Installing plugins in a duplicate folder (from wordpress)

  • Resolved pr0ject10n

    (@pr0ject10n)


    7 years, 4 months ago

    I used the plugin ‘Duplicator’ to duplicate my wordpress folder as two external files (the archive and php installer) and uploaded those into the projectionpictures folder with this path projection (name of the server)/web/projectionpictures.

    I then opended the php file to complete the installation.
    However when I sign into http://192.168.1.234/projectionpictures/wp-login.php and try to install or update further plugins I’m asked to enter connection information for the ftp address of my Synology unit. I’m not sure what the ftp address is but Synology inform me that port 21 is open. I don’t know what the ftp username or password is either, unless I do and don’t realise it.

    What do I have to do now so further plugins can be installed and updated in the newly created projectionpictures as I intend to make it a live site once the plugin problem is solved.

Viewing 15 replies - 61 through 75 (of 153 total)
1 2 3 4 5 6 … 9 10 11
  • Thread Starter pr0ject10n

    (@pr0ject10n)

    7 years, 3 months ago

    I decided to manually reinstall phpmyadmin in the dsm (I didn’t ‘stop’ it or ‘uninstall’ it beforehand) and now I can open it but the database for wordpress and projectionpictures aren’t in there (I thought they might stay there). You did suggest reinstalling it before.

    But the projectionpictures WP dash is still working and I even installed a plugin that wanted to be updated and that went in. I didn’t think it would, please forgive my ignorance about this.

    The original wordpress dashboard is still working.

    How do I reinstall the database for each in the phpmyadmin if I don’t have a an sql back up from inside the phpmyadmin. I do but there few weeks out of date for the projectionpictures website. Not that my site is that complicated.

    I took this action based on your first paragraph to my last reply.

    I’ve changed the root password in phpmyadmin it created last time in its own generator, for the three user accounts that are in there.

    • This reply was modified 7 years, 3 months ago by pr0ject10n.
    • This reply was modified 7 years, 3 months ago by pr0ject10n.
    Moderator bcworkz

    (@bcworkz)

    7 years, 3 months ago

    The mySQL server is clearly still working and has all of your data. phpMyAdmin needs to be told how to connect to that mySQL server by running its setup script. Add /setup to however you access phpMyAdmin in your browser. This script does not save anything directly. You use the “Download” button to save a copy of your setup configuration. This configuration file is then copied into where ever the phpMyAdmin configuration file is. The location varies by operating system. One common location is /etc/phpmyadmin/config.inc.php (YMMV)

    The DB host is the same as in WordPress’ wp-config.php, often “localhost”. I’m not sure which user and password you would use. The ones in wp-config.php may not give you full access, but should be adequate for managing WP if you don’t know the user/pass for the full mySQL admin.

    More on setting up phpMyAdmin:
    http://docs.phpmyadmin.net/en/latest/setup.html#using-setup-script

    Thread Starter pr0ject10n

    (@pr0ject10n)

    7 years, 3 months ago

    Please don’t get upset with me but I discovered the reason why I thought both databases for wordpress and projectionpictures were missing from inside phpmyadmin its because when I first sign in by default the screen server selector is on MariaDB5 and neither database appears and I thought they were lost. However if I revert to MariaDB10 when I sign in they appear. Oops !

    I discovered that purely by accident (we) reset the password to get in but I was only the sign in screen wouldn’t accept the new password with MariaDB5 so I changed it to 10 ten they appear. What a numpty I am.

    So..as we were if I want to change to https from http is the easiest way to do it to use plugin Better Search Replace plugin to do a straight http://www.projectionpictures.com to https://www.projectionpictures.com, then see if that is reflected in ‘Settings’ > ‘General’ and if they have changed I would then go into permalinks and save changes for Post name.

    The login should change from http://www.projectionpictures.com/wp-login.php?loggedout=true
    to https://www.projectionpictures.com/wp-login.php?loggedout=tru or will that remain as is.

    After that I have two SSL certificates installed in the DSM security already. One is from my domain registrar 1and1 and the other from Lets Encrypt, but the one from 1and1 was deactivated in the 1and1 console before when we were trying to get the port forwarding information / DNS record correct.

