Build and install SSH2 libraries

Depending on your linux distribution you might need to use different method. On my Debian, I had to use the following to install:

#  wget http://downloads.sourceforge.net/project/libssh2/libssh2-1.2.1.tar.gz?use_mirror=kent
#  tar zxf libssh2-1.2.1.tar.gz
#  cd libssh2-1.2.1
#  ./configure
#  make
#  make install

What’s important here is that I had to build libssh2 from sources manually. However I hate doing this, it was apparently the only way. Aptitude was only offering me an older (0.12) version of the library, which failed to build PHP ssh2 extension.

Build and install PHP SSH2 extension

Now again, for some reason simple command failed to work for me… So I had to specify beta channel to install PHP SSH2 extension. Fear not though, just try this

#  pecl install ssh2

And if it doesn’t work, then do this

#  pecl install channel://pecl.php.net/ssh2-0.11.0

Simple, isn’t it?

Generate SSH public and private keys

You need to generate both public and private keys that are going to be used to connect to your server (even if it is the same server your connecting from!). Go to your home directory:

$ cd .ssh
$ ssh-keygen 
Generating public/private rsa key pair.
Enter file in which to save the key (/home/user/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /home/user/.ssh/id_rsa.
Your public key has been saved in /home/user/.ssh/id_rsa.pub.
The key fingerprint is:
fe:3b:5d:94:53:1e:d3:9f:87:45:73:ab:8d:9f:d7:cc user@server
$ cp id_rsa.pub authorized_keys

Private key is used to decrypt the data, whereas public key is used by the remote host to encrypt the data. You also need to create authorized_keys file, so that server knows your key is trusted and allows you to login without using actual user account password.

There is one annoying bit though. Apache user needs to be able to read both private and public keys. Normally they are kept secure in user’s .ssh/ directory, which is readable by user only, and allowing all to see it, is not a particularly good idea. So I had to copy both files to /etc/wordpress/ and make them readable to www-data group:

#  cd /etc
#  mkdir wordpress
#  cp /home/user/.ssh/id_rsa* wordpress/
#  chgrp www-data wordpress/*
#  chmod 640 wordpress/*

Configure WordPress to use public keys automatically

Add the following lines to your wp-config.php file, so you’re not asked any passwords or server names during the upgrade:

define('FTP_PUBKEY','/etc/wordpress/id_rsa.pub');
define('FTP_PRIKEY','/etc/wordpress/id_rsa');
define('FTP_USER','user');
define('FTP_PASS','');
define('FTP_HOST','localhost:22');

Related posts:

1. Securing WordPress
2. Building python 2.6.4 RPM for CentOS 5.4
3. Building and running Google Chrome OS on VirtualBox

Software development is really complex process and although  WordPress developers take security very seriously, you should also take extra measures to ensure safety and security of your blog/web site.

There are few simple steps to make your WordPress installation lot harder for attacker to compromise.

WordPress software

Always keep up to date. Flaws in security model are being identified and addressed immediately as soon as they are reported. So it’s important for you to always keep your WordPress installation up to date. It’s very easy to do now that WordPress has automatic update feature, where all you have to do is just to tell it to install the newer version of it.

File permissions

You need to make sure that webserver can modify only those files that it is allowed to. Do not rely on WordPress to enforce this, use file system permission model. All files in WordPress installation need to be owned and writeable to by the user that installed the system and not the user which is used to run webserver. Only exceprion to this is /wp-content/ directory, which contains uploaded contents.

Make sure you perform all actions in whatever your WordPress installation directory is, and not outside of it!

Let’s make all files owned by your user and set the group to web server group:

$ sudo chown -R myuser.www-data *

Then change all file permissions so that files can be written to by your user only, and read-only by other users:

$ find . -type d -exec chmod 755 {} \;
$ find . -type f -exec chmod 644 {} \;

Finally allow group write for wp-content/ directory, so that web server can do automatic updates for plugins and user content could be uploaded:

$ chmod -R g+w *

Secure wp-admin access

WordPress recommend using additional plugins and HTTP authentication to provide additional security to the administration pages, but I think this is not necessary if you implement the following two security measures: enforce SSL only traffic to /wp-admin/ and allow access only from certain IP addresses.

Make /wp-admin/ available on SSL connection only, so all traffic to and from (including passwords) is encrypted. This prevent attackers hijacking traffic and intercepting passwords and other sensitive data.

This may sound bit complicated, but bear with me, it’s not that scary as it may look like. So you will need two <VirtualServer> directives: one for normal web traffic and one for SSL.

