WPM

The automagical WordPress Mangler

SUMMARY

WPM began life, as many things do, as a simple script to automate tedium. Working nights at a managed webhosting company and datacenter, you have a bit of time. I was tired of constantly being asked to install WordPress, and I was even more tired of being asked to do really stupid things for customers regarding their WordPress installations. Naturally, the first two things that wpm did were installations and backups. Overtime, this script grew to become a truly useful tool. It makes a few assumptions based upon its place of origin, and it may not be suitable for everyone. For example, it assumes that there could be more than one site on any given machine, it assumes that you do not want the web process to have write access to the filesystem, and it assumes that your server has access to the internet for a few of its functions.

CONFIGURATION

WPM calls $PREFIX/etc/wpm/wpm.conf for those environmental options that it has. You should check these before using in a production environment.

INSTALLATION

As root, just type make install within this archive. There is one configurable option within the make file, and that is the installation prefix. It will default to /usr/local. The script assumes it is running as root, and the install will set permissions accordingly. Usage information is available with wpm --help. There is a make uninstall as well if you decide you hate it, and there is a make reinstall if you modify something and make the script worse.

USAGE

Try using wpm --help

sudo wpm -h
wpm version 4.1.1

-r       rename a wordpress installation
-c       copy a wordpress installation
-i       install wordpress
-u       update a wordpress installation
-p       attempt to set sane permissions on a WP installation
-d       delete a wordpress installation
-b       backup a wordpress installation
-w       change a wordpress user's password
-e       change wpm settings
-s       search for wordpress installations
-m       find and update wordpress installations
-v       verify a wordpress installation

Note that you can also do stuff like sudo wpm -h -b

NOTES

The --install function, by default, configures WordPress to use ftpsockets for FS_METHOD. This will require that you have an FTP server running even if it's only listening on 127.0.0.1. This same assumption is made by the --permissions function. Both --install and --permissions will set the user and group such that the web process is not the owner of the files, and that the web group will have read access only. This is to attempt to prevent file injection. The --permissions function does make permission settings backups if the getfacl command is available. FTP sockets configuration can be skipped via the --skip-ftp for both -i and -u.

The --verify function requires maldet and clamdscan if you wish to use the --scan option. The --md5 option will download a copy of the installed WP version from WordPress.org and will md5 every file and compare. If you select the --replace option, any file will get replaced if a difference is detected. The --replace option also enables quarantining in --scan. It is highly recommended to only use --replace if you use --backup.

Installation of dependencies for --verify is as follows on Ubuntu:

sudo apt install clamdscan -y
sudo -s
cd /usr/local/src/
wget http://www.rfxn.com/downloads/maldetect-current.tar.gz
tar -xzf maldetect-current.tar.gz
rm -f maldetect-current.tar.gz
cd maldetect-*
bash ./install.sh
ln -s /usr/local/maldetect/maldet /usr/local/bin/

You may notice that the --mangle function has an option for skipping search. This is because the --search function will generate lists in $TEMPDIR which can be modified, should you wish to skip a particular installation.

The --delete function will NOT remove the FTP user used for ftpsockets.

LICENSE

This software is licensed under terms of the Absurd License 2.0.6. Please see the LICENSE file.