{"id":810,"date":"2011-12-19T02:36:29","date_gmt":"2011-12-19T02:36:29","guid":{"rendered":"http:\/\/congnghepc.com\/2011\/12\/19\/11-meo-bao-mat-danh-cho-blog-wordpress\/"},"modified":"2011-12-19T02:36:29","modified_gmt":"2011-12-19T02:36:29","slug":"11-meo-bao-mat-danh-cho-blog-wordpress","status":"publish","type":"post","link":"https:\/\/tapchicntt.com\/11-meo-bao-mat-danh-cho-blog-wordpress\/","title":{"rendered":"11 m\u1eb9o b\u1ea3o m\u1eadt d\u00e0nh cho blog WordPress"},"content":{"rendered":"

\n\t1. Mã hóa thông tin \u0111\u0103ng nh\u1eadp:<\/h2>\n

\n\t\u0110ây là \u0111i\u1ec3m c\u1ea7n quan tâm \u0111\u1ea7u tiên c\u1ee7a chúng ta t\u1ea1i \u0111ây là m\u1ed7i khi \u0111\u0103ng nh\u1eadp thì m\u1eadt kh\u1ea9u s\u1ebd không \u0111\u01b0\u1ee3c mã hóa mà truy\u1ec1n th\u1eb3ng vào c\u01a1 s\u1edf d\u1eef li\u1ec7u l\u01b0u tr\u1eef. N\u1ebfu b\u1ea1n truy c\u1eadp \u1edf n\u01a1i công c\u1ed9ng thì c\u01a1 h\u1ed9i dành cho hacker \u0111\u1ec3 “nhòm ngó” và l\u1ea5y c\u1eafp thông tin này là r\u1ea5t l\u1edbn nh\u1edd vào các ph\u1ea7n m\u1ec1m Keylogger <\/b>ho\u1eb7c \u1ee9ng d\u1ee5ng khác. Tuy nhiên, chúng ta hoàn toàn có th\u1ec3 kh\u1eafc ph\u1ee5c \u0111\u01b0\u1ee3c v\u1ea5n \u0111\u1ec1 này b\u1eb1ng plug – in Chap Secure Login<\/a> v\u1edbi ch\u1ee9c n\u0103ng chính là gán thêm nh\u1eefng \u0111o\u1ea1n mã hash ng\u1eabu nhiên vào chu\u1ed7i ký t\u1ef1 m\u1eadt kh\u1ea9u, sau \u0111ó ti\u1ebfn hành xác nh\u1eadn tính h\u1ee3p pháp c\u1ee7a tài kho\u1ea3n v\u1edbi giao th\u1ee9c CHAP<\/a>.<\/p>\n

\n\t2. Ng\u0103n ch\u1eb7n Brute Force Attack:<\/h2>\n

\n\t\"11<\/a><\/p>\n

\n\tTrên th\u1ef1c t\u1ebf, tin t\u1eb7c hoàn toàn có th\u1ec3 b\u1ebb gãy m\u1eadt kh\u1ea9u \u0111\u0103ng nh\u1eadp c\u0169ng nh\u01b0 thông tin xác nh\u1eadn c\u1ee7a ng\u01b0\u1eddi dùng b\u1eb1ng cách s\u1eed d\u1ee5ng c\u01a1 ch\u1ebf Brute Force Attack<\/a>. \u0110\u1ec3 gi\u1ea3m thi\u1ec3u nguy c\u01a1 này, các b\u1ea1n hãy s\u1eed d\u1ee5ng plug – in Login LockDown<\/a> dành cho WordPress<\/b>. Ti\u1ec7n ích này s\u1ebd ghi l\u1ea1i toàn b\u1ed9 thông tin m\u1ed7i khi có yêu c\u1ea7u truy c\u1eadp t\u1eeb 1 \u0111\u1ecba ch\u1ec9 IP nào \u0111ó th\u1ef1c hi\u1ec7n nhi\u1ec1u l\u1ea7n \u0111\u0103ng nh\u1eadp vào h\u1ec7 th\u1ed1ng WordPress<\/b>, sau m\u1ed9t s\u1ed1 l\u1ea7n \u0111\u0103ng nh\u1eadp th\u1ea5t b\u1ea1i nh\u1ea5t \u0111\u1ecbnh nào \u0111ó thì h\u1ec7 th\u1ed1ng s\u1ebd khóa ch\u1ee9c n\u0103ng truy c\u1eadp, c\u0169ng nh\u01b0 t\u1ea5t c\u1ea3 yêu c\u1ea7u khác t\u1eeb \u0111\u1ecba ch\u1ec9 \u0111ó.<\/p>\n

\n\t3. S\u1eed d\u1ee5ng m\u1eadt kh\u1ea9u theo \u0111úng tiêu chu\u1ea9n:<\/h2>\n

