Lockdown Option

JohnB

It would be nice to have a "lockdown" option which basically sets the entire website directory and sub directories to read-only. There is another panel I ran across once that had this integration with wordpress and updates still worked because the panel update process had write permissions.

Everyone knows most malware will edit wordpress core files or other plugins or create new php files that their CC server can hit to reinstall malware. If the linux user doesn't have permissions to create/edit files you completely remove that attack vector.

This is also useful in some types of malware removal to avoid malware replicating. Average users won't know how to go into SSH and run chmod/chown. If you want to allow self malware cleanup having a nice lockdown option you can tell them to use would be nice.

AdamM

Big +1
Another good option would be to reinstall the WordPress core files. Plesk has this feature. In this malware situation, it would replace infected files.

JohnB

AdamM We would just use wp CLI or wget unzip but for the end user this would be great too! +1

Reinstalling public plugins could also be an option. Not sure how hard it is to automate downloading a plugin from the wordpress repo @ specific version instead of the latest. Should obviously have a big warning that side affects could occur and should require a successful auto backup first.

JohnB

AdamM Sorry for double reply but I'm curious if you know if a tool I want exists. I haven't found anything for linux asside from features in expensive and heavy server managment services.

Basically I want a web GUI tool that displays a log of directory changes in realtime and historically.

I'm aware of inotify, incron and this library https://pythonhosted.org/watchdog/ which is probably what such a tool would rely on.

As an example, I would like to open the webpage and see website directory changes in realtime or view logs from between 2 and 5pm yesterday. If the search/filter function was good, it could be useful for troubleshooting updates, user error, malware removal and forensics.

Do you know of anything like this that already exists?

Do you think this would be worth adding such functionality to enhance?

psybox

JohnB it sound like you are looking for auditor tools perhaps. There are a lot although I’ve only really come across them in windows environments. Netwrix is a popular one and has some free tools last time I checked

AdamM

JohnB
Unfortunately, I've never used such a tool and haven't looked for it.
Maybe you'll find something here?

https://github.com/awesome-selfhosted/awesome-selfhosted

https://github.com/awesome-foss/awesome-sysadmin

JohnB

psybox auditor tool

Yeah I've seen these features in heavy auditor tools but I'm thinking more along the lines of just a simple script you run or even a docker image with access to the folder you want to monitor. Just launch it and its monitoring. It really wouldn't be that hard to make. Maybe I should just do it myself lol.