Saturday, April 4, 2009

KB: Secure WordPress Administration on Ubuntu

Configuration guide for the administration of WordPress over SSL on Ubuntu Linux.

Contents

Overview

This guide outlines the basic steps needed to enable the administration of WordPress over SSL.

The configuration presented consists of two name-based virtual hosts. This first virtual host is the non-secure host. This host provides public access to WordPress. The second virtual host is the secure host. This virtual host is used to secure communications while logging into and performing WordPress administration functions. The secure virtual host uses the same DocumentRoot as the non-secure host.

This guide assumes that Apache and WordPress are properly installed on the target system. This configuration has been tested on Ubuntu 8.04 LTS running Apache 2.2.8 and WordPress 2.7.1.

Existing WordPress Host Configuration

It is assumed that the existing non-secure WordPress site is located at http://www.mysite.com and has the following configuration (/etc/apache2/sites-available/mysite):
<virtualhost *:80>
        ServerName www.mysite.com
        ServerAdmin webmaster@mysite.com

        DocumentRoot /var/www/wordpress

        DirectoryIndex index.html index.php

        <directory>
                Options FollowSymLinks
                AllowOverride None
        </directory>

        ErrorLog /var/log/apache2/www.error.log

        # Possible values include: debug, info, notice, warn, error, crit,
        # alert, emerg.
        LogLevel warn

        CustomLog /var/log/apache2/www.access.log combined
        ServerSignature On
</virtualhost>
Note: It is assumed that /etc/apache2/sites-available/mysite has a symbolic link /etc/sites-enabled/001-mysite.

Secure Host Configuration

1. Configure Apache to use SSL. See this guide for help.
2. Enable the Apache rewrite module:
sudo a2enmod rewrite
3. Create a secure host configuration with a number of rewrite rules to automatically go to the non-secure host when one browses to a URL that does not include any secured paths i.e. wp-admin, wp-login or wp-register. Create /etc/apache2/sites-available/mysitessl:
<virtualhost *:443>
        ServerName www.mysite.com
        ServerAdmin webmaster@mysite.com

        DocumentRoot /var/www/wordpress

        DirectoryIndex index.html index.php

        SSLEngine On
        SSLCertificateFile /etc/apache2/ssl/mysite.pem
        SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown

        <ifmodule mod_rewrite.c>
                RewriteEngine On
                RewriteRule !^/wp-(admin|login|register)(.*) - [C]
                RewriteRule ^/(.*) http://www.mysite.com/$1 [L]
        </ifmodule>

        <directory>
                Options FollowSymLinks
                AllowOverride None
        </directory>

        ErrorLog /var/log/apache2/www.error.log

        # Possible values include: debug, info, notice, warn, error, crit,
        # alert, emerg.
        LogLevel warn

        CustomLog /var/log/apache2/www.access.log combined
        ServerSignature On
</virtualhost>
4. Create the following link in /etc/sites-enabled:
sudo ln -s /etc/apache2/sites-available/mysitessl 002-mysitessl
5. Restart Apache:
sudo /etc/init.d/apache2 restart

WordPress Configuration

To force all logins and administration sessions to happen over SSL, the FORCE_SSL_ADMIN constant needs to be set to true. Edit WP_INSTALL_DIR/wp-config.php and add the following:
define('FORCE_SSL_ADMIN', true);
To Top