In default HTTP definition, you then need to make a special case for /wp-admin/ URL, and enforce redirection to HTTPS, so whenever you try to access wp-admin/ using http:// you will be redirected to https:// instead. HTTPS VirtualHost on it turn has instructions to deny access from all, but only the IPs listed in the configuration:

<VirtualHost server_ip:80>
    ServerName example.com
    ServerAlias www.example.com
    DocumentRoot /var/www/virtual/www.example.com
    ErrorLog /var/log/apache2/www.example.com-error.log
    CustomLog /var/log/apache2/www.example.com-access.log combined
    <Location /wp-admin/>
        RewriteEngine on
        RewriteRule ^(.*)$ https://%{SERVER_NAME}/wp-admin/ [R=permanent,L]
    </Location>
</VirtualHost> 

<VirtualHost server_ip:443>
    ServerName example.com
    ServerAlias www.example.com
    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/example.com.pem
    SSLCertificateKeyFile /etc/ssl/private/example.com.key
    DocumentRoot /var/www/virtual/www.example.com
    ErrorLog /var/log/apache2/www.example.com-error.log
    CustomLog /var/log/apache2/www.example.com-access.log combined
    <Location /wp-admin>
        Order deny,allow
        Deny from all
        Allow from trusted_ip_1
        Allow from trusted_ip_2
    </Location>
</VirtualHost>

Other security measures

Install WP Security scan plugin which will provide a good overview of how your installation looks like from the security point of view.

Also remove advertising of the WordPress version that you are using. Add the following line to functions.php file, which you are using:

remove_action('wp_head', 'wp_generator');

And did I mention that you need to make regular backups?…

Related posts:

1. Use SSH to upgrade WordPress plugins automatically
2. Basic Apache security
3. Essential WordPress plugins

Right, back to business. So I decided to write a WordPress plugin. There were few reasons I wanted to do that:

• See how difficult it is and what WordPress looks like under the hood
• Since I’m using WP, which is a PHP shop I needed to remind myself how PHP looks like
• Get some more publicity and bump up the Google rating (that’ll never hurt, will it?)

So, I remembered seeing this neat trick of reversing, or flipping over text by replacing regular ASCII latin characters with Unicode ones that resemble a mirror image of the original ones. There are numerous websites out there on the wild internets that would swallow your piece of texts and then spit out same text, but flipped over.

As you can see it is still text information, no magic with images or anything like that. You can select, copy-paste, etc.

So, I thought, right, let’s see if there was someone smart who has created a plugin for WordPress that would do this. Not that I’m a big fan of flipped over text, but just to make sure that I’m not reinventing the wheel. At the end of the day, what’s the point in creating something that’s already been build. If such plugin existed, I would have had to think of something else. Lucky for me, no one has yet created anything like it.

So, simple idea, just what I need to warm up.

First things first, go and read official manual from WordPress about how to develop plugins. It’s a really good manual, and everyone developing a plugin must read it. Or read it if you feel you need more details in following my manual…

All plugins go into /wp-content/plugins/ directory in your WordPress installation. Each plugin has it’s own directory, but this isn’t a strict requirement, but if you’re not creating a directory for your plugin, it must be just a single PHP file. I’d advise to create a directory for your plugin.

Right, this is how I saw me implementing this: user types in any text in the post (or page, or comment, or even excerpt) and encloses any text he/she wants to flip over in my new (made up) tags, just like that:

<upsidedown>your text</upsidedown>

Because WordPress does some clever validation of the text and only certain tags are allowed, I had to include this code in my plugin to declare my new tags as valid ones:

if (!CUSTOM_TAGS) {
    // allow new tag in the posts
    $allowedposttags['upsidedown'] = array();
    // ... and also in the comments
    $allowedtags['upsidedown'] = array();
}

Next thing is to register new filter function with WordPress. Hold on, what is this filter function? Filter function is a function that WordPress calls and passes contents of the post to it. Filter function can do anything it likes to the text and then spits is back to WordPress engine. WordPress will then pass the result to another filter, and so on and on until there are no more filter registered. Each filter get a priority flag assigned, and those with priority 0 will get executed before those that have priority 10. By default each filter gets priority 6 assigned to them.

Right, going back to my filters, let’s register them:

add_filter('the_content', 'flip_text_upside_down_filter');
add_filter('the_excerpt', 'flip_text_upside_down_filter');
add_filter('comment_text', 'flip_text_upside_down_filter');

As you can see, I register my filter with three types of content: post (or page), excerpt and comment.

