ebf0bb55d92d669f693ec262d22b2b09ff2e5ba7
[cacert-infradocs.git] / docs / systems / blog.rst
1 .. index::
2 single: Systems; Blog
3
4 ====
5 Blog
6 ====
7
8 Purpose
9 =======
10
11 This system hosts the blog, blog.cacert.org. The blog meets the needs of public
12 relations and the CAcert community to publish CAcert's activities.
13
14 Application Links
15 -----------------
16
17 Blog URL
18 https://blog.cacert.org/
19
20 Adding a category
21 https://blog.cacert.org/wp-admin/categories.php
22
23 Administration
24 ==============
25
26 System Administration
27 ---------------------
28
29 * Primary: :ref:`people_dirk`
30 * Secondary: None
31
32 .. todo:: find an additional admin
33
34 Application Administration
35 --------------------------
36
37 +-----------------------+-------------------------------------------------+
38 | Role | Users |
39 +=======================+=================================================+
40 | Wordpress Admin | :ref:`people_dirk`, |
41 | | :ref:`people_mario`, |
42 +-----------------------+-------------------------------------------------+
43 | Wordpress Editor | PR Team, |
44 | | `Support`_ |
45 +-----------------------+-------------------------------------------------+
46 | Wordpress Author | Anyone with a certificate |
47 +-----------------------+-------------------------------------------------+
48 | Wordpress Contributor | Anyone with contributor privileges |
49 +-----------------------+-------------------------------------------------+
50 | Wordpress Subscriber | Any Spammer or person who has not posted or has |
51 | | not logged in |
52 +-----------------------+-------------------------------------------------+
53
54 .. _Support: support@cacert.org
55
56 Contact
57 -------
58
59 * blog-admin@cacert.org
60
61 Additional People
62 -----------------
63
64 :ref:`Jan Dittberner <people_jandd>`, :ref:`Mario Lipinski <people_mario>` and
65 :ref:`Dirk Astrath <people_dirk>` have :program:`sudo` access on that machine
66 too.
67
68 Basics
69 ======
70
71 Physical Location
72 -----------------
73
74 This system is located in an :term:`LXC` container on physical machine
75 :doc:`infra02`.
76
77 Logical Location
78 ----------------
79
80 :IP Internet: :ip:v4:`213.154.225.234`
81 :IP Intranet: :ip:v4:`172.16.2.13`
82 :IP Internal: :ip:v4:`10.0.0.13`
83 :MAC address: :mac:`00:ff:fa:af:b2:9b` (eth0)
84
85 .. seealso::
86
87 See :doc:`../network`
88
89 DNS
90 ---
91
92 .. index::
93 single: DNS records; Blog
94
95 ====================== ======== ============================================
96 Name Type Content
97 ====================== ======== ============================================
98 blog.cacert.org. IN A 213.154.225.234
99 blog.cacert.org. IN SSHFP 1 1 32CA6E4BA3275AAB0D65F0F46969B11A4C4B36E8
100 blog.cacert.org. IN SSHFP 2 1 AAFBA94EBE5C5C45CDF5EF10D0BC31BEA4D9ECEC
101 blog.intra.cacert.org. IN A 172.16.2.13
102 ====================== ======== ============================================
103
104 .. seealso::
105
106 See :wiki:`SystemAdministration/Procedures/DNSChanges`
107
108 Operating System
109 ----------------
110
111 .. index::