\n\t\u0110ây là \u0111i\u1ec1u r\u1ea5t c\u01a1 b\u1ea3n, nh\u01b0ng có v\u1ebb nhi\u1ec1u ng\u01b0\u1eddi v\u1eabn không áp d\u1ee5ng chu\u1ea9n xác, \u0111ó là l\u1ef1a ch\u1ecdn và s\u1eed d\u1ee5ng m\u1eadt kh\u1ea9u ph\u1ee9c t\u1ea1p nh\u01b0ng v\u1eabn ph\u1ea3i d\u1ec5 nh\u1edb, ng\u01b0\u1eddi khác khó \u0111oán, không dùng nh\u1eefng chu\u1ed7i thông tin quen thu\u1ed9c nh\u01b0 tên ng\u01b0\u1eddi thân, s\u1ed1 \u0111i\u1ec7n tho\u1ea1i, \u0111\u1ecba ch\u1ec9… mà ph\u1ea3i k\u1ebft h\u1ee3p ký t\u1ef1 và con s\u1ed1, ký t\u1ef1 \u0111\u1eb7c bi\u1ec7t, ch\u1eef hoa ch\u1eef th\u01b0\u1eddng…<\/p>\n

\n\t4. “B\u1ea3o v\u1ec7” th\u01b0 m\u1ee5c wp-admin:<\/h2>\n

\n\t\"11<\/a><\/p>\n

\n\tV\u1ec1 m\u1eb7t b\u1ea3n ch\u1ea5t, th\u01b0 m\u1ee5c wp-admin<\/b> ch\u1ee9a t\u1ea5t c\u1ea3 các thông tin quan tr\u1ecdng, c\u1ea7n thi\u1ebft và có th\u1ec3 \u1ea3nh h\u01b0\u1edfng tr\u1ef1c ti\u1ebfp t\u1edbi \u0111\u1ed9 \u1ed5n \u0111\u1ecbnh c\u1ee7a h\u1ec7 th\u1ed1ng. Và 1 gi\u1ea3i pháp nên s\u1eed d\u1ee5ng t\u1ea1i \u0111ây là cài \u0111\u1eb7t plug – in AskApache Password Protect<\/a> dành cho WordPress <\/b>\u0111\u1ec3 \u0111\u1eb7t m\u1eadt kh\u1ea9u b\u1ea3o v\u1ec7 th\u01b0 m\u1ee5c \u0111ó, c\u1ea5p quy\u1ec1n truy c\u1eadp cho ng\u01b0\u1eddi ho\u1eb7c tài kho\u1ea3n mà b\u1ea1n tin c\u1eady.<\/p>\n

\n\t5. Xóa b\u1ecf thông tin v\u1ec1 phiên b\u1ea3n WordPress:<\/h2>\n

\n\tTrên th\u1ef1c t\u1ebf, có r\u1ea5t nhi\u1ec1u b\u1ed9 theme WordPress <\/b>có ch\u1ee9a thông tin v\u1ec1 phiên b\u1ea3n trong th\u1ebb meta, và d\u1ef1a vào \u0111ó, hacker có th\u1ec3 d\u1ef1a vào \u0111i\u1ec1u này \u0111\u1ec3 tìm ph\u01b0\u01a1ng án t\u1ea5n công phù h\u1ee3p. \u0110\u1ec3 kh\u1eafc ph\u1ee5c, các b\u1ea1n hãy truy c\u1eadp vào b\u1ea3ng \u0111i\u1ec1u khi\u1ec3n chính c\u1ee7a WordPress<\/b>, sau \u0111ó m\u1edf Design > Theme Editor.<\/b> \u1ede phía bên ph\u1ea3i, chúng ta ch\u1ecdn file Header <\/b>và tìm ki\u1ebfm dòng mã có d\u1ea1ng nh\u01b0 d\u01b0\u1edbi \u0111ây:<\/p>\n

\n\t<meta name=”generator” content=”WordPress <?php bloginfo(’version’); ?>” \/><\/span><\/i><\/span><\/p>\n

\n\tHãy xóa dòng này và nh\u1ea5n nút Update File<\/b>. Các b\u1ea1n c\u1ea7n l\u01b0u ý r\u1eb1ng v\u1edbi phiên b\u1ea3n WordPress 2.6<\/b> ho\u1eb7c m\u1edbi h\u01a1n thì h\u1ec7 th\u1ed1ng t\u1ef1 \u0111\u1ed9ng g\u1eafn thông tin phiên b\u1ea3n trong ph\u1ea7n Wp_head. Và \u0111\u1ec3 kh\u1eafc ph\u1ee5c, chúng ta ch\u1ec9 c\u1ea7n cài \u0111\u1eb7t plug – in WP Security Scan<\/a>.<\/p>\n

