WordPressのセキュリティについて / gifuwpm20-wordpress-security

Gifu WordPress Meetup #20 での登壇資料です。

Transcript

1. 8PSE1SFTTͷηΩϡϦςΟʹ
   ͍ͭͯ
   (JGV8PSE1SFTT.FFUVQ
   ೥݄೔ʢ౔ʣʙ
   

   View Slide

2. ࣗݾ঺հ
   w 8FC੍࡞ܥϑϦʔϥϯε
   w ࠷ۙʮσʔλɾαΠΤϯεʯʹ͍ͭͯڵຯ௡ʑ
   w ग़਎͸άϥϑΟοΫσβΠϯɻ8FC͸׬શಠֶɻ
   w ಈը഑৴ʹ΋खΛग़࢝͠Ίͨɻ
   

   View Slide

3. 8PSE1SFTTͷηΩϡϦςΟʹ
   ͍ͭͯ
   

   View Slide

4. ৘ใηΩϡϦςΟͷ̏෼ྨ
   w ਓతڴҖ

   ˠ৘ใΛ౪Ήɾෆਖ਼ར༻ɾޡૢ࡞ͳͲਓ͕ى͜͢΋ͷ
   w ٕज़తڴҖ

   ˠෆਖ਼ΞΫηεɾվ͟ΜɾΫϥοΩϯά
   w ෺ཧతڴҖ

   ˠαʔόʔ͕෺ཧతʹյΕΔͳͲ
   

   View Slide

5. 8PSE1SFTT͸ૂΘΕ΍͍͢ʁ
   w ʮૂΘΕ΍͍͢ʯͱࢥ͏ʢݸਓతײ૝ʣ
   w γΣΞ͔Βߟ͑ͯ8PSE1SFTTΛૂ͑͹खͬऔΓૣ͍ͱߟ
   ͑Δͷ͕ଥ౰
   w ΦʔϓϯιʔεͳͷͰத਎͸୭Ͱ΋ݟΔ͜ͱ͕Ͱ͖Δ
   

   View Slide

6. ຊ౰ʹ8PSE1SFTT͡Όͳ͍ͱμϝʁ
   w ͦͷ΢ΣϒαΠτ͕8PSE1SFTTͰ͋Δ΂͖ཧ༝͸ʁ
   w ଞͷແྉɾ༗ྉϒϩάαʔϏεͰ͸ͩΊʁ
   w ੩త΢ΣϒαΠτͰྑ͍ͷͰ͸ʁ
   

   View Slide

7. ޮՌ͕ߴ͍ʢͱߟ͑ΒΕΔʣ
   ରࡦ
   ύεϫʔυͷ؅ཧ
   ΞοϓσʔτΛ͢Δ
   ϩάΠϯ63-Λมߋ͢Δ
   44-Խ
   8"'ಋೖ
   ࢖Θͳ͍ςʔϚɾϓϥάΠϯͷແޮԽ࡟আ
   

   View Slide

8. ύεϫʔυͷ؅ཧ
   w ೦ͷͨΊॳظύεϫʔυ͔Βมߋ͓ͯ͜͠͏
   w ҆શͳύεϫʔυͱ͸ʁʢ૯຿লࢀরʣ
   ໊લͳͲͷݸਓ৘ใ͔Β͸ਪଌͰ͖ͳ͍͜ͱ
   ӳ୯ޠͳͲΛͦͷ··࢖༻͠ͳ͍͜ͱ
   ΞϧϑΝϕοτͱ਺ࣈ͕ࠞࡏ͍ͯ͠Δ͜ͱ
   ద੾ͳ௕͞ͷจࣈྻͰ͋Δ͜ͱ
   ྨਪ͠΍͍͢ฒͼํ΍ͦͷ༰қͳ૊Έ߹Θͤʹ͠ͳ͍͜ͱ
   

   View Slide

9. ύεϫʔυͷ࠷େղಡ࣌ؒ
   https://www.ipa.go.jp/security/txt/2008/10outline.html
   

   View Slide

10. ΞοϓσʔτΛ͢Δ
    w 8PSE1SFTTίΞͷߋ৽ʢϚΠφʔ͸ࣗಈʣ
    w ϓϥάΠϯςʔϚͷߋ৽
    w ίΞWFSʹରԠ͍ͯ͠Δ͔֬ೝ͢Δ΂͖
    

    View Slide

11. ϓϥάΠϯͷબͼํ
    

    View Slide

12. όοΫΞοϓΛऔಘ͠Α͏
    w ΞοϓσʔτΛ࣮ߦͯ͠ը໘͕ਅͬനʹʜ
    w ͦΜͳ࣌ʹ͸ɺόοΫΞοϓσʔλͰ෮ݩ͠·͢
    w "MMJO0OF81.JHSBUJPO͕ʢݸਓతʹ͸ʣ͓͢͢Ί