112 single: Debian GNU/Linux; Jessie
113 single: Debian GNU/Linux; 8.10
114
115 * Debian GNU/Linux 8.10
116
117 Applicable Documentation
118 ------------------------
119
120 A small (work in progress) guide can be found in the :wiki:`BlogDoc`.
121
122 Services
123 ========
124
125 Listening services
126 ------------------
127
128 +----------+---------+---------+----------------------------+
129 | Port | Service | Origin | Purpose |
130 +==========+=========+=========+============================+
131 | 22/tcp | ssh | ANY | admin console access |
132 +----------+---------+---------+----------------------------+
133 | 25/tcp | smtp | local | mail delivery to local MTA |
134 +----------+---------+---------+----------------------------+
135 | 80/tcp | http | ANY | application |
136 +----------+---------+---------+----------------------------+
137 | 443/tcp | https | ANY | application |
138 +----------+---------+---------+----------------------------+
139 | 5666/tcp | nrpe | monitor | remote monitoring service |
140 +----------+---------+---------+----------------------------+
141 | 3306/tcp | mysql | local | MySQL database for blog |
142 +----------+---------+---------+----------------------------+
143 | 9000/tcp | php-fpm | local | PHP FPM executor |
144 +----------+---------+---------+----------------------------+
145
146 Running services
147 ----------------
148
149 .. index::
150 single: Apache
151 single: MySQL
152 single: PHP FPM
153 single: Postfix
154 single: cron
155 single: nrpe
156 single: openssh
157
158 +--------------------+--------------------+----------------------------------------+
159 | Service | Usage | Start mechanism |
160 +====================+====================+========================================+
161 | openssh server | ssh daemon for | init script :file:`/etc/init.d/ssh` |
162 | | remote | |
163 | | administration | |
164 +--------------------+--------------------+----------------------------------------+
165 | Apache httpd | Webserver for blog | init script |
166 | | | :file:`/etc/init.d/apache2` |
167 +--------------------+--------------------+----------------------------------------+
168 | cron | job scheduler | init script :file:`/etc/init.d/cron` |
169 +--------------------+--------------------+----------------------------------------+
170 | MySQL | MySQL database | init script |
171 | | server for blog | :file:`/etc/init.d/mysql` |
172 +--------------------+--------------------+----------------------------------------+
173 | PHP FPM | PHP FPM executor | init script |
174 | | for blog | :file:`/etc/init.d/php5-fpm` |
175 +--------------------+--------------------+----------------------------------------+
176 | Postfix | SMTP server for | init script |
177 | | local mail | :file:`/etc/init.d/postfix` |
178 | | submission | |
179 +--------------------+--------------------+----------------------------------------+
180 | Nagios NRPE server | remote monitoring | init script |
181 | | service queried by | :file:`/etc/init.d/nagios-nrpe-server` |
182 | | :doc:`monitor` | |
183 +--------------------+--------------------+----------------------------------------+
184
185 Databases
186 ---------
187
188 +-------+------------+------------------------------+
189 | RDBMS | Name | Used for |
190 +=======+============+==============================+
191 | MySQL | blog | Wordpress blog |
192 +-------+------------+------------------------------+
193 | MySQL | phpmyadmin | PHPMyAdmin settings database |
194 +-------+------------+------------------------------+
195
196 Connected Systems
197 -----------------
198
199 * :doc:`monitor`
200
201 Outbound network connections
202 ----------------------------
203
204 * HTTP (80/tcp) and HTTPS (443/tcp) `Ping-o-matic`_ blog update service [#f1]_
205 * HTTP (80/tcp) and HTTPS (443/tcp) to Akismet anti spam service [#f2]_
206 * HTTP (80/tcp) and HTTPS (443/tcp) to wordpress.org
207 * DNS (53) resolving nameservers 172.16.2.2 and 172.16.2.3
208 * :doc:`emailout` as SMTP relay
209 * :doc:`proxyout` as HTTP proxy for APT
210 * crl.cacert.org (rsync) for getting CRLs
211
212 .. _Ping-o-matic: http://rpc.pingomatic.com/
213 .. [#f1] http://blog.cacert.org/wp-admin/options-writing.php
214 .. [#f2] http://blog.cacert.org/wp-admin/plugins.php?page=akismet-key-config
215
216 .. - check network status
217
218 Security
219 ========
220
221 .. sshkeys::