\n\t6. “Gi\u1ea5u” th\u01b0 m\u1ee5c plugins:<\/h2>\n

\n\tN\u1ebfu truy c\u1eadp vào th\u01b0 m\u1ee5c ho\u1eb7c \u0111\u01b0\u1eddng d\u1eabn http:\/\/yourwebsite.com\/wp-content\/plugins<\/b>, b\u1ea1n s\u1ebd th\u1ea5y toàn b\u1ed9 danh sách plug – in c\u1ee7a h\u1ec7 th\u1ed1ng \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng. N\u1ebfu mu\u1ed1n \u1ea9n th\u01b0 m\u1ee5c này thì các b\u1ea1n ch\u1ec9 c\u1ea7n \u0111\u0103ng t\u1ea3i file index.html<\/b> tr\u1ed1ng t\u1edbi th\u01b0 m\u1ee5c plugin này. R\u1ea5t \u0111\u01a1n gi\u1ea3n, ch\u1ec9 c\u1ea7n m\u1edf 1 \u1ee9ng d\u1ee5ng ch\u1ec9nh s\u1eeda text b\u1ea5t k\u1ef3, sau \u0111ó l\u01b0u l\u1ea1i thành index.html,<\/b> dùng ch\u01b0\u01a1ng trình ftp và t\u1ea3i file index.html<\/b> này vào th\u01b0 m\u1ee5c \/wp-content\/plugins.<\/b><\/p>\n

\n\t7. Thay \u0111\u1ed5i tên \u0111\u0103ng nh\u1eadp:<\/h2>\n

\n\t\"11<\/a><\/p>\n

\n\tTên Username <\/b>m\u1eb7c \u0111\u1ecbnh \u1edf \u0111ây là admin<\/b>, tuy nhiên chúng ta v\u1eabn có th\u1ec3 thay \u0111\u1ed5i \u0111\u01b0\u1ee3c \u0111\u1ec3 c\u1ea3n tr\u1edf quy trình t\u1ea5n công c\u1ee7a hacker vào nh\u1eefng h\u1ec7 th\u1ed1ng \u0111\u01a1n gi\u1ea3n. Trong b\u1ea3ng \u0111i\u1ec1u khi\u1ec3n chính c\u1ee7a WordPress<\/b>, các b\u1ea1n m\u1edf Users <\/b>và t\u1ea1o m\u1edbi 1 tài kho\u1ea3n, sau \u0111ó gán quy\u1ec1n administrator <\/b>và \u0111\u0103ng nh\u1eadp l\u1ea1i b\u1eb1ng tài kho\u1ea3n v\u1eeba t\u1ea1o.<\/p>\n

\n\tTruy c\u1eadp vào ph\u1ea7n Users<\/b>, l\u1ea7n này các b\u1ea1n \u0111ánh d\u1ea5u check vào ô bên c\u1ea1nh admin <\/b>và ch\u1ecdn Delete<\/b>. Khi h\u1ec7 th\u1ed1ng hi\u1ec3n th\u1ecb c\u1eeda s\u1ed5 xác nh\u1eadn thông báo, chúng ta ch\u1ecdn Attribute all posts and links to:<\/b> và ch\u1ecdn tài kho\u1ea3n v\u1eeba t\u1ea1o t\u1ea1i b\u01b0\u1edbc trên trong danh sách dropdown. Quá trình này s\u1ebd chuy\u1ec3n toàn b\u1ed9 các bài vi\u1ebft sang tài kho\u1ea3n m\u1edbi. Sau \u0111ó các b\u1ea1n nh\u1ea5n Confirm Deletion.<\/b><\/p>\n

\n\t8. Luôn c\u1eadp nh\u1eadp phiên b\u1ea3n m\u1edbi nh\u1ea5t c\u1ee7a WordPress và plug – in:<\/h2>\n

\n\tV\u1ec1 m\u1eb7t k\u1ef9 thu\u1eadt, phiên b\u1ea3n m\u1edbi nh\u1ea5t c\u1ee7a WordPress <\/b>luôn \u0111\u01b0\u1ee3c c\u1eadp nh\u1eadt các b\u1ea3n vá b\u1ea3o m\u1eadt, do v\u1eady ng\u01b0\u1eddi dùng hãy \u0111\u1ec3 ý \u0111\u1ebfn quá trình này. T\u1ea1i th\u1eddi \u0111i\u1ec3m c\u1ee7a bài vi\u1ebft này thì WordPress \u0111ã cho phát hành b\u1ea3n 3.3, và các b\u1ea1n có th\u1ec3 download tr\u1ef1c ti\u1ebfp t\u1ea1i \u0111ây<\/a>.<\/p>\n

