Wordpress designer needed for redo of drupal website that got hacked.

Discussion:

Rich Ernst

2018-09-20 22:18:45 UTC

Any recommendations for someone familiar with Wordpress to recreate a
site for a non-profit who's drupal site got hacked (wasn't being
updated, you know how it goes with volunteers). Here's the current
site, basically want to recreate in something simpler like Wordpress.

http://sdscholars.org/ Apparently registered/hosted with enom.com

Rich

--
KPLUG-***@kernel-panic.org
http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list

Tracy Reed

2018-09-21 08:31:17 UTC

Permalink

I don't have anyone to recommend but I would question the idea of
Wordpress being simpler. It certainly is not any more secure or less in
need of update.

My rules for running Wordpress without getting pwned:

1. Stay patched up: Login to the admin page at least weekly to monitor
for updates since it tells you when updates are available and has
one-click upgrade there.

2. Use SELinux in enforcing mode and monitor for denials (you will have
to setenforce 0 to do the previously mentioned upgrade, don't forget
to setenforce 1 afterwards).

3. Configure apache to block access to certain potentially harmful
things from anyone except the admin:

<Location ~ "/(wp-login.php|wp-admin|xmlrpc.php)">
Order Allow,Deny
Deny from all
Allow from 192.168.12.0/24
Allow from 10.0.0.0/8
Allow from 98.171.210.130/32
Allow from 155.143.35.194/32
</Location>

4. Be absolutely fascist about avoiding plugins. They are generally
written with less care than the Wordpress codebase itself and are a
frequent source of vulnerabilities.

https://blog.malwarebytes.com/threat-analysis/2018/09/mass-wordpress-compromises-tech-support-scams/

Post by Rich Ernst
Any recommendations for someone familiar with Wordpress to recreate a
site for a non-profit who's drupal site got hacked (wasn't being
updated, you know how it goes with volunteers). Here's the current
site, basically want to recreate in something simpler like Wordpress.
http://sdscholars.org/ Apparently registered/hosted with enom.com
Rich
--
http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list

--
Tracy Reed
http://tracyreed.org
Digital signature attached for your safety.

Tony Su

2018-09-24 03:41:28 UTC

Permalink

Agree,
I don't consider Wordpress any safer or less vulnerable than Drupal,
The only diff is that only recently Drupal had that nasty vulnerability.
But, if you look at Wordpress historically, you'll see plenty of
similar incidents, and especially for individual Wordpress plugins.

You should instead take a look at whether the overall design requires
a CMS like Drupal or Wrodpress, and select a re-architecture that
minimizes your attack surface.

Tony

Post by Tracy Reed
I don't have anyone to recommend but I would question the idea of
Wordpress being simpler. It certainly is not any more secure or less in
need of update.
1. Stay patched up: Login to the admin page at least weekly to monitor
for updates since it tells you when updates are available and has
one-click upgrade there.
2. Use SELinux in enforcing mode and monitor for denials (you will have
to setenforce 0 to do the previously mentioned upgrade, don't forget
to setenforce 1 afterwards).
3. Configure apache to block access to certain potentially harmful
<Location ~ "/(wp-login.php|wp-admin|xmlrpc.php)">
Order Allow,Deny
Deny from all
Allow from 192.168.12.0/24
Allow from 10.0.0.0/8
Allow from 98.171.210.130/32
Allow from 155.143.35.194/32
</Location>
4. Be absolutely fascist about avoiding plugins. They are generally
written with less care than the Wordpress codebase itself and are a
frequent source of vulnerabilities.
https://blog.malwarebytes.com/threat-analysis/2018/09/mass-wordpress-compromises-tech-support-scams/

--
Tracy Reed
http://tracyreed.org
Digital signature attached for your safety.
--
http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list

--
KPLUG-***@kernel-panic.org
http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list

Rich Ernst

2018-09-24 03:47:54 UTC

Permalink

What we're looking for is something as simple as possible implementing
the info on current site. Static pages are fine. Need to be able to
update parts of page relative to current month/topic/speaker, and keep
and allow upload of current "newsletter/notes".

http://www.sdscholars.org/

Rich

Post by Tony Su
Agree,
I don't consider Wordpress any safer or less vulnerable than Drupal,
The only diff is that only recently Drupal had that nasty vulnerability.
But, if you look at Wordpress historically, you'll see plenty of
similar incidents, and especially for individual Wordpress plugins.
You should instead take a look at whether the overall design requires
a CMS like Drupal or Wrodpress, and select a re-architecture that
minimizes your attack surface.
Tony

--
Tracy Reed
http://tracyreed.org
Digital signature attached for your safety.
--
http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list

--
http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list

--
KPLUG-***@kernel-panic.org
http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list

Néstor

2018-09-24 04:25:51 UTC

Permalink

Rich,

Your website design looks very simple but I might be wrong.

