A little security is better than no security :D If you are self hosting a wordpress.org blog on some shared server or VPS it is good idea to secure the Admin panel using HTTPS. I have recently enabled this security on this blog by using self signed certificate. Before we dig into details lets check some basics of SSL or HTTPS.
What is SSL?
SSL is the standard for exchanging information securely–via cryptographic encryption–between a website and the browser. SSL is a way to establish a trusted connection between the server and a web browser. Once that relationship is in place the server will encrypt data before transmitting it in a way that only its intended recipient i.e. browser can decrypt it.
This method of security accepts the fact that any data transmitted over the internet can, and likely will be, intercepted at anytime by a hacker or a government agency fishing for information. By sending the data encrypted, we ensure that if anyone but the intended recipient gets the data they will have what is effectively gibberish. Giving them gibberish is preferable to giving them confidential correspondence, private records, credit card numbers or any other private data.
Using SSL requires that your server has a valid SSL certificate installed. An SSL certificate, which must be purchased, tells the browser important details about your sites security. In most browsers, when you go to a secure site, you will see a lock or similar icon in the address bar, showing you details about the SSL certificate.
Once your SSL certificate is installed, when someone visits your website they will be able to access it via secure HTTP, or HTTPS. When we say “using SSL” what we mean is that the exchange of information between the server and browser is happening via the HTTPS protocol instead of the unsecured HTTP protocol. Doing so requires a valid SSL certificate.
What are Self-signed certificates?
As noted earlier in order to secure a website using HTTPS we need an SSL certificate. Usually to build the trust, the SSL certificate is issued from an authority known as Certificate Authority (CA) like Verisign. These CA issued certificates are also known as signed certificates. As they are usally issued by verifing the domain authority and business. Depending upon which CA is used, the domain is verified and a certificate is issued. Verisign and other more trusted CAs will verify the existence of the business in question and the ownership of the domain to provide a bit more security that the site in question is legitimate.
Due to all these varification steps, the signed certificates are not free. You have to pay a yearly fee to get a signed certificate from CA. To avoid this, self signed certificate can be utilized. Self signed certificates are exactly similar to signed one in terms of security. The only difference is that user will see a warning in most mordern browsers if the site they are visiting is signed using self-signed certificate. So self signed certificate are best suited from test servers, Intranet applications or admin consoles for self hosted wordpress.
How to create Self-signed certificates?
First step to secure your wordpress admin panel using HTTPS is creating a self-signed certificate. There are number of tools you can use to generate certificates (openssl, Java keytool, Adobe Reader, Apple keychain). We will stick to the most common tool available on linux flavors like Ubuntu – openssl. Let’s get started.
Step 1: Verifiy is Openssl is installed
First check if openssl is available. Run following command and see if it gives openssl folder.
$ which openssl /usr/bin/openssl
If openssl is not available then install the same using apt-get:
$ apt-get install openssl
We have openssl installed so lets proceed with other steps.
Step 2: Generate an RSA private key
First generate RSA private key using openssl. This key is a 1024 bit RSA key which is encrypted using Triple-DES and stored in a PEM format so that it is readable as ASCII text.
$ openssl genrsa -des3 -passout pass:x -out server.key 1024 Generating RSA private key, 1024 bit long modulus ...++++++ ....++++++ e is 65537 (0x10001) $
Private key is generated in file server.key.
Step 3: Remove Passphrase from server key
We need to remove the Passphrase from the server key. Otherwise everytime when Apache server will restart we have to enter this key. Its better we remove the passphrase key.
First create copy of server.key file.
$ cp server.key server.key.out
Next remove the passphrase key and overwrite it on server.key.
$ openssl rsa -passin pass:x -in server.key.out -out server.key writing RSA key
Remove temporary file server.key.out
$ rm server.key.out
Now all we have left with is a server.key without any passphrase.
Step 4: Generate a CSR (Certificate Signing Request)
Let’s now generate a CSR file which we later use to create certificate. The CSR is used in one of two ways. Ideally, the CSR will be sent to a Certificate Authority, such as Verisign who will verify the identity of the requestor and issue a signed certificate. The second option is to self-sign the CSR, which will be demonstrated in the next section.
