Security concerns on HTTP WAN side

[raidsm]

Here is my question.

I host a personal wordpress website. (for fun). So I did a port forward to be able to access my website on the WAN side.

Unfortunately this also expose the FVDW config web page on the WAN side. Is there a way to "isolate" both website so only the wordpress is exposed on the WAN side and not the fvdw config page?

For accessing the other services and the fvdw config, I will use the VPN. For SSH I also use a RSA key, for my website I only allow HTTPS through a non standard port .

Someone have some tips to let me configure my NAS remotely via the webpage AND that allow me the also publish my wordpress? IE: uses different port forward for my wordpress and the FVDW webpage? is that even possible? ex: port 80 for wordpress and post 1234 for the FVDW config webpage?

Maybe there is some tricks related to the .htaccess but I don't want to use the "allow or restrict" command.

Someone have a clue? :thinking :thinking

[Jocko]

Hi raidsm,

Maybe there is some tricks related to the .htaccess but I don't want to use the "allow or restrict" command.

Yes , there are other tricks to do it: use a virtual host for your wordpress site (use another port for it, for example 81).
Note: you can not change the port 80 used for fvdw-sl web-interface (or with hard changes).

First remove your wordpress symlink in /usr/htdocs and also any script to create it.

I hope this time you will use the attached file! :disapprove as you never download it the previous version....(viewtopic.php?f=11&t=2327&p=20701#p20700)

The zip archive contains now 4 files:
- php.ini.org, to erase your change
- mysql.5.6.6, to reinstall mysql extension file after upgrading
- update_php_ini.sh, to restore your settings after rebooting the nas.
- wp_vhost.conf, to set the virtual host

To install them :
- unzip the archive in fvdw
- restore php.ini

Code: Select all

cp /direct-usb/fvdw/php.ini.org /etc/php.ini

- move update_php_ini.sh in the cron-boot folder and select it so that it runs at each boot (boot jobs menu)
- edit wp_vhost.conf to set some custom settings (port; path): I added some comments

This script does :
- restore mysql.so in /usr/lib/php/extensions if it is missing
- edit php.ini to set your custom settings
- set a virtual host for wordpress

So restart the nas and now your wordpress url will be http://yourDDNS:81 (if you did not change the port in wp_vhost.conf).
if it fails then there are some traces in /boot.log

[raidsm]

Great! I take a look at it right now... I come back to you with some feedback and probably some questions ;)


edit: i'm rebooting right now!

edit 2: it's not working, I can't connect to my server...

What is working:

php.ini has the good values (memory size = 64 mb and execution time = 300). So that part is working great.

I checked the 2 log in the fvdw folder and both are empty. (wp_access and wp_error)

I changed my router port forwarding to allow port 81 as in the wp_vhost con file.

here is my modified wp_vhost file: my worpress is in the root of /share/1000/web/

Code: Select all

# you may change port 81 by any unused port
<VirtualHost *:81>
# set here your DDNS
ServerName notmyrealddns.com

# full path to wordpress files
DocumentRoot "/share/1000/web"

# full path to wordpress files
<Directory "/share/1000/web">
 DirectoryIndex index.php
 AllowOverride All
 Options -Indexes +FollowSymLinks
</Directory>

#Logs
ErrorLog /direct-usb/fvdw/wp_error_log
CustomLog /direct-usb/fvdw/wp_access_log common
</VirtualHost>

[raidsm]

When I try to access it locally it timed out.

local fvdw web page = s2.local = working great
local wordpress = ns2.local:81 = time out

[raidsm]

For testing purposes

I did re-make my symlink and re-add the port forward on my router. I now have 2 way to access my wordpress website. (normally and via virtual host which it doesn't work)

So to summarize:

2 port forward in my router
public port 5051 to private 443 (https) = working great as before access via normal mode (htdocs symlink)
public port 5050 to private 81 (http) = not working (via virtual host port 81)

BTW Can I have both access at the same time? (via virtual host and normally via htdocs?)

here is the dump file created with the http -S command (I read somewhere it may help...?)

[Tue Nov 10 10:23:11.217964 2015] [core:warn] [pid 2237] AH00117: Ignoring deprecated use of DefaultType in line 428 of /usr/conf/httpd.conf.
VirtualHost configuration:
ServerRoot: "/usr"
Main DocumentRoot: "/usr/htdocs"
Main ErrorLog: "/usr/logs/error_log"
Mutex ssl-stapling: using_defaults
Mutex authn-socache: using_defaults
Mutex ssl-cache: using_defaults
Mutex default: dir="/usr/logs/" mechanism=default
Mutex mpm-accept: using_defaults
Mutex authdigest-opaque: using_defaults
Mutex rewrite-map: using_defaults
Mutex authdigest-client: using_defaults
PidFile: "/usr/logs/httpd.pid"
Define: DUMP_VHOSTS
Define: DUMP_RUN_CFG
User: name="nobody" id=99
Group: name="#-1" id=4294967295
root@NS2:/usr/bin #

[Jocko]

Sorry but I forgot a directive : NameVirtualHost in wp_vhost.conf

So add this line

Code: Select all

NameVirtualHost *:81

# you may change port 81 by any unused port
<VirtualHost *:81>
# set here your DDNS
ServerName .....
....
</VirtualHost>


in your conf file

After editing, restart the apache server

Code: Select all

/usr/bin/httpd -f httpd.conf -d /etc -k graceful

and check if httpd listens the port 81

Code: Select all

netstat -apn|grep httpd

[raidsm]

not working...

a got that message when rebooting the apache after I added the line

AH00548: NameVirtualHost has no effect and will be removed in the next release /direct-usb/fvdw/wp_vhost.conf:1

and the netstat result:
tcp 0 0 :::80 :::* LISTEN 1122/httpd
tcp 0 0 :::443 :::* LISTEN 1122/httpd

[raidsm]

here is my wp_vhost.conf file: (i masked my real dans name... before posting xxxxxxx.net)

Code: Select all

NameVirtualHost *:81

# you may change port 81 by any unused port
<VirtualHost *:81>
# set here your DDNS
ServerName XXXXXX.net   

# full path to wordpress files
DocumentRoot "/share/1000/web"

# full path to wordpress files
<Directory "/share/1000/web">
 DirectoryIndex index.php
 AllowOverride All
 Options -Indexes +FollowSymLinks
</Directory>

#Logs
ErrorLog /direct-usb/fvdw/wp_error_log
CustomLog /direct-usb/fvdw/wp_access_log common
</VirtualHost>

[Jocko]

:pound I am tired...

The right directive is

Code: Select all

Listen 81

instead of NameVirtualHost *:81

[raidsm]

Yeah baby yeah everything is working great! thank you!

Now for the last question, can it be a HTTPS port instead of an HTTP?