    Thread Starter pr0ject10n

    (@pr0ject10n)

    7 years, 3 months ago

    Something weird has happened tonight with internet explorer. For some unknown reason unknown to me the web page and the wordpress login for the site are appearing… and I’ve just figured out why I’ve turned on my Nord VPN service and chose Romania as I wanted to look up something. If I turn Nord off neither will appear, that’s odd, why is that happening? Just because I hide the IP address of my laptop, mad.

    Moderator bcworkz

    (@bcworkz)

    7 years, 3 months ago

    How could I be upset when you solve your own problem? 🙂 I’m just happy it’s solved!

    Yes, the login will change to https along with everything else. Once the https is changed in the DB and in general settings, you will automatically become logged out and will need to sign in again. Password and all are all the same. Only the URL used to get somewhere changes slightly.

    Just a theory on why VPN works with IE, but I’m pretty sure I’m at least close:
    As you probably know, VPN connections “tunnel” out to a remote resource so other entities along the way have no way to snoop on your traffic. With VPN, even your own NAS is “remote” because the traffic is routed through Romania or where ever. Whatever it is that is blocking IE traffic (a firewall of some sort I think) sees something it doesn’t like when IE traffic comes through and it kills the the data stream so nothing ever comes back to IE, or never goes out to start with.

    With VPN tunneling, this firewall or whatever it is cannot snoop on your traffic and is thus powerless to do anything, so IE traffic comes through. There is a chance that a HTTPS connection would also hide whatever is found objectionable so IE might work over a HTTPS connection as well. It depends on what is being found objectionable.

    Thread Starter pr0ject10n

    (@pr0ject10n)

    7 years, 3 months ago

    So tonight I attempted to transfer from http to https, before I did that I did some back ups.

    First I backed up the databases in phpMyAdmin.

    However I had to use nord vpn through Romania with internet explorer to download the archive file from Duplicator and the wpress file from All in one WP migration for projectionpictures. Admittedly there is a size issue wpress is 354MB and the archive file is 125MB.

    Opera refused to download the big archive file generated by Duplicator or to downloaded the wpress file from All in one WP migration.

    I then used better search replace to go from http to https for projectionpictures. I also saved the permalinks in Setting. So the site URL and home are now https. However I couldn’t log back into the WP dashboard for projectionpictures and the website wouldn’t appear even though. There are two security certificates in the DSM one from Lets Encrypt the other from my 1and1 domain provide. Now we did disable it and as a consequence of that both internet explorer and Opera.

    Opera gave this message:

    You attempted to reach www.projectionpictures.com, but the certificate that the server presented has been revoked by its issuer. This means that the security credentials the server presented absolutely should not be trusted. You may be communicating with an attacker.

    You cannot visit www.projectionpictures.com right now because the SSL certificate has been revoked. Network errors and attacks are usually temporary, so this page will probably work later.

    Internet Explorer:

    This organization’s certificate has been revoked.
    Security certificate problems may indicate an attempt to fool you or intercept any data you send to the server.

    Should I simply transfer all the virtual hosts to the Lets Encrypt certificate and delete the 1and1 entirely (which needs to be issued again by 1and1, as that is the revoked one). Or would I be any better of using ‘Really Simple SSL’ plugin, is it any good and does it have to be linked to anything is the DSM.

    I feel if you have to many SSL certificates search engines start to tell you, that you have mismatched certificates which happened before.

    • This reply was modified 7 years, 3 months ago by pr0ject10n.
    Thread Starter pr0ject10n

    (@pr0ject10n)

    7 years, 3 months ago

    As off 12.55am this morning I lost my live website and the projectionpictures WP login due to multipile copies of photo.scr. I have no managed to remove it but neither the live site appears except as a blank white screen and so does the WP dashboard login.

    Jetpack sent me an email to alert me that they had lost contact.

    Internet explorer displays this:
    This error (HTTP 500 Internal Server Error) means that the website you are visiting had a server problem which prevented the webpage from displaying.

    I’ve also lost the google file I uploaded from the google console and when I went in there to try and retrieve the same one I couldn’t find it at all. Incidentally when I select projectionpictures in the console the url bar at the top shudders and the page hangs.