$ openssl req -new -key server.key -out server.csr You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:IN State or Province Name (full name) [Some-State]:Karnataka Locality Name (eg, city) []:Bangalore Organization Name (eg, company) [Internet Widgits Pty Ltd]:ViralPatel.net Organizational Unit Name (eg, section) []: Common Name (eg, YOUR name) []:viralpatel.net Email Address []:viralpatel.net@gmail.com Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []:
Step 5: Generate SSL self signed certificate
Let us generate the certificate using CSR and private key we created earlier.
$ openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt Signature ok subject=/C=IN/ST=Karnataka/L=Bangalore/O=http://ift.tt/1dfuIzm Getting Private key
Now we should have 3 files present in current directory.
$ ls server.crt server.csr server.key
server.crt is the self-signed certificate and server.key is the private key.
Securing WordPress Admin with HTTPS
We can now install it in Apache and configure wordpress to use it.
Step 1: Moving the certificates to apache folder
Copy the newly created certificate and private key file in Apache’s SSL configuration.
$ cp server.crt /usr/local/apache/conf/ssl.crt $ cp server.key /usr/local/apache/conf/ssl.key
for Ubuntu
$ cp server.crt /etc/ssl/certs/ssl.crt $ cp server.key /etc/ssl/private/ssl.key
Step 2: Configure Apache to use SSL certificate
Let us enable the Apache’s SSL module and default-ssl site.
$ sudo a2enmod ssl $ sudo a2ensite default-ssl $ sudo service apache2 restart
Once you do that you will see /etc/apache2/sites-available/default-ssl file available in apache. Open the file and check if DocumentRoot is pointing to corrrect root.
<IfModule mod_ssl.c>
<VirtualHost _default_:443>
ServerAdmin webmaster@localhost
DocumentRoot /var/www/<user>/public_html/
<Directory />
Options FollowSymLinks
AllowOverride None
</Directory>
Almost done. Now enable wordpress SSL configuration for Admin.
Open wp-config.php file from your wordpress installation folder. And add following line.
define(‘FORCE_SSL_ADMIN’, true);
Step 3 – Test your SSL Setup
Open your website in a your favorite web browser. If everything goes well, you’ll see a warning saying the certificate is not verified.
Accept the certificate exception. But before accepting it verify the SHA/MD5 fingerprints to make sure its yours.
That’s it. Your WordPress Admin dashboard is secured using HTTPS and self-signed certificate.
The post How to secure WordPress Admin with HTTPS – Self-signed certificate appeared first on ViralPatel.net.
via ViralPatel.net http://ift.tt/1QPpwVw
Apowersoft Video Converter Studio is a powerful video editing suite that can convert numerous types of video formats, such as AVI, MP4, FLV, and MKV. The application is also capable of converting audio formats, such as MP3, MP2, OGG, and AAC.
The features which are present in other BitTorrent clients are here in µTorrent, including scheduling, bandwidth prioritization, RSS auto-downloading and compatibility with BitComet-Mainline DHT. µTorrent also supports peer exchange and the Protocol Encryption joint specification (compatible with Vuze / Azureus 2.4.0.0 and above and BitComet 0.63 a...
Simple screenshots are taken with Print-Key and MS Paint. For anything more advanced, like manuals, tutorials or presentations, Techsmith SnagIt is the tool of choice. The powerful screen capturing and image manipulation software records stills and videos. Other than traditional full screen the capturing area can be set to window, region or scrolli...
K-Meleon is an extremely fast, customizable, lightweight web browser based on the Gecko layout engine developed by Mozilla which is also used by Firefox. K-Meleon is free, open source software released under the GNU General Public License and is designed specifically for Microsoft Windows (Win32) operating systems.
Glary Utilities is a free system cleaner and performance booster for your Windows PC. The easy-to-use and intuitive interface features one-click functionality and easy, automated options that give you the choice of either a 1-Click maintenance or a custom selection of operations.