If you get WP designer you also have to migrate all of the data to WP.
Is that an easy process? (I have never worked with WP)

Did you consider migrating to Drupal 8?
You need to check to see if the Drupal modules you are using, are
available on the latest D8 and if they are then you can migrate your site.
If your Drupal site is D6 or D7 then D8 has migration modules that makes it
easier to do the migration.

D8 is much more secure because it uses Symfony. You also can sign up to
receive Drupal security emails that will let you know if you need to update
a module.

Néstor

Post by Rich Ernst
What we're looking for is something as simple as possible implementing
the info on current site. Static pages are fine. Need to be able to
update parts of page relative to current month/topic/speaker, and keep
and allow upload of current "newsletter/notes".
http://www.sdscholars.org/
Rich

https://blog.malwarebytes.com/threat-analysis/2018/09/mass-wordpress-compromises-tech-support-scams/

Post by Tony Su

Post by Tracy Reed

--
Tracy Reed
http://tracyreed.org
Digital signature attached for your safety.
--
http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list

--
http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list

--
KPLUG-***@kernel-panic.org
http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list

Tracy Reed

2018-09-24 10:12:31 UTC

Permalink

Also:

Some sort of system hardening if at all possible like following the CIS
or RHEL hardening guide.

Don't forget to do backups. Make sure you do a mysqldump regularly. This
almost bit me just today.

--
Tracy Reed
http://tracyreed.org
Digital signature attached for your safety.
--
http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list

--
Tracy Reed
http://tracyreed.org
Digital signature attached for your safety.

Kevin Keane Subscription

2018-09-24 04:07:26 UTC

Permalink

Looking at that site - definitely check out Jekyll. That type of site is exactly what Jekyll is designed to do.

Adding a newsletter is as easy as adding a file to a directory, then run jekyll to regenerate the static site, and then upload it.

They don't even need to do it in HTML - Jekyll understands markdown, which is much easier to learn.

For that matter, you can make it even easier - and with free hosting to boot. Get a github account for that organization. Github will handle the Jekyll and uploading part for you, and throws in the hosting. You will have to do a bit of initial configuration (configure the domain name and SSL certificate, for the most part).

So all they have to do is type out the new newsletter and push it to github.

Oh - and they should also look at all the freely available Jekyll templates to give the site a face lift!

Kevin Keane
Whom the IT Pros Call
760-721-8339

-----Original message-----

Sent: Sunday, September 23, 2018 8:49 PM
Subject: Re: Wordpress designer needed for redo of drupal website that got hacked.
What we're looking for is something as simple as possible implementing
the info on current site. Static pages are fine. Need to be able to
update parts of page relative to current month/topic/speaker, and keep
and allow upload of current "newsletter/notes".
http://www.sdscholars.org/
Rich

Post by Tracy Reed
I don't have anyone to recommend but I would question the idea of
Wordpress being simpler. It certainly is not any more secure or less in
need of update.
1. Stay patched up: Login to the admin page at least weekly to monitor
    for updates since it tells you when updates are available and has
    one-click upgrade there.
2. Use SELinux in enforcing mode and monitor for denials (you will have
    to setenforce 0 to do the previously mentioned upgrade, don't forget
    to setenforce 1 afterwards).
3. Configure apache to block access to certain potentially harmful
<Location ~ "/(wp-login.php|wp-admin|xmlrpc.php)">
     Order Allow,Deny
     Deny from all
     Allow from 192.168.12.0/24
     Allow from 10.0.0.0/8
     Allow from 98.171.210.130/32
     Allow from 155.143.35.194/32
</Location>
4. Be absolutely fascist about avoiding plugins. They are generally
written with less care than the Wordpress codebase itself and are a
frequent source of vulnerabilities.
https://blog.malwarebytes.com/threat-analysis/2018/09/mass-wordpress-compromises-tech-support-scams/

--
Tracy Reed
http://tracyreed.org
Digital signature attached for your safety.
--
http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list

--
http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list

--
KPLUG-***@kernel-panic.org
http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list

Tracy Reed

2018-09-24 10:14:09 UTC

Permalink

I really wish someone could help out the club by implementing a new jekyll
(ruby) or pelican (python) website for SDCS/KPLUG! We need to get off of
our current host. It could disappear any day now.

