There are several ways of making a Wordpress installation more secure. One possibility is to ditch FTP and use a safe authentication, like SSH.
In Wordpress 4.1 there is embedded support for SSH authentication active - as long as the ssh2 php extension is loaded.
In Debian Wheezy this can be installed with the library libssh2-php:
apt-get install libssh2-php
After the installation, a restart of Apache activates the extension (which is defined in /etc/php5/conf.d/ssh2.ini):
service apache2 restart
However, no matter what I did, I couldn't get it to work in Wordpress.
I adapted file permissions, create a key pair with and without a password, verified manual ssh login with the key file, ... whatever I did, I always got this error:
Public and Private keys incorrect for wpuser
Where wpuser is the user I defined and which owns the wordpress folder.
There are several good howtos available which mention this error and which give potential resolutions:
But unfortunately, none of them could resolve the problem.
On the SSH layer I saw, that a connection came in, but the key authentication never happened. The connection was always terminated from the pecl side before the authentication could happen (in the preauth phase):
sshd: Connection from 188.8.131.52 port 36144
sshd: Found matching RSA key: aa:bb:cc:dd:ee:ff:gg:hh:ii:jj:kk:ll:mm:nn:oo:pp
sshd: Postponed publickey for wpuser from 184.108.40.206 port 36144 ssh2 [preauth]
sshd: Received disconnect from 220.127.116.11: 11: PECL/ssh2 (http://pecl.php.net/packages/ssh2) [preauth]
Could it be a bug in the Wordpress core? Or maybe is the libssh2-php version too old/buggy? After a frustrating and non-successful research about possible bugs, I tried it with an alternative, a plugin called "SSH SFTP Updater Support". And finally I got lucky!
Once I manually installed (unzipped and activated) the plugin, I was able to use the private/public key pair as authentication method. With or without password-protected private key, both setups worked.
In the SSH log, the successful authentication (and sftp download of a theme) is logged like this:
sshd: Accepted publickey for wpuser from 18.104.22.168 port 43559 ssh2
sshd: pam_unix(sshd:session): session opened for user wpuser by (uid=0)
sshd: subsystem request for sftp by user wpuser
sshd: Received disconnect from 22.214.171.124: 11:
sshd: pam_unix(sshd:session): session closed for user wpuser
Great WP plugin, well done and well working! Thanks to the author TerraFrost!
No comments yet.
AWS Android Ansible Apache Apple Atlassian BSD Backup Bash Bluecoat CMS Chef Cloud Coding Consul Container Containers CouchDB DB DNS Database Databases Docker ELK ElasticSearch Elasticsearch Filebeat FreeBSD GlusterFS Grafana Graphics HAProxy HTML Hacks Hardware Icinga Icingaweb2 InfluxDB Internet Java KVM Kibana Kubernetes LXC Linux Logstash Mac Macintosh Mail MariaDB Minio MongoDB Monitoring Multimedia MySQL NFS Nagios Network Nginx OSSEC OTRS PGSQL PHP Perl Personal PostgreSQL Postgres PowerDNS Proxmox Proxy Python Rancher SSL Security Shell SmartOS Solaris Surveillance SystemD TLS Tomcat Ubuntu Unix VMWare VMware Varnish Virtualization Windows Wireless Wordpress Wyse ZFS Zoneminder