replace the word start)

/usr/local/Plone/zinstance/bin/plonectl start

Step 5: Access Plone
Open a web browser (e.g. Firefox, Chrome) and enter following URL address;

http://localhost:8080

Default password is found in the file /usr/local/Plone/zinstance/adminPassword.txt

Create a Plone instance, then read the instructions at the main page of the Plone instance.

Additional notes:
Install following packages;

• Openoffice.org or libreoffice (headless) for better document conversion
• msttcorefonts for better formatting compatibility, see previous post. 

References: http://plone.org/documentation/manual/installing-plone/installing-on-linux-unix-bsd/referencemanual-all-pages

Linux security checklist

The Anonymous is announcing an attack on www.malaysia.gov.my, which is a central portal to reach all other Malaysian Government portals. This is reported by F-Secure Corporation and theStar, 14 Jun 2011. Makes you wonder why Anonymous would want to do that.

Follow up from my previous post, I realise that many Linux Admins out there do not have a Security Checklist for their web application. I am sharing the following checklist here as it provides a standard security consideration for almost all web application on Linux or LAMP stack. It is by no means the only security guide, please apply all other security concerns specific to your needs and you can then sleep better at night.

Check List for Web Application (deployment)

Category	Item	Notes
Logins
A.1	Operating system -Administrator password is secured and recorded as only accessible by ONE administrator -All login's are done as normal user -Normal users with access to Administrator priviledges are recorded. Access should be via SUDO. -All logins are recorded
A.2	Application -All users to have secured logins -Administrator logins are assigned to specific individuals and listed -Web based self registered user must have email and spam prevention facilities -Lock down on Web server's user/application access -Default access and password for all administrator applications must be secured. This includes the main application, phpmyadmin, firewall.
A.3	Database -Each application to have a specific user and password access. This user cannot access other databases. -Administrator access is with secured password. Assignment to specific individuals must be recorded.
Services
B.1	Disable unnecassary services -Firewalls must be enabled to restrict external access to only the approved application (via port numbers). -Identify every services running. Disable those not in use. -Remote access must be via encrypted protocols -Disable local email server (e.g. sendmail) from runnin/listening continuously. Or use external email server. -Email servers controlled to allow access to specific application and directories. -Anti-virus if implemented, must have patches and pattern updates kept to the most recent.
B.2	Create a base point of security -A penetration test must be carried out. The type and complexity is based on the specific application. -Establish an integrity check point
B.3	Tell them you do not allow access -Place warning messages to all points of access. E.g. motd and issue.net
B.4	Logging -Log activities to separate files for operating system and application. -Make logs available to a centralised log server.
B.5	Backup -Establish a backup plan. -Implement a backup process
B.6	Create a boot disk and rescue of the Linux
B.7	System updates -Disable the automatic system updates. Updates should be installed only after it is verfied working with the application. -Periodically check with security issues, respective application security notices and update as needed.
Physical
C.1	Physical Access -Ensure only authorised personel can access to the server. -A record of physical access is maintained.
C.2	Storage Media -All storage media is tagged. -Storage location and transportation is secure and recorded.
C.3	Security Policy -Ensure the document is readily available to authorised users.

Checklist for Web Application (Deployment) by Nicholas A. Suppiah is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License.
Permissions beyond the scope of this license may be available at http://www.blogger.com/profile/06749525177696246387.

A CMS called Drupal

Content Management Systems (CMS) like Drupal have been popular as it provided a relatively powerful framework for customisation. As Drupal is upgraded, the user customised modules are protected to ensure that it can continue to work. Currently many CMS administrators fear upgrading their CMS as things will break due to extensive customisations.

Drupal version 5.x and 6.x currently supports PHP 5.2. This provides better security and performance. Did I mention performance? Currently due to Drupal modularity, it can be tweak for performance to the max. This depends on the web server, PHP and MySQL settings. By default, non registered visitors use Drupal cached pages which reduces load on Drupal.
See a typo3, Joomla and Drupal and part II comparison.

Drupal provides regular security updates at http://drupal.org/security and through mailing list.

Following are general precautions on installation of CMS, refer to http://tboxmy.blogspot.com/2008/08/cms-called-joomla.html
Additional precautions you can take:

Use only modules that is proven secure. Drupal security problems revolve mostly on poorly written additional modules.

Example of vulnerability:
Plugin Manager - Access Bypass, allowed any user to uninstall and remove modules.
Mail handler - SQL injection, allowed malicious users to gain administrator access.