222 :RSA: MD5:ec:cb:b5:13:7c:17:c4:c3:23:3d:ee:01:58:75:b5:8d
223 :DSA: MD5:c6:a7:52:f6:63:ce:73:95:41:35:90:45:9e:e0:06:a5
224 :ECDSA: MD5:00:d7:4b:3c:da:1b:24:76:74:1c:dd:2c:64:50:5f:81
225 :ED25519: MD5:0c:fe:c7:a1:bd:e6:43:e6:70:5a:be:5a:15:4d:08:9d
226
227 Dedicated user roles
228 --------------------
229
230 +-------+--------------------------------------------------------------------+
231 | Group | Purpose |
232 +=======+====================================================================+
233 | blog | group owning the blog file content and temporary files. This group |
234 | | is used to execute the Wordpress PHP code. |
235 +-------+--------------------------------------------------------------------+
236
237 Non-distribution packages and modifications
238 -------------------------------------------
239
240 * **Wordpress Plugins**
241
242 * `client-certificate-authentication
243 <http://wordpress.org/plugins/client-certificate-authentication/>`_
244 * akismet
245
246 Risk assessments on critical packages
247 -------------------------------------
248
249 +-------------+-------------+---------------------------------------------+
250 | Software | Risk rating | Mitigation |
251 +=============+=============+=============================================+
252 | *Wordpress* | high | Regular updates, avoid unnecessary plugins, |
253 | | | Consider `Wordpress hardening`_ |
254 +-------------+-------------+---------------------------------------------+
255
256 .. todo:: `Wordpress hardening`_
257
258 .. _Wordpress hardening: http://codex.wordpress.org/Hardening_WordPress
259
260 Critical Configuration items
261 ============================
262
263 Keys and X.509 certificates
264 ---------------------------
265
266 .. sslcert:: blog.cacert.org
267 :certfile: /etc/ssl/public/blog.cacert.org.crt
268 :keyfile: /etc/ssl/private/blog.cacert.org.key
269 :serial: 11e837
270 :expiration: Mar 31 16:34:28 2018 GMT
271 :sha1fp: 69:A5:5F:3E:1B:D8:2E:CB:B3:AB:0B:E9:81:A6:CF:31:DF:C8:A4:5F
272 :issuer: CAcert.org Class 1 Root CA
273
274 * :file:`/etc/ssl/certs/cacert.org/` directory containing CAcert.org Class 1
275 and Class 3 certificates (allowed CA certificates for client certificates)
276 and symlinks with hashed names as expected by OpenSSL
277 * :file:`/etc/ssl/certs/cacert.org.pem` CAcert.org Class 1 certificate
278 (certificate chain for server certificate)
279
280 .. seealso::
281
282 * :wiki:`SystemAdministration/CertificateList`
283
284 .. index::
285 pair: Apache httpd; configuration
286
287 Apache httpd configuration
288 --------------------------
289
290 * :file:`/etc/apache2/cacert/blog.inc.conf`
291
292 Defines settings that are shared by the HTTP and the HTTPS VirtualHost
293 definitions. This file takes care of the PHP FCGI setup.
294
295 * :file:`/etc/apache2/cacert/headers.inc.conf`
296
297 Defines HTTP headers that are shared by the HTTP and the HTTPS VirtualHost
298 definitions. The file is included by
299 :file:`/etc/apache2/cacert/blog.inc.conf`.
300
301 * :file:`/etc/apache2/sites-available/blog-ssl.conf`
302
303 This file contains the HTTPS VirtualHost definition and defines client
304 certificate authentication for ``/wp-admin`` and ``/wp-login.php``.
305
306 * :file:`/etc/apache2/sites-available/blog-nossl.conf`
307
308 This file defines the HTTP VirtualHost definition and takes care of
309 redirecting ``/wp-admin`` and ``/wp-login.php`` to the HTTPS VirtualHost.
310
311 The following RewriteRule is used to redirect old blog URLs::
312
313 RewriteRule ^/[0-9]{4}/[0-9]{2}/([0-9]+)\.html$ ?p=$1 [R=302,L]
314
315 .. index::
316 pair: Wordpress; configuration
317
318 Wordpress configuration
319 -----------------------
320
321 * :file:`/srv/www/blog/wp-config.php` contains the Wordpress database
322 configuration. The rest of the Wordpress configuration is stored in the
323 database (assumption).
324
325 Tasks
326 =====
327
328 Planned
329 -------
330
331 .. todo:: setup IPv6
332
333 .. todo::
334 setup CRL checks (can be borrowed from :doc:`svn`) for client certificates
335
336 Changes
337 =======
338
339 System Future
340 -------------
341
342 .. todo:: system should be upgraded to Debian 9
343
344 Additional documentation
345 ========================
346
347 .. seealso::
348
349 * :wiki:`PostfixConfiguration`
350
351 References
352 ----------
353
354 Wordpress website
355 https://wordpress.org/