milestone update 4

Diamond Supply Co. Project and Portfolio II William Feller Full Sail University Table of Contents

Inventory ................................................................................................................................. 4 Custom Network ..................................................................................................................... 4 IDs and Passwords .................................................................................................................. 4 Network Topology Diagram .................................................................................................... 5 Node.js Application (Ghost) on Docker .................................................................................... 5 Install base CentOS 7 Virtual Machine “ITE229-docker (11)” .............................................................. 5 SSH into CentOS VM ........................................................................................................................... 5 Update CentOS ................................................................................................................................... 5 Install EPEL Packages .......................................................................................................................... 5 Install Docker CE ................................................................................................................................. 5 Start and Enable Docker ..................................................................................................................... 5 Test Docker (hello-world) .................................................................................................................... 5 Disable SELinux on CentOS 7 Virtual Machine .................................................................................... 5 Install Ghost Docker Container ........................................................................................................... 5 Test Ghost ........................................................................................................................................... 5 NginX Reverse Proxy ............................................................................................................... 6 Install base CentOS 7 Virtual Machine “ITE229-NginX (10) ................................................................. 6 SSH into CentOS VM ........................................................................................................................... 6 Update CentOS ................................................................................................................................... 6 Disable SELinux ................................................................................................................................... 6 Disable Firewall .................................................................................................................................. 6 Install EPEL Packages .......................................................................................................................... 6 Install NginX ....................................................................................................................................... 6 Start and Enable NginX ....................................................................................................................... 6 Reverse Proxy to Ghost Site ................................................................................................................ 6 Install WordPress on Ubuntu - LAMP Stack .............................................................................. 7 Base Ubuntu 18.04 Install ................................................................................................................... 7 Set Static IP ......................................................................................................................................... 7 SSH into Ubuntu VM ........................................................................................................................... 7 Update Ubuntu ................................................................................................................................... 7 Install and Configure Apache ............................................................................................................. 7

Inventory EQUIPMENT OPERATIING SYSTEM ADDITIONAL INFO IP ADDRESS Router/Custom Network Enter your OS - 10.10.229.1 Docker CentOS Ghost Container 10.10.229.11 NginX Reverse Proxy CentOS Reverse Proxy 10.10.229.10 Wordpress Ubuntu LAMP Stack running WordPress 10.10.229.12 Custom Network NETWORK NAME SUBNET IP SUBNET MASK DNS GATEWAY ITE229 10.10.229.0 255.255.255.0 10.10.229.1 10.10.229.1 IDs and Passwords ACCOUNT USER ID PASSWORD CentOS Root User root Fullsail1! CentOS Network User root Fullsail1! CentOS Host User [yourname] Fullsail1! MySQL Network User root Fullsail1! MySQL Host User [yourname] [randompassword] WordPress Admin admin [randompassword]

Network Topology Diagram Node.js Application (Ghost) on Docker INCLUDE SCREENSHOTS PER STEP LISTED BELOW Install base CentOS 7 Virtual Machine “ITE229-docker (11)” SSH into CentOS VM Update CentOS Install EPEL Packages Install Docker CE Start and Enable Docker

NginX Reverse Proxy INCLUDE SCREENSHOTS PER STEP LISTED BELOW Install base CentOS 7 Virtual Machine “ITE229-NginX (10) SSH into CentOS VM Update CentOS Disable SELinux Disable Firewall Install EPEL Packages Install NginX Start and Enable NginX

Reverse Proxy to Ghost Site

Install WordPress INCLUDE SCREENSHOTS PER STEP LISTED BELOW Clone WordPress Edit Ownership Edit .htaccess WordPress Configuration WordPress Configuration Process Test WordPress

WordPress Security Settings and Configurations Security Summary WordPress is a popular content management system used to create and manage websites. Due to its widespread usage, it is important to ensure the security of a WordPress website in order to protect sensitive information and prevent malicious attacks. This can include measures such as using strong passwords and regularly updating the website's software to address security vulnerabilities. Additionally, using security plugins and implementing best practices for user account management can also help to enhance the security of a WordPress website. The .htaccess file is a configuration file used by the Apache web server to control various settings for a website, including security settings. By editing the .htaccess file, you can prevent hackers from accessing specific files or directories on your website. One way to do this is by using the "Deny" directive to block specific IP addresses or ranges from accessing your website. For example, you can use the following code to block all access to your website from a specific IP address: Order Deny,Allow Deny from 12.34.56.78 Another way to use the .htaccess file to improve security is by using the "FilesMatch" directive to restrict access to specific files or file types. For example, you can use the following code to block access to all PHP files in a specific directory: <FilesMatch "\.php$"> Order Deny,Allow Deny from all </FilesMatch> It's also important to note that editing the .htaccess file can also cause errors or break your website if not done properly, so it is recommended to have a backup of the file before editing. Additionally, it's worth noting that editing the .htaccess file may not be enough to secure your website, it's important to keep software and plugin updated and use other security measures like using a web application firewall, SSL certificates, and regular security scans.

Testing and Validation Process INCLUDE SCREENSHOTS OF EACH CATEGORY (FILE PERMISSIONS AND CHANGING THEM, SECURING WP-CONFIG.PHP, AND CONFIGURATION OF FIREWALL) WordPress Security Conclusion Security is important in regards to defense in depth because it creates multiple layers of protection for a system or network. This approach helps to prevent a single point of failure and can make it more difficult for an attacker to penetrate the system. Defense in depth can be applied to computer systems in the real world by implementing a combination of technical and non-technical controls such as firewalls, intrusion detection systems, encryption, access controls, and security policies. This can help to protect against a wide range of threats, including malware, hackers, and unauthorized access. Additionally, regular security assessments and testing can help to identify vulnerabilities and ensure that the system remains secure over time.