    Thread Starter pr0ject10n

    (@pr0ject10n)

    7 years, 3 months ago

    UPDATE: photo.scr has returned with a vengeance. Clearly something else in projectionpictures folder is keeping it around.

    photo.scr does not appear in the wordpress folder.

    I made another copy of the google file on my pc so I still have that to upload.

    I have shut down my server for the night.

    I have closed port 21 and in the DSM and removed it the configuration settings. It was also open in my talktalk router and I have switched it off the port number.

    Moderator bcworkz

    (@bcworkz)

    7 years, 3 months ago

    I don’t know anything about that Really Simple SSL plugin beyond reading their info page at the WP dot org site. If the search and replace operation went well, I don’t think the plugin will be of much benefit.

    I think I would install the Lets Encrypt SSL certificate. It’s probably easier to manage than 1&1. Overall, it doesn’t really matter as long as one is in place. I don’t know if switching certs affects SEO or not. It’s possible. In any case, you need to set one up at least one more time no matter what. Then there’s no reason to change after that with either cert source.

    You should still be able to click through the security warnings to access your site, but with the Photo.scr bit going on, it’s maybe just as well you do not access it as a normal user. Whatever you were going to do on WP can wait.

    Sorry to hear Photo.scr is back. There is clearly a security breach somewhere. These can be very difficult to find. My only experience with breaches like that are on commercial hosted servers. In that situation, the only way to clear the breach for us mere mortals is to wipe our share of the server and restore from backup. We’re primarily talking about data files like WP, images, and DB content. The other option is to hire an expert to clean things up. This is the only option if there is no clean backup and one does not wish to lose data.

    Your breach has gotten into things like phpMyAdmin that is beyond the usual commercial hosting breach and my experience. Wiping and reinstalling everything may be an onerous task. If you can FTP into DSM, it may be possible for an expert to still go in and clean things up. Wouldn’t hurt to ask them if they can help. I’ve always recommended Sucuri, but there are other options.

    Thread Starter pr0ject10n

    (@pr0ject10n)

    7 years, 3 months ago

    I don’t know anything about that Really Simple SSL plugin beyond reading their info page at the WP dot org site. If the search and replace operation went well, I don’t think the plugin will be of much benefit.

    I haven’t used it as it might be in conflict with the one in survelliance that isn’t configured correctly and a youtube link further down states not to use with a reason.

    I think I would install the Lets Encrypt SSL certificate. It’s probably easier to manage than 1&1. Overall, it doesn’t really matter as long as one is in place. I don’t know if switching certs affects SEO or not. It’s possible. In any case, you need to set one up at least one more time no matter what. Then there’s no reason to change after that with either cert source.

    Not sure if I’m going to use Let’s Encrypt yet as I find it difficult to get the DMS to cooperate with Lets encrypt site externally. Very hit and miss.

    Sorry to hear Photo.scr is back. There is clearly a security breach somewhere. These can be very difficult to find. My only experience with breaches like that are on commercial hosted servers. In that situation, the only way to clear the breach for us mere mortals is to wipe our share of the server and restore from backup. We’re primarily talking about data files like WP, images, and DB content. The other option is to hire an expert to clean things up. This is the only option if there is no clean backup and one does not wish to lose data.

    I had to delete the contents of the folders in the web/ directory for projectionpictures and phpmyadmin entirely. As I had entire backups of both but there was a slight difference in their dates when I had created them. However I did manage to use this method to get the projectionpictures WP Dash back and the website is live again. Took about 2 hours of thought and practice to figure that out. Not sure if photo.scr will return though. I did a search for it in projectionpictures in file station, but so far nothing. It seems doing a a search in explorer (as I have enabled the SMB facility in the DSM) often brings up more photo.scr than doing a search inside file station within the DSM alone. I was though surprised to fix it how I have done using the method I used. I did loose entry into the phpmyadmin for 30mins as I was getting a red banner saying the config.php was not writable. In uploading the complete database again the permissions in the web/ folder for phpmyadmin had changed. So it should be owner ‘root’ with ‘administrator’ and ‘system’ in FULL CONTROL with ‘http’ as custom (read & write) only.

