rootninja

Get rid of this line in all your WordPress php files

<meta name=”generator” content=”WordPress <?php bloginfo(’version’); ?>” /><!– leave this for stats please –>

When wordpress comes out with a new version, part of the update is usually fixing an exploitable bug.  The bug may allow a hacker to access your wp-admin directory or delete your files, or worse.  If the bug is only in version xyz, and that’s the version you’re running, you don’t want anyone googling that version to run into your pages and exploit your code.

You can use the “leave this for stats please” to find and replace that line in all your php files at once.  If you don’t have shell access, well I guess you’ll have to use whatever interface your site provider overlords have thrust upon you.

[admica@host]$  sudo for x in `grep ” leave this for stats please” /path/to/myblog -R | awk ‘{print $1}’ | grep -o -e “.*php”`; do sed -e ’s/.*leave this for stats please.*//g’ $x > $x.temp; mv $x.temp $x; done

This will find all the files that contain that line and delete it from each one.

Linux bash, php, security, wordpress

[user@localhost ~]$  cat ~/.ssh/id_rsa.pub ~/.ssh/id_dsa.pub | ssh user@remotehost ’sh -c “cat - >> ~/.ssh/authorized_keys”‘

You’ll be prompted for the password just this one last time.  This is perfect for running a script that runs several remote commands through ssh.  Here’s a script that checks for your keys and adds them if they’re not there.  You’ll get prompted for a password twice if the keys didn’t already exist, and then no more.

#!/bin/sh
MY_NAME=`hostname`
MY_IPADDR=`hostname -i`

CHECK_KEYS=`ssh user@remotehost “touch ~/.ssh/authorized_keys > /dev/null 2> /dev/null; \
chmod 700 ~/.ssh/authorized_keys; grep -e $MY_NAME ~/.ssh/authorized_keys”`

LENGTH=`expr $CHECK_KEYS” : ‘.*’`
if [ $LENGTH -lt 3 ]; then
# cat the keys
else
# they already exist
fi

Another way around the password prompting issue from running a bunch of ssh commands is to branch the script and have one branch check your hostname to make sure you’re not the remote host and then start running all your commands.  When you get to the stuff you want to do remotely, echo the script across your ssh tunnel and execute it.  Now in the script, go into the 2nd branch that only runs if the hostname check matches the remote host, and it will skip down to this part on the remote run.  This gets around having a 2nd script with all your remote commands in it.  It might not be elegant, but it works!

#!/bin/sh
if [ `hostname` != $1 ]; then
# you ran this script with the remote host as the 1st argument, so it’s not going to be equal, and it will run these commands
# do a bunch of local stuff here
cat $0 | ssh user@remotehost /bin/bash `hostname`

else

# i’m here because i’ve been called on the remote host
REMOTEHOST=$2
# now i can run commands as if they were local.  executing `hostname` now would now return the remotehost name.  So any variables you want to carry over to the remote host, such as where I was called from, just add them as additional arguments when you cat the script and grab them from $2, $3, … etc. when you enter this else clause!
fi

Linux authorized_keys, bash, ssh

Create some new directories:

/var/spool/prngd/

/var/run/

Create a startup script for the random number generator in /etc/init.d

#!/bin/sh
# 10/04/2008
# Purpose: start, stop, status script for prngd
case “$1″ in
’start’)
/usr/local/sbin/prngd /var/spool/prngd/pool /var/run/egd-pool
;;
’stop’)
/usr/bin/kill `ps -ef | /usr/bin/grep prngd | /usr/bin/grep local | /usr/bin/awk ‘{print $2}’`
;;
’status’)
if [ "`ps -ef | /usr/bin/grep prngd | /usr/bin/grep local`" ]; then
echo prngd is running…
else
echo prngd is stopped.
fi
;;
*)
echo “Usage: $0 { start | stop | status }”
exit 1
;;
esac
exit 0

Create a startup script for sshd in /etc/init.d

#! /bin/sh
#
# start/stop the secure shell daemon
case “$1″ in
’start’)
# Start the ssh daemon
if [ -f /usr/local/sbin/sshd ]; then
echo “starting SSHD daemon”
/usr/local/sbin/sshd &
fi
;;
’stop’)
# Stop the ssh deamon
PID=`/usr/bin/ps -e -u 0 | /usr/bin/fgrep sshd | /usr/bin/awk ‘{print $1}’`
if [ ! -z "$PID" ] ; then
/usr/bin/kill ${PID} >/dev/null 2>&1
fi
;;
*)
echo “usage: /etc/init.d/sshd {start|stop}”
;;
esac

Don’t forget to link them both in /etc/rc2.d so they’ll start automatically.  I used 50 and 99 to try to make sure that prngd starts before sshd fires up.

# cd /etc/rc2.d

# ln -s ../init.d/prngd S50prngd

# ln -s ../init.d/sshd S99sshd

Create ssh public key pairs.  Don’t change these output names, the daemon expects them to be named like this and if you change them, you’ll see an error like no key found, ssh v1 not starting.  But who really cares, right?

# /usr/local/bin/ssh-keygen -d -f /usr/local/etc/ssh_host_dsa_key -N “”

# /usr/local/bin/ssh-keygen -b 1024 -f /usr/local/etc/ssh_host_rsa_key -t rsa -N “”

# /usr/local/bin/ssh-keygen -t rsa1 -f /usr/local/etc/ssh_host_key -N “”

Start the daemons and you should be good to go.  If you’re getting PRNGD not seeded errors, go take care of some other stuff, it will eventually stop as long as you installed prngd properly and started it up.  Generating the keys will probably take forever if you’re on an old Ultra 1 like me, give them a minute or two.  Entropy will take forever+1.  You can fill the seed files with garbage data if you want to speed it up.  If you’re still getting PRNGD errors an hour later, you could try the kernel patch to add /dev/random /dev/urandom support directly to the kernel.  (Sun patch 112438-03) I chose not to because I didn’t want to risk something going terribly wrong with this machine.  It’s unique in my environment and been shoved in a corner and forgotten about for a long time until now!

I also installed bash and top.  Bash was a no brainer!  I hate old ksh shells with broken backspaces, arrow keys, and lack of a command history.  They were both installed with pkgadd -d, no additional script writing or directory creating necessary.  If you have library issues after installed, run ldd on the binaries and do a google search to find what libraries packages you need.

Uncategorized ancient, bash, egd, gcc, popt, prngd, rsync, solaris, ssh, ssl, sun, sunfreeware, sunos, top, zlib