Post by Kevin Keane Subscription
Looking at that site - definitely check out Jekyll. That type of site is exactly what Jekyll is designed to do.
Adding a newsletter is as easy as adding a file to a directory, then run jekyll to regenerate the static site, and then upload it.
They don't even need to do it in HTML - Jekyll understands markdown, which is much easier to learn.
For that matter, you can make it even easier - and with free hosting to boot. Get a github account for that organization. Github will handle the Jekyll and uploading part for you, and throws in the hosting. You will have to do a bit of initial configuration (configure the domain name and SSL certificate, for the most part).
So all they have to do is type out the new newsletter and push it to github.
Oh - and they should also look at all the freely available Jekyll templates to give the site a face lift!
Kevin Keane
Whom the IT Pros Call
760-721-8339
-----Original message-----

Post by Tracy Reed
I don't have anyone to recommend but I would question the idea of
Wordpress being simpler. It certainly is not any more secure or less in
need of update.
1. Stay patched up: Login to the admin page at least weekly to monitor
    for updates since it tells you when updates are available and has
    one-click upgrade there.
2. Use SELinux in enforcing mode and monitor for denials (you will have
    to setenforce 0 to do the previously mentioned upgrade, don't forget
    to setenforce 1 afterwards).
3. Configure apache to block access to certain potentially harmful
<Location ~ "/(wp-login.php|wp-admin|xmlrpc.php)">
     Order Allow,Deny
     Deny from all
     Allow from 192.168.12.0/24
     Allow from 10.0.0.0/8
     Allow from 98.171.210.130/32
     Allow from 155.143.35.194/32
</Location>
4. Be absolutely fascist about avoiding plugins. They are generally
written with less care than the Wordpress codebase itself and are a
frequent source of vulnerabilities.
https://blog.malwarebytes.com/threat-analysis/2018/09/mass-wordpress-compromises-tech-support-scams/

--
Tracy Reed
http://tracyreed.org
Digital signature attached for your safety.
--
http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list

--
http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list

--
Tracy Reed
http://tracyreed.org
Digital signature attached for your safety.

Tracy Reed

2018-09-24 10:16:05 UTC

Permalink

I'm making backups of it btw. But restoring the backup and getting
getting our old content, photos etc out of django would be a serious PITA so I
would hope to get it migrated while it is still up where we can just
copy the data out. I think we can ditch the book reviews. They are too
old to be relevant now.

Post by Tracy Reed
I really wish someone could help out the club by implementing a new jekyll
(ruby) or pelican (python) website for SDCS/KPLUG! We need to get off of
our current host. It could disappear any day now.

Post by Tracy Reed
I don't have anyone to recommend but I would question the idea of
Wordpress being simpler. It certainly is not any more secure or less in
need of update.
1. Stay patched up: Login to the admin page at least weekly to monitor
    for updates since it tells you when updates are available and has
    one-click upgrade there.
2. Use SELinux in enforcing mode and monitor for denials (you will have
    to setenforce 0 to do the previously mentioned upgrade, don't forget
    to setenforce 1 afterwards).
3. Configure apache to block access to certain potentially harmful
<Location ~ "/(wp-login.php|wp-admin|xmlrpc.php)">
     Order Allow,Deny
     Deny from all
     Allow from 192.168.12.0/24
     Allow from 10.0.0.0/8
     Allow from 98.171.210.130/32
     Allow from 155.143.35.194/32
</Location>
4. Be absolutely fascist about avoiding plugins. They are generally
written with less care than the Wordpress codebase itself and are a
frequent source of vulnerabilities.
https://blog.malwarebytes.com/threat-analysis/2018/09/mass-wordpress-compromises-tech-support-scams/

--
Tracy Reed
http://tracyreed.org
Digital signature attached for your safety.
--
http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list

--
http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list

--
Tracy Reed
http://tracyreed.org
Digital signature attached for your safety.
--
http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list

--
Tracy Reed
http://tracyreed.org
Digital signature attached for your safety.

Tony Su

2018-09-24 19:56:18 UTC

Permalink

Rich,
Static websites are the way to go today if you can eliminate
- User Logins
- files stored in a database

In other words,
A site that simply serves information and does not accept
information/data from the website visitor.

Every/all static website generators (and at my last count there are
well over a hundred active, and maybe over a thousand overall) support
updating in the form of micro-blogging... In other words, think
"Twitter." If your frequent updates can look like a Twitter feed, then
it's supported out of the box by practically any Jekyll site using any
theme..