A CMS called Plone

Plone is a content management system using Zope application server. Just like any other popular application, it is prone to hacker attack. There is lesser exploits compared to PHP based CMS,

Example of pre Plone 3.1 security issue is the
Cross Site Request Forging (CSRF) security vulnerability where CSRF attacks work against people with a valid session on a Plone site: an attacker can — by tricking them (or their browser) to make an HTTP request to the site — use their active session and change security sensitive settings such as the users email address.

Following are general precautions on installation of CMS, refer to http://tboxmy.blogspot.com/2008/08/cms-called-joomla.html
Additional precautions you can take:

1. Keep Python updated.
   

Examples of vulnerability:
Password reset vulnerability, Plone tools did not have proper security checks for its password reset method, allowing anonymous users to reset any users password through the web. (affects pre 2.5)
plone-group-spoofing, Plone could allow a remote attacker to spoof certain information, caused by an unspecified vulnerability in member registration. If anonymous users can register as a member, a remote attacker could exploit this vulnerability and falsely register as a group. (Affects 2.5.1)
Plone CMS cookie places a base64 encoded form of the username and password in the __ac cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network. (Affect pre 2.5)

A CMS called Joomla

Joomla! is a widely used content management system using PHP and its frameworks. However due to its large user base, hackers have been attracted like bees to honey.

Example of pre Joomla! 1.5.6 security issue is the
Joomla "token" Password Change Vulnerability where the admin password could be reset easily. Users can then install the Joomla explorer component, and upload malicious scripts.

Following are some precautions on installation of Joomla!

1. Patch the OS and its other software
   
1. Open only needed ports (HTTP, HTTPS)
2. Patch the software
3. Configure the software in a secure manner
2. Verify that Joomla! is from the official site http://www.joomla.org
3. During installation - Do not use the default MySQL tables prefix as jos_
   
4. Change the default administrator name (default is admin)
5. Remove all files as instructed by Joomla! And other unneeded files or directories
6. Ensure files and directories have the proper permissions. Below are for Linux based systems.
   
1. PHP files: 644
2. Config files: 666
3. Other folders: 755
   
7. Password protect sensitive directories with .htaccess
8. Move the configuration.php file to outside of the web directory if possible. Make it non-writable.
9. Use a search engine friendly (SEF) URLs
   

1. The Google inurl: command can be used to search for a vulnerable exploit. Use Artio, SH404SEF or another SEF component to re-write your URLs. This will prevent hackers from finding the exploits.

10. Establish a security plan and ensure the relevant parties know about it.
11. Remove unused extensions and themes. Existing extensions and themes should have their version removed from the end user view.
    
12. Subscribe to Joomla! and the extensions/themes sites for continuous updates. Additional sites that can help with updates:
1. http://joomla-wiki.de/doku.php?id=howto_s:security:checklist
2. http://docs.joomla.org/Joomla_Administrators_Security_Checklist
   
13. Subscribe to security sites such as http://www.ictsecurity.gov.my/
14. Carryout routine backup of Joomla! Site and its database.

Using Apache Benchmarking tools
One good reason to use Apache web server is the availability of a benchmarking tool. There are some constrains that you should know in using this data. Read the documentations. Install Apache and execute as below:
ab -n7500 -c100 http://server.com

Where
-n option is the number of request for benchmark
-c is the number of concurrent page request

===========
Document Path: /
Document Length: 36649 bytes

Concurrency Level: 100
Time taken for tests: 183.819035 seconds
Complete requests: 500
Failed requests: 383
(Connect: 0, Length: 383, Exceptions: 0)
Write errors: 0
Total transferred: 6472586 bytes
HTML transferred: 6260026 bytes
Requests per second: 2.72 [#/sec] (mean)
Time per request: 36763.806 [ms] (mean)
Time per request: 367.638 [ms] (mean, across all concurrent requests)
Transfer rate: 34.38 [Kbytes/sec] received

Connection Times (ms)
min mean[+/-sd] median max
Connect: 0 1446 4324.4 0 21000
Processing: 47 23707 49002.2 1897 175812
Waiting: 47 21936 45081.7 1897 173650
Total: 47 25153 49793.2 2214 183816

Percentage of the requests served within a certain time (ms)
50% 2214
66% 6756
75% 10461
80% 27527
90% 132227
95% 151803
98% 175812
99% 181539
100% 183816 (longest request)
=== END ====

Other references:
For discussion on application security see https://nvd.nist.gov/cwe.cfm#NVD-CWE-DesignError.

My advice to those considering other CMS is this;
All CMS will have their weak points. However Joomla! have thus far been prompt with security notices and updates. Hackers tend to crawl the webs on Friday to Sundays, when systems are unattended. As the care taker of the Joomla! you need to be proactive, it goes the same for any other CMS. Finally, Joomla! is easy to use for end-users and provides lots of features for beautifications.