    I then tried unsuccessfully to use a pre-existing ssl certificate in the security section of DSM to migrate across to https. Unfortunately as it was issued to projection.synology.me (lets encrypt previously) so it wouldn’t work with projectionpictures.com as its the wrong domain. I watch a youtube video about migrating across on this link

    https://youtu.be/cizulBKZ5bc

    It raised the use of this site to check your domains compatibility for SSL before and after migrating to https –

    https://www.whynopadlock.com/

    It told me that the projection.synology.me had the wrong name even though in the description of it in the DSM I had written the projectionpictures name with https before it. It was who it was issued to that was wrong.

    Once I knew this I tried to import a 1and1 certificate I already had one my laptop into the security screen but this was BEFORE I had reactivated in the 1and1 console for the .com version of projectionpictures. The DSM screen hanged as the procedure interpreted the certificate I was trying to create as revoked. So I closed the web page and after that the DSM login screen refused to appear and nor did the projectionpictures WP DB either. So again I had to find out how to get back into the DSM. Answer is using a paper-clip in the reset hold at the back of the Synology box for 4 seconds or until it bleeps once, then releasing. This allows me to get to the login screen generate a new password and enter the DSM interface again, do a few alterations that the reset does and I was back in (as that reset only resets the password and doesn’t affect whats on the drives inside). I had to put the DSM back to http from https. I was doing all this at about 1.30am this morning.

    When I went back to the survelliance screen the projection.synoloy.me certificate had gone and replaced with the 1and1 I was trying to install however in the results I got back from

    https://www.whynopadlock.com/

    it appears to be damaged with this result:

    SSL Certificate Info
    Certificate Issuer DigiCert Inc
    Certificate Type Encryption Everywhere DV TLS CA – G1
    Issued On 2018-07-25

    Force HTTPS Your webserver is not forcing the use of SSL.
    You may want to add a redirect to ensure a secure connection is used.

    Invalid Intermediate (BAD)
    You have an invalid or missing intermediate (bundle) certificate. This may not break your padlock on all browsers, but will on others. Please contact your SSL Vendor for assistance with this error.

    Domain Matching Your SSL certificate matches your domain name!
    Protected Domains:
    *.projectionpictures.com
    projectionpictures.com

    Signature Your SSL certificate is using a sha256 signature!

    Expiration Date Your SSL certificate is current. Your SSL certificate expires in 145 days. (2019-07-22)

    I am now at crossroads about which provider to use for the SSL certificate. I have activated the 1and1 again but the issuer to is projectionpictures.com not https:// in front of it and I selected ‘my own server’ in the option box.

    Before I go ahead and have another attempt at doing the SSL I thought I would ask your view on who I should go with for the provider of the SSL. Can you get a free Lets Encrypt directly from their website?

    • This reply was modified 7 years, 3 months ago by pr0ject10n.
    Moderator bcworkz

    (@bcworkz)

    7 years, 3 months ago

    Go with which ever is easier to manage. Because the 1&1 cert probably renews along with your domain registration, there is probably less fuss involved. Lets Encrypt certs only last 90 days before you must renew. It’s not a big deal, but one more thing to do. They do send reminder emails. Add the fact you’ve had trouble with Lets Encrypt, I’m reversing my previous recommendation and I now think 1&1 would be a better option.

    No one gets a Lets Encrypt cert directly from their website. It doesn’t work that way, it would be too easy to abuse. You install a cert agent on your server and it manages getting the cert. AFAIK you do not include https:// when you specify your site’s common name. You want *.projectionpictures.com. This way any subdomains you want to use are covered.

    You’ve sure been going through a lot getting this all going. There is one bright spot in all this. You are learning a lot about server administration! It may not seem like much right now, but what you are learning will serve you well into the future.

    Thread Starter pr0ject10n

    (@pr0ject10n)

    7 years, 3 months ago

    I’ve managed to install two lets encrypt certificates for the simple reason being on the last screen where you enter the:

    Domain: http://www.projectionpictures.com
    email: me email address
    Subject alternative Name: projection.synology.me

    I didn’t realise that the last entry ‘Subject alternative Name’ had to be the actual assigned name of your server or you can leave it blank. I was putting alternative for projectionpictures, ie .co.uk. Which is Wrong!

    And now whynopadlock is also happy ! see results below.