Then the next question is how technically savvy your Users/Customer is.
All static websites can be updated by simply uploading a plain text
file, during website regeneration formatting will be applied to
"prettify" the blog entry, also applying various automatic features
like time-date stamping and perhaps the Author.
But uploading the file usually involves the standard git commands...
"Add ." "commit -am "some text" " and "push"
There are a few where you can install a graphical add-on so
non-technical Users can upload, or maybe you can simply script the
upload (and optionally provide a graphical frontend) so for the user
it's simply "create a file in notepad" then "save" to a particular
location then "doubleclick on the script" to upload... Which IMO is
simple enough no Windows User needs to know what's actually happening.

Tracy,
Can the existing KPLUG website be re-deployed on a local server?
If it can,
Then I might be willing to do some preliminary work to prepare for
migration or at least develop an approach for migrating.
I remember the existing site has a CMS capability for Users to log in
and do "whatever," that will likely have to be deprecated and a
decision whether to re-implement as a public space or eliminate
altogether.

Tony

Post by Tracy Reed
I'm making backups of it btw. But restoring the backup and getting
getting our old content, photos etc out of django would be a serious PITA so I
would hope to get it migrated while it is still up where we can just
copy the data out. I think we can ditch the book reviews. They are too
old to be relevant now.

--
Tracy Reed
http://tracyreed.org
Digital signature attached for your safety.
--
http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list

--
http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list

--
Tracy Reed
http://tracyreed.org
Digital signature attached for your safety.
--
http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list

--
KPLUG-***@kernel-panic.org
http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list

Tony Su

2018-09-24 20:03:47 UTC

Permalink

BTW -
I'm sorry to hear the existing KPLUG site is in Django.
Django is a very important and popular website technology,
I understand its origins and popularity is mainly rooted in its
ability to support journalism workflow.
But I personally have had incredibly bad experiences trying to
understand the technology (If a Django expert is in; the group, I'd
welcome a meeting presentation).

Considering the age of the website, I'd even wonder if it can run on
current versions of python, whatever database it's using and even
Django framework.
Might have to dig up some old install source to install and run in a vm..

Tony

Post by Tony Su
Rich,
Static websites are the way to go today if you can eliminate
- User Logins
- files stored in a database
In other words,
A site that simply serves information and does not accept
information/data from the website visitor.
Every/all static website generators (and at my last count there are
well over a hundred active, and maybe over a thousand overall) support
updating in the form of micro-blogging... In other words, think
"Twitter." If your frequent updates can look like a Twitter feed, then
it's supported out of the box by practically any Jekyll site using any
theme..
Then the next question is how technically savvy your Users/Customer is.
All static websites can be updated by simply uploading a plain text
file, during website regeneration formatting will be applied to
"prettify" the blog entry, also applying various automatic features
like time-date stamping and perhaps the Author.
But uploading the file usually involves the standard git commands...
"Add ." "commit -am "some text" " and "push"
There are a few where you can install a graphical add-on so
non-technical Users can upload, or maybe you can simply script the
upload (and optionally provide a graphical frontend) so for the user
it's simply "create a file in notepad" then "save" to a particular
location then "doubleclick on the script" to upload... Which IMO is
simple enough no Windows User needs to know what's actually happening.
Tracy,
Can the existing KPLUG website be re-deployed on a local server?
If it can,
Then I might be willing to do some preliminary work to prepare for
migration or at least develop an approach for migrating.
I remember the existing site has a CMS capability for Users to log in
and do "whatever," that will likely have to be deprecated and a
decision whether to re-implement as a public space or eliminate
altogether.
Tony

--
Tracy Reed
http://tracyreed.org
Digital signature attached for your safety.
--
http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list

--
http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list

--
Tracy Reed
http://tracyreed.org
Digital signature attached for your safety.
--
http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list

--
KPLUG-***@kernel-panic.org
http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list

Tracy Reed

2018-09-25 10:12:23 UTC

Permalink

Post by Tony Su
I'm sorry to hear the existing KPLUG site is in Django.

It is in Plone. Not Django.

Post by Tony Su
Django is a very important and popular website technology,
I understand its origins and popularity is mainly rooted in its
ability to support journalism workflow.

I'm not aware of Django having a journalism workflow or any workflow at
all by default. It's just a web framework.

Post by Tony Su
But I personally have had incredibly bad experiences trying to
understand the technology (If a Django expert is in; the group, I'd
welcome a meeting presentation).

Are you sure you are talking about Django? I'm not an expert but I would
be happy to give a presentation on Django when I am in town.

Post by Tony Su
Considering the age of the website, I'd even wonder if it can run on
current versions of python, whatever database it's using and even
Django framework.

It is possible that it would run on the latest Python 2.7 but not Python
3. But not a whole lot has moved over to 3 even though 3 has been with
us for years now.