    ˠόοΫΞοϓऔಘͱ෮ݩ͕؆୯
    w ීஈ͔ΒఆظతͳόοΫΞοϓΛεέδϡʔϧԽ͢Δ
    

    View Slide

13. ϩάΠϯ63-Λมߋ͢Δ
    IUUQTTBNQMFDPNXQMPHJOQIQ
    

    View Slide

14. ϩάΠϯ63-Λมߋ͢Δ
    w खಈͰରԠ΋Մೳ

    ˠϋʔυϧ͕ߴ͍ͷͰϓϥάΠϯͰػೳ௥Ճ͕Φεεϝ
    w 4JUF(VBSE811MVHJO
    w ʲ஫ҙʳ༗ޮԽͨ͠Βඪ४ઃఆͰϩάΠϯ63-͕มߋ
    ͞Εͯ͠·͏ͷͰѻ͍ʹ஫ҙ
    w Ճ͑ͯϩάΠϯը໘ʹ#"4*$ೝূΛ෇͚Δͱ͍͏ख΋
    

    View Slide

15. 44-Խ
    w 4FDVSF4PDLFUT-BZFSͷུ
    w ΢ΣϒαΠτͱσόΠεʢ1$ͳͲʣͱͷؒͰ΍ΓऔΓ͢
    ΔσʔλΛ҉߸Խͯ͠౪Έʹ͘͘͢Δ࢓૊Έ
    w IUUQTʙͰΞΫηεͰ͖Δ΢ΣϒαΠτ͸ରԠࡁΈ
    w (PPHMF$ISPNFͳͲͰ͸ରԠ͍ͯ͠ͳ͍ͱʮอޢ͞Εͯ
    ͍ͳ͍௨৴ʯͱදࣔ͞ΕͨΓ͢Δ
    

    View Slide

16. 44-Խͷํ๏
    w ར༻͍ͯ͠ΔαʔϏε΍αʔόʔʹΑ༷ͬͯʑͳͷͰҰ
    ֓ʹํ๏ΛఏࣔͰ͖ͳ͍
    w طଘ΢ΣϒαΠτΛରԠ͢Δ৔߹ɺαΠτ಺ʹઃஔ͞Ε
    ͍ͯΔϦϯΫશ͕ͯIUUQTʙʹͳ͍ͬͯͳ͍ͱ׬શͳ
    44-Խʹ͸ͳΒͳ͍ʢNJYFEDPOUFOUʣ
    w ద౰ʹ΍Βͣʹ༗ࣝऀʹ૬ஊ͢Δ͜ͱΛ͓קΊ͠·͢
    

    View Slide

17. 8"'ಋೖ
    w 8FC"QQMJDBUJPO'JSFXBMMͷུ
    w αʔόʔଆPSϓϥάΠϯͰͷಋೖ͕Ұൠత
    w 9TFSWFSϩϦϙTBLVSB͸ར༻Մೳ
    w 8PSEGFODF4FDVSJUZ'JSFXBMM.BMXBSF4DBOͳͲ
    w 81ɾϓϥάΠϯͷػೳʹΑΔΞΫηεΛޡͬͯःஅͯ͠
    ͠·͏͜ͱ͕͋Δˠνϡʔχϯά͕ඞཁͳ৔߹΋͋Δ
    

    View Slide

18. ࢖Θͳ͍ςʔϚɾϓϥάΠϯͷ
    ແޮԽ࡟আ
    w ඪ४Ͱ5XFOUZʙςʔϚ͕ෳ਺Πϯετʔϧ͞Ε͍ͯΔ͕
    ෆཁͳΒ࡟আʢఆظతʹߋ৽͍ͯ͠Ε͹0,ʣ
    w ࢖Θͳ͍PSݹ͍ϓϥάΠϯ͸ɺ࡟আPS৐Γ׵͑ʢஔ͖׵
    ͑ʣΛݕ౼͢Δ
    w ఆظతʹ֬ೝ͢Δश׳Λ࣋ͭͱϕλʔ
    

    View Slide

19. ·ͱΊ
    w *%ͱ18͸ΦϦδφϦςΟΛ࣋ͭ
    w ߋ৽͠ͳ͍ͳΒ8PSE1SFTT࢖Θͳ͍ʢ͘Β͍ͷؾ࣋ͪͰʣ
    w όοΫΞοϓ͸ඞਢʢ෮ݩ΋࿅शͯ͠ΈΑ͏ʣ
    w ϩάΠϯ63-Λมߋͯ͠#"4*$ೝূ΋ซͤΔͱ٢
    w 44-Խ͸ࠓ΍ৗࣝʢඞਢʣϨϕϧ
    

    View Slide