Next thing is to define the filter function:

function flip_text_upside_down_filter($content)
{
    return preg_replace_callback(
        '/\s*<upsidedown>(.*)<\/upsidedown>/siU',
        'convert_to_upsidedown_unicode',
        $content
    );
}

WordPress is going to call it with a parameter that contains content text in it. I pass the contents to PHP function preg_replace_callback, which matches the regular expression (any text in between my tags) and calls another function with the contents of the regular expression match (hope that makes sense to you, if not, read the sentence again, repeat until you got it… ).
Finally, a function that actually does the conversion. Which is pretty simple – go through all characters and replace them with matching Unicode chars from the table. I’m not including the whole table here, you can download source code from WordPress plugins directory (in fact, if you install the plugin – you’ll have the sourcecode in your plugins/ directory):

function convert_to_upsidedown_unicode($match)
{
    // conversion table
    $flipTable = array(
...
    )
    $origStr = strrev($match[1]);
    $newStr = ' ';
    for ($i = 0; $i < strlen($origStr); $i++) {
        $ch = $origStr[$i];
        if (array_key_exists($ch, $flipTable)) {
            $newStr .= $flipTable[$ch];
        } else {
            $newStr .= $ch;
        }
    }
    return $newStr;
}

This is it. Well, ok nearly it. You still need to do the boring bit, ie put a formal header so WP recognises your plugin code (put this, replacing what’s necessary accordingly):

/*
Plugin Name: Upside Down Text
Plugin URI: http://www.grenadepod.com/projects/upside-down-text-plugin-for-wordpress/
Description: This plugin allows to "flip" any section of text upside down
Version: 1.1.0
Author: Grenadepod
Author URI: http://www.grenadepod.com
*/

Now you can activate the plugin from your WP admin console, and start typing text that everyone struggles to read.

Sooner or later you’ll notice that the implementation is not ideal. When you switch over to visual editor (which I use most of the time) and then back to HTML editor, all “new” tags are gone. This is because the editor does not know about them and so it removes them. Solution was to type in text in Visual (if you prefer to use it) then switch to HTML and place tags where needed. Save without switching back, and publish.

This wasn’t really nice, and I wasn’t going to get lots of users with this approach. Some nice soul on WordPress forum suggested to have a look at Shortcode API. This API allows plugin to register shortcode that looks like: [somethinghere]content[/somethinghere], and passes all content back to your function. And this would be immune to switching between editors issue.

So I decided to make a second release of the plugin, where shortcodes are supported alongside with tags. And in fact using shortcodes not only allows me to type them in directly in the Visual editor, but also coding is simpler, I don’t need to do any regexp magic.

Register my new shortcode:

add_shortcode('upsidedown', 'flip_text_upside_down_shortcode');

And define what function to call:

function flip_text_upside_down_shortcode($atts, $content=null)
{
    return convert_to_upsidedown_unicode(array('', $content));
}

As you can see, I’m reusing same character conversion function, so the changes were minimal.

All seems to be working quite fine, at the end of the day, what can go wrong with only few lines of code?…

Related posts:

1. Securing WordPress
2. Essential WordPress plugins
3. Use SSH to upgrade WordPress plugins automatically

Yes, it did add the link, but not where I wanted it to add. I want ‘About’ link to be at the end of the list. Always. However it seems that there’s no way of changing the order in the link category, and the links appear based on the link IDs. So the only way to resolve this, is to change link_id of the ‘About’ link to something big, let’s say 10’000. I’m never going to have that many links , so 10’000 sounds like a sound choice.

Go to your database and select all links:

+---------+---------------------------------------------------+
| link_id | link_url                                          |
+---------+---------------------------------------------------+
...
|       8 | http://www.grenadepod.com/category/news/          |
|       9 | http://www.grenadepod.com/about/                  |
|      10 | http://www.grenadepod.com/category/it-technology/ |
+---------+---------------------------------------------------+
10 rows in set (0.00 sec)

Now change the link_id:

mysql> update wp_links set link_id=10000 where link_id=9;
Query OK, 1 row affected (0.00 sec)
Rows matched: 1  Changed: 1  Warnings: 0
 
mysql> select link_id, link_url from wp_links;
+---------+---------------------------------------------------+
| link_id | link_url                                          |
+---------+---------------------------------------------------+
...
|       8 | http://www.grenadepod.com/category/news/          |
|      10 | http://www.grenadepod.com/category/it-technology/ |
|   10000 | http://www.grenadepod.com/about/                  |
+---------+---------------------------------------------------+
 