Post by Tony Su
Might have to dig up some old install source to install and run in a vm..

I would much rather see someone spend that time migrating out of Plone.

--
Tracy Reed
http://tracyreed.org
Digital signature attached for your safety.

Tracy Reed

2018-09-25 02:02:21 UTC

Permalink

Post by Tony Su
Can the existing KPLUG website be re-deployed on a local server?

Not easily. The instance of Plone that it is running on is surely
incompatible with modern Plone and its dependencies would not be
satisfied by a modern Linux distro.

We really just need to migrate to a simple static site.

Post by Tony Su
I remember the existing site has a CMS capability for Users to log in
and do "whatever," that will likely have to be deprecated and a
decision whether to re-implement as a public space or eliminate
altogether.

Yeah. We don't need any of that. I would like to just preserve
historical content such as photos, events, picnics, meetings, etc. and
ditch everything else. And then have an easy update process going
forwad.

--
Tracy Reed
http://tracyreed.org
Digital signature attached for your safety.

Kevin Keane Subscription

2018-09-25 18:32:52 UTC

Permalink

How much of that site is dynamic? I'm just making a clone with wget and could throw that up on my Web server with a letsencrypt certificate, but I don't know how workable that site would be.

Unfortunately, I don't have the time to go through the site, fix up links, test everything and remove what's not static.

Kevin Keane
Whom the IT Pros Call
760-721-8339

-----Original message-----

Sent: Tuesday, September 25, 2018 3:13 AM
Subject: Re: Wordpress designer needed for redo of drupal website that got hacked.

Post by Tony Su
I'm sorry to hear the existing KPLUG site is in Django.

It is in Plone. Not Django.

Post by Tony Su
Django is a very important and popular website technology,
I understand its origins and popularity is mainly rooted in its
ability to support journalism workflow.

I'm not aware of Django having a journalism workflow or any workflow at
all by default. It's just a web framework.

Post by Tony Su
But I personally have had incredibly bad experiences trying to
understand the technology (If a Django expert is in; the group, I'd
welcome a meeting presentation).

Are you sure you are talking about Django? I'm not an expert but I would
be happy to give a presentation on Django when I am in town.

Post by Tony Su
Considering the age of the website, I'd even wonder if it can run on
current versions of python, whatever database it's using and even
Django framework.

It is possible that it would run on the latest Python 2.7 but not Python
3. But not a whole lot has moved over to 3 even though 3 has been with
us for years now.

Post by Tony Su
Might have to dig up some old install source to install and run in a vm..

I would much rather see someone spend that time migrating out of Plone.
--
Tracy Reed
http://tracyreed.org
Digital signature attached for your safety.
--
http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list

--
KPLUG-***@kernel-panic.org
http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list

Tony Su

2018-09-26 15:43:45 UTC

Permalink

The origins of Django are described in many places,
The following Wikipedia entry states its place of origin without going
into more depth which can be found elsewhere.

https://en.wikipedia.org/wiki/Django_(web_framework)

Plone hasn't given me the problems Django has.
Will the website really run on Python 2.7? That's a good step for
redeployment and analysis for migration.

Kevin,
That's cool...
But of course identifying and understanding all those links, manually
determining what to preserve and re-engineer vs what to discard is the
major work that has to be done... which is why I suggest re-deployment
as the first step because IMO it's only when you can see the website's
structure can you be sure you understand all of the website.

I also have a Jekyll framework I'm using...
Recently, after discovering that the there are problems with the
default Jekyll theme...

I was able to use the following very versatile theme and get it working properly

http://jekyllthemes.org/themes/jekyll-pug-material/

My Test deployment
The source
https://github.com/putztzu/jekyll-testbed
The website deployed
https://putztzu.github.io/jekyll-testbed/

For anyone who wants to deploy their own version
- It's probably possible to simply clone my source, then modify for
your own git website but I opted to build from the theme's source
- When I looked into Jekyll again 3 mths ago, I found the default
theme broken and wasted a ton of time. On the chance that it's still
broken and if you want to build your own using this theme, just follow
the theme's own install instructions instead of the main Jekyll
instructions.

Tony
On Tue, Sep 25, 2018 at 11:33 AM Kevin Keane Subscription

Post by Kevin Keane Subscription
How much of that site is dynamic? I'm just making a clone with wget and could throw that up on my Web server with a letsencrypt certificate, but I don't know how workable that site would be.
Unfortunately, I don't have the time to go through the site, fix up links, test everything and remove what's not static.
Kevin Keane
Whom the IT Pros Call
760-721-8339
-----Original message-----