DSO Server Setup Steps

To answer your question, I have not yet had a problem doing a backup. I am having a problem when trying to switch backup profiles, which would be needed if a client did multiple types of backups.

Just to clarify, I am making these changes in isolation. Before I make each change, I put everything back to default (the way it was when I installed the two plug-ins).

When I put your suggested Whitelist rule into the TIMTHUMB FORBID RFI and MISC FILE SKIP/BYPASS RULE, and made the following substitution for YourWebsite.com:
RewriteCond %{HTTP_REFERER} ^.*localhost.*
I still get the Application error, and the notification of update does not appear.

When I add the Query String skip/bypass rule to the wp-admin Custom Code text box, I still get the Application error, and the notification of update does not appear.

Since you said one or more of your list of BPS root .htaccess file security rules might be blocking the API upgrade check, I commented them ALL out. In this case, I edited the root .htaccess file directly. I still get the Application error, and the notification of update does not appear.

The way configuration information is stored for the version of Apache2 I have seems to be different from XAMPP. There are no httpd.conf or vhosts.conf files.

The file /etc/apache2/apache.conf has the following lines:

# Include module configuration:
IncludeOptional mods-enabled/*.load
IncludeOptional mods-enabled/*.conf
IncludeOptional sites-enabled/*.conf

In the file /etc/apache2/mods-enabled/authz_core.load is the command:
LoadModule authz_core_module /usr/lib/apache2/modules/mod_authz_core.so

The file /etc/apache2/apache.conf has the following lines:

# Sets the default security model of the Apache2 HTTPD server. It does
# not allow access to the root filesystem outside of /usr/share and /var/www.
# The former is used by web applications packaged in Debian,
# the latter may be used for local directories served by the web server. If
# your system is serving content from a sub-directory in /srv you must allow
# access here, or in any related virtual host.
<Directory />
	Options FollowSymLinks
	AllowOverride None
	Require all denied
</Directory>

<Directory /usr/share>
	AllowOverride None
	Require all granted
</Directory>

<Directory /var/www/>
	Options Indexes FollowSymLinks
	AllowOverride None
	Require all granted
</Directory>

#<Directory /srv/>
#	Options Indexes FollowSymLinks
#	AllowOverride None
#	Require all granted
#</Directory>

and

# The following lines prevent .htaccess and .htpasswd files from being
# viewed by Web clients.
#
<FilesMatch "^\.ht">
	Require all denied
</FilesMatch>

The file /etc/apache2/sites-enabled/mysite.conf contains the following lines:

<VirtualHost *:80>
	ServerAdmin webmaster@localhost
        ServerName localhost
	DocumentRoot /home/christina/public_html
	<Directory />
		Options FollowSymLinks
		AllowOverride All
	</Directory>
	<Directory /home/christina/public_html>
		Options Indexes FollowSymLinks MultiViews
		AllowOverride All
		Order allow,deny
		allow from all
		Require all granted
	</Directory>

	ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
	<Directory "/usr/lib/cgi-bin">
		AllowOverride None
		Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
		Order allow,deny
		Allow from all
	</Directory>

	ErrorLog ${APACHE_LOG_DIR}/error.log

	# Possible values include: debug, info, notice, warn, error, crit,
	# alert, emerg.
	LogLevel warn

	CustomLog ${APACHE_LOG_DIR}/access.log combined

    Alias /doc/ "/usr/share/doc/"
    <Directory "/usr/share/doc/">
        Options Indexes MultiViews FollowSymLinks
        AllowOverride None
        Order deny,allow
        Deny from all
        Allow from 127.0.0.0/255.0.0.0 ::1/128
    </Directory>

</VirtualHost>

If there are other relevant sections of configuration information you think I might be overlooking, please let me know and I’ll supply them.

I may have found the problem.

The root .htaccess file contains the following directive:

ErrorDocument 403 /repos/akwpcore-1.4.1/wp-content/plugins/bulletproof-security/403.php

If I comment out this line, I am able to switch profiles successfully.

Here are the first few lines in /wp-content/plugins/bulletproof-security/403.php (left/right arrows changed to “[]” so they show up in the code segment):

[?php ob_start(); ?]
[?php session_cache_limiter('nocache'); ?]
[?php session_start(); ?]
[?php error_reporting(0); ?]
[?php session_destroy(); ?]

If I leave the above line in the .htaccess file intact and remove this code, I am able to switch profiles successfully.

When the AKWP Control Panel is displayed as the result of being selected from a menu, it initializes some session variables. It also checks that the backup directory is inaccessible from the browser – it performs a request where a 403 error is expected.

When the 403 error is detected, the BPS root .htaccess file causes /wp-content/plugins/bulletproof-security/403.php to be executed. 403.php calls session_destroy(), which wipes out the session variables.

When the AKWP Control Panel is displayed as the result of redirection after a form is submitted (such as selecting a new Backup Profile), it loads and checks the session variables. These variables were wiped out by 403.php, AKWP detects that something is amiss with the session and displays “Application Error 500”.

Can this be resolved with a Skip rule? Do developers need to create a custom 403.php file for use on sites where AKWP is installed? Is there some other better solution?

Thanks! Turning off Security Logging allows AKWP to function properly. But as you pointed out, that will cause problems with other plug-ins that expect the session to be destroyed. Eventually this requires a more tailored solution, but for now there is this work-around, so I’ll mark this Topic as Resolved.