How to Install Magento Community Edition via FTP or cPanel
How to Install Magento Community Edition via FTP or cPanel How to Install Magento Community Edition via FTP or cPanel how to install magento, how to install ...
Shell Scripting : Linux Tutorial 15
//www.guru99.com This tutorial introduces Shell Scripting.
Sorry that nobody else replied to your comment earlier but type man vi for more info on vi
Top 10 WordPress Security Mistakes
A quick video about the most common misconfigurations and security holes (from a System Administrator's perspective) in WordPress sites (applies to Joomla, ...
+Saurav Gautam Hey, about to start uploading again -- I moved from Europe back to the US, and now I'm traveling around the states for a while before going back to 'real life' :-). Just started recording again a few days ago -- more videos coming soon!
+tutoriaLinux Yes, that would be great. I'm all ears for anything iptables, netstat, malware, keeping the sketchballs out. Not in my house! Thanks for the great work you're doing. (PS, already saw your vids on ssh keys, that helped me a lot. Thanks)
+sporock Thanks, good to know! Right now my job is all about security, so I'll try to come up with a few more clever ideas here. Maybe a tiny malware-analysis video?
Won't the 644 permissions with dave:www-data essentially make it impossible
for Wordpress to update itself anymore? Additionally, won't it also make it
impossible to update to a new version from the dashboard (without the
dreaded FTP info prompt)? I understand where you're coming from here, but
in a way, isn't it making it 'harder' for regular people running their site
to update quickly? Same applies to Plugins - wouldn't this make it
impossible to update plugins from the dashboard?
Don't get me wrong, I would love to be able to lock down the 'owner/group'
of the files like you did, but then I have to manually upgrade each site
instead of taking advantage of the auto-update feature in the latest
versions of Wordpress. I've tried to find a middle ground, but it seems
like it's an either/or proposition - either I change the owner to something
other than what Apache is running as and remove write permission to the
group and gain some security, or use the user Apache is running as and keep
that as a member of the group with write permissions, thus permitting
auto-updates.
If I'm running a single site, then it wouldn't be much of an issue for me,
but when you have 30+ sites, upgrading each site manually and verifying
each one can be a tedious effort. Add plugins into the mix and its a bigger
mess.
Thoughts?
+Eric Bazerghi Good question -- I haven't noticed any issues with WordPress updates using these settings.This is probably because I'm locking down user accounts and then running each site's PHP process in its own pool, running as the owner (in this case 'dave'). When the WordPress update runs (as the PHP user), it has enough permissions to modify site files.I guess the question is how you're running PHP. But you're definitely right in the assessment that you do not, under any circumstances, want to give the web server 'write' permissions to your files (since anonymous users from the Web will be masquerading as this process).