10 rows in set (0.00 sec)

All done, all fixed and here’s how the menu looks now:

Related posts:

1. Top level menu in Arras theme
2. Essential WordPress plugins

1. Akismet. If you plan using comments (who doesn’t?) you most definitely need this one. This plugin will check any new comment against it’s spam database and if it thinks it is spam – it will not allow it to show up on your site. So no more penis enlargement pill comments… Apparently 83% of comments are spam. It comes in a default installation and also requires WordPress API key. Plugin website.
2. All in One SEO Pack. Makes your website more search engine friendly. Not really sure how critical is that, but I tent to just install these plugins, just in case. Plugin website.
3. Amazon Affiliate Link Localizer. This one is quite handy if you’re advertising Amazon products on your site. Problem with Amazon is that you will not earn a penny if you advertise Amazon.com product and german user clicks and buys it off Amazon.de. This plugin detects the location of the user and display appropriate Amazon website link. Plugin website.
4. Contact Form 7. Simple contact form. Yet quite extensible, allows you to add custom fields, email forwarding, etc. Plugin website.
5. Easy AdSense. Another must have for those who want to place their GoogleAds on the blog. Although it’s primarily meant for placing GoogleAd code, you can use it for other affiliate networks as well. Plugin website.
6. FollowMe. Everyone’s on Twitter these days right? This plugin displays a Twitter “FollowMe” link on your blog. Plugin website.
7. Google Analytics for WordPress. Another plugin to make your website and Google friends. Adds Google Analytics code to all your pages. Plugin website.
8. Google XML Sitemaps. Yup, they want sitemaps as well. So Let’s provide them with some. Very simple and easy to configure. Plugin website.
9. Inline Posts. This one allows you to include posts in your pages. I mean any page. Let’s say if for whatever reason in your about page you decide to add posts – now you can with this plugin. Plugin website.
10. Sociable. Puts links to all gazillion social networking websites that are out there, so people who enjoy reading your posts can spread the joy and love. And yes, you can only select those that you like. Plugin website.
11. WordPress.com Stats. Kind of redundant if you use Google analytics, but I like the ability to quickly check how the blog is doing in terms of visitors, etc. Also requires WordPress account. Plugin website.

As I said, this is just the beginning. These are bare necessity to get you online in a good shape. Add more to your taste afterwards…

Update 1

Just when I started writing my first post about coding, I realised that simple <pre> tag is way too boring and I want something juicier. So there it is, a plugin that adds syntax highlight to the code syntax snippets in your posts. It extends simple <pre> so that you can say <pre lang=”python”> and it’ll render nicely highlighted syntax:

• WP-syntax. Plugin website.

Related posts:

1. Disabling columns for specific pages
2. Top level menu in Arras theme
3. Developing my first WordPress plugin

Still haven’t thought the exact structure as just yet, but I see it coming.

Anyway, again, being a complete dummy when it comes to WordPress configuration, I struggled with the top menu. From the first glance at the Arras theme config it seemed that I can either link to site pages or categories. So what I want is this: links to some (not all, just some!) categories and a link to a page (to be precise: about page). Neither of the two provided me with this functionality.

There is a third option, that I overlooked: link category. It allows you to pick a link category, such as blogroll, and display all links in the menu. Yeah right, why would I need that, I thought. But then it clicked – I can put any links I want, like links to my categories and pages and display it there. I can even link to individual posts.

How cool is that?! There’s one (or may be more, but I haven’t come across them yet) drawback – you need to specify all links manually. Would be really nice if I could just select from all the resources available on my site.

Related posts:

1. Changing menu order
2. Disabling columns for specific pages
3. Essential WordPress plugins

So far I’ve only installed few themes, and basic plugins, mostly to get stuff like Google Ads and Analytics working, nothing too spectacular.

I was playing with Google search and got an idea of replacing the default WordPress search with GoogleSearch. There’s one issue though, I have two options:

• Redirect users to Google page, which isn’t ideal, I want them stay
• Display search results on my website

I opted for the second option, however it poses few issues – I have 2 column layout (and will possibly add 3rd one at some stage). Google results are best displayed in a single column view (debatable, but that’s my taste at the moment, which may change in the future).

So, how do I make specific pages single column? After some Googling I’ve come across this post, which seems to work fine for me.

Related posts:

1. Essential WordPress plugins
2. SEO is killing Google
3. Top level menu in Arras theme