    SSL Connection – Pass
    SSL Certificate Info
    Certificate Issuer Let’s Encrypt
    Certificate Type Let’s Encrypt Authority X3
    Issued On 2019-02-26

    Force HTTPS Your webserver is forcing the use of SSL.

    Valid Certificate Your SSL Certificate is installed correctly.
    Domain Matching Your SSL certificate matches your domain name!

    Protected Domains:
    projection.synology.me
    http://www.projectionpictures.com

    Signature Your SSL certificate is using a sha256 signature!
    Expiration Date Your SSL certificate is current. Your SSL certificate expires in 89 days. (2019-05-27)

    Mixed Content – Pass
    You have no mixed content.

    I have also installed a 2nd lets enrypt certificate supposedly to cover the http IP login for the DSM, but I’m getting a mismatched certificate, interestingly when I entered details again for the last screen. I can still enter the DSM but ‘certificate error’ (mismatched) for Opera and Internet Explorer.

    Domain: projection.synology.me
    email: my email address
    Subject alternative Name: [I left this blank]

    HOWEVER one irony I can only see my live website on any of my devices through the Nord VPN service I choose Romania, if I switch it off I cant see the site and I can’t login to the projectionpictures WP dash either.

    In the virtual host I have these variants:

    projectionpictures.co.uk
    http://www.projectionpictures.co.uk
    projectionpictures.com
    http://www.projectionpictures.com
    projectionpictures/wp-login.php

    In the certificates there is:

    System Default
    FTPS
    WebDav Server
    projectionpictures.co.uk
    http://www.projectionpictures.co.uk
    projectionpictures.com
    http://www.projectionpictures.com
    projectionpictures/wp-login.php

    and all of those are using issued to: http://www.projectionpictures.com certificate
    and the projection.synology.me certificate isn’t covering anything its just there.

    How can the IP address for the DSM problem be sorted, I could delete the projection.synology.me certificate, but I don’t think it will affect the certificate error as I had it after I created the first one which is being used with the live site.

    Your thoughts.

    • This reply was modified 7 years, 3 months ago by pr0ject10n.
    Thread Starter pr0ject10n

    (@pr0ject10n)

    7 years, 3 months ago

    I’ve also updated the Google console with a site map from Yeo in the wordpress dashboard for the https changes and removed the http ones, I’ve included with the entry for projectionpictures.com only, and I added this author-sitemap.xml and a second one called page-sitemap.xml. I don’t need to enter the individual variants for each web page ie. /runaround ?

    Haven’t sorted the https certificate for the DSM IP address.

    Moderator bcworkz

    (@bcworkz)

    7 years, 3 months ago

    No, you don’t need to submit sitemaps for page variants. The individual pages are listed in page-sitemap.xml, so they’re covered.

    I think you will have trouble obtaining a cert for your IP because you don’t truly own the IP like you do domain names. The IP belongs to your ISP and is assigned for your use as part of your Internet service agreement with them. I’m speculating, I don’t know for sure.

    Thread Starter pr0ject10n

    (@pr0ject10n)

    7 years, 3 months ago

    As we know I can’t see my live website or the wordpress dash for it unless I use the Nord VPN service to locate my IP in Rommania.

    We think the TalkTalk server is doing this. There is a custom option I in the firewall that will allow me to change the action direction on port numbers to anyone of these:

    accept from local
    accept from remote
    accept in both way
    reject from local
    reject from remote
    reject in both way

    By default everyone is set to ‘Accept from Local’

    The numbers below appear only in the Remote Port column the Local Port column is empty throughout.
    80
    443
    21 (switched off) (local IP 192.168.1.234)
    20 (switched off) (local IP 192.168.1.234)
    53
    23
    22
    143
    993
    110
    995
    25
    465
    119
    123
    587

    With regards to the Synology IP address I think I might raise a support ticket with them and ask them which virtual host entries have to be assigned to the projection.synology.me certificate as the projectionpictures.com certificate isn’t sufficient in itself to padlock the servers IP address.

    • This reply was modified 7 years, 3 months ago by pr0ject10n.
Viewing 15 replies - 61 through 75 (of 153 total)
1 2 3 4 5 6 … 9 10 11

The topic ‘Installing plugins in a duplicate folder (from wordpress)’ is closed to new replies.