\n\t9. Th\u1ef1c hi\u1ec7n quy trình quét th\u01b0\u1eddng xuyên:<\/h2>\n

\n\t<\/a><\/p>\n

\n\t
\n\tNh\u01b0 \u0111ã \u0111\u1ec1 c\u1eadp t\u1edbi \u1edf bên trên, các b\u1ea1n c\u1ea7n cài \u0111\u1eb7t ti\u1ec7n ích WP Security Scan<\/a> và ti\u1ebfn hành quét th\u01b0\u1eddng xuyên nh\u1eb1m phát hi\u1ec7n ra các l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt trong h\u1ec7 th\u1ed1ng. 1 \u0111i\u1ec3m n\u1eefa c\u1ea7n áp d\u1ee5ng \u1edf \u0111ây là thay \u0111\u1ed5i wp_<\/b> thành b\u1ea5t ti\u1ec1n t\u1ed1 tùy ch\u1ec9nh, nh\u1eb1m tránh kh\u1ecfi s\u1ef1 nhòm ngó c\u1ee7a hacker.<\/p>\n

\n\t10. Sao l\u01b0u c\u01a1 s\u1edf d\u1eef li\u1ec7u:<\/h2>\n

\n\t\u0110\u1ec3 th\u1ef1c hi\u1ec7n vi\u1ec7c này, các b\u1ea1n hãy cài \u0111\u1eb7t và s\u1eed d\u1ee5ng ti\u1ec7n ích h\u1ed7 tr\u1ee3 WP-DB-Backup<\/a> v\u1edbi ch\u1ee9c n\u0103ng chính là sao l\u01b0u toàn b\u1ed9 c\u01a1 s\u1edf d\u1eef li\u1ec7u c\u1ee7a h\u1ec7 th\u1ed1ng theo th\u1eddi gian và l\u1ecbch s\u1eafp \u0111\u1eb7t c\u1ee7a ng\u01b0\u1eddi qu\u1ea3n tr\u1ecb.<\/p>\n

\n\t11. Thi\u1ebft l\u1eadp m\u1ee9c phân quy\u1ec1n phù h\u1ee3p:<\/h2>\n

\n\tTrong tr\u01b0\u1eddng h\u1ee3p có nhi\u1ec1u h\u01a1n 1 tác gi\u1ea3 – Author trong h\u1ec7 th\u1ed1ng c\u1ee7a b\u1ea1n, hãy s\u1eed d\u1ee5ng plug – in Role Manager<\/a> \u0111\u1ec3 t\u1ea1o, qu\u1ea3n lý và giám sát m\u1ee9c phân quy\u1ec1n \u0111\u1ed1i v\u1edbi ng\u01b0\u1eddi dùng ho\u1eb7c nhóm ng\u01b0\u1eddi dùng trong h\u1ec7 th\u1ed1ng.<\/p>\n

\n\tChúc các b\u1ea1n thành công!<\/p>\n

\n\tNgu\u1ed3n MakeTechEasier<\/i><\/p>\n","protected":false},"excerpt":{"rendered":"

\n\t\"11<\/a><\/p>\n

\n\tKhi xét v\u1ec1 m\u1eb7t b\u1ea3n ch\u1ea5t k\u1ef9 thu\u1eadt thì vi\u1ec7c c\u1ea7n làm ngay sau khi c\u1ea5u hình, thi\u1ebft l\u1eadp blog WordPress là \u0111\u1ea3m b\u1ea3o m\u1ee9c \u0111\u1ed9 b\u1ea3o m\u1eadt, an ninh c\u1ea7n thi\u1ebft. Trong bài vi\u1ebft d\u01b0\u1edbi \u0111ây, chúng tôi s\u1ebd gi\u1edbi thi\u1ec7u v\u1edbi các b\u1ea1n 11 m\u1eb9o c\u01a1 b\u1ea3n có th\u1ec3 áp d\u1ee5ng trong nhi\u1ec1u tình hu\u1ed1ng \u0111\u1ec3 th\u1ef1c hi\u1ec7n vi\u1ec7c này.<\/p>\n","protected":false},"author":6,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[143],"tags":[],"class_list":["post-810","post","type-post","status-publish","format-standard","hentry","category-thu-thuat-wordpress"],"views":445,"_links":{"self":[{"href":"https:\/\/tapchicntt.com\/rest-api\/wp\/v2\/posts\/810","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tapchicntt.com\/rest-api\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tapchicntt.com\/rest-api\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tapchicntt.com\/rest-api\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/tapchicntt.com\/rest-api\/wp\/v2\/comments?post=810"}],"version-history":[{"count":0,"href":"https:\/\/tapchicntt.com\/rest-api\/wp\/v2\/posts\/810\/revisions"}],"wp:attachment":[{"href":"https:\/\/tapchicntt.com\/rest-api\/wp\/v2\/media?parent=810"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tapchicntt.com\/rest-api\/wp\/v2\/categories?post=810"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tapchicntt.com\/rest-api\/wp\/v2\/tags?post=810"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}