Uncategorized

wordpress

Aug 2 2012

Resetting WordPress Security Keys

Several people have recently come to me asking for help identifying and remediating hacks against their wordpress blogs. Many of the online tutorials fail to address attackers who try to maintain persistence by changing user passwords and remaining logged in to wordpress. Even if you reset the password the attacker can still make changes because their cookies are still valid. By default, WordPress allows users to remain logged in for 48 hours or 14 days if you check the “Remember Me” box.

Since version 2.6 of WordPress they have added security keys to ensure better encryption of information stored in cookies. If you change these keys then the previously existing cookies will no longer be valid and the attacker who is logged in will no longer have access. WordPress offers an key genereator which will randomly generate new keys for you or you could just make random changes to the existing keys. Please note that this will invalidate all existing cookies and all users will have to login again.

Here is an example of the section in wp-config.php that you will need to edit.


Okay, so to sum things up.

  • Step 1: Go to the key genereator and copy all keys
  • Step 2: Edit the wp-config.php file and paste the keys to keys section
  • Step 3: Save the file and changes will become effective immediately
  • Step 4: Harden your wordpress site

    • Happy WordPress blogging!

    By • 0 • Tags:

    apple-logo-png-black-i1

    Jul 31 2012

    Installing MacPorts on your Mac

    What is MacPorts?

    MacPorts provides an infrastructure for building, installing, and packaging open source software. It is designed to match the functionality of the FreeBSD Ports system and to be extensible for future enhancements.

    Installing MacPorts

    Download the macports package for your version here or you can click on the version of the MacOS you have here: Mountain Lion, Lion, Snow Leopard orLeopard. Double click on the package to run the Installer and follow the on-screen instructions until completion.

    Basic Usage

    The main user interface to MacPorts is the port command and the various facilities it provides for installing ports. The first thing you should do after you install MacPorts is to make sure it is fully up to date by pulling the latest revisions to the Portfiles and any updated MacPorts base code from our rsync server, all accomplished simply by running the port selfupdate command as the Unix superuser:

    1
    sudo port selfupdate

    Running this command on a regular basis is recommended — it ensures your MacPorts installation is always up to date. Afterwards, you may search for ports to install:

    1
    port search <portname>

    where is the name of the port you are searching for, or a partial name. To install a port you’ve chosen, you need to run the port install command as the Unix superuser:

    1
    sudo port install <portname>

    where now maps to an exact port name in the ports tree, such as those returned by the port search command. Please consult the port(1) man page for complete documentation for this command and the software installation process.

    By • , 0 • Tags: