Shifterで始めるWordPressのセキュアな運用

Slide 1

Slide 1 text

S H I F T E R Ͱ ࢝ Ί Δ W O R D P R E S S ͷ η Ω ϡ Ξ ͳ ӡ ༻ S E C U R I T Y- J A W S ʲ ୈ 4 ճ ʳ 2 0 1 7 ೥ 2 ݄ 2 4 ೔ Wo rd P re s s g o e s S e r v e r l e s s #getshifter #secjaws #secjaws04

Slide 2

Slide 2 text

W H O A M I ?

Slide 3

Slide 3 text

Hiromichi Koga    AWS SAMURAI AWARD 2013  DigitalCube Co. Ltd ,CEO + HBT   amimoto-ami.com  getshifter.io 

Slide 4

Slide 4 text

ຊ ೔ ͷ ಺ ༰

Slide 5

Slide 5 text

ɾ Wo rd P re s s ͱ ͸ ? ɾ Wo rd P re s s ͷ η Ω ϡ Ϧ ςΟ ɾ S h i f t e r ͱ ͸ ? ɾ S h i f t e r ͷ Ϣʔεέ ʔε

Slide 6

Slide 6 text

W O R D P R E S S ͱ ͸ ?

Slide 7

Slide 7 text

M o s t p o p u l a r c o n t e n t m a n a g e m e n t s y s t e m s h t t p s : / / w 3 t e c h s . c o m /   s i n c e 1 J a n u a r y 2 0 1 7 Usage Change Since 1 January 2017 Market Share Change Since 1 January 2017 1.WordPress 27.5% +0.2% 58.7% +0.2% 2.Joomla 3.3% -0.1% 7.1% -0.1% 3.Drupal 2.2% 4.8%

Slide 8

Slide 8 text

F a s t e s t g ro w i n g c o n t e n t m a n a g e m e n t s y s t e m s   h t t p s : / / w 3 t e c h s . c o m /   s i n c e 1 J a n u a r y 2 0 1 7 1 . Wo rd P re s s ɹ 4 6 0 2 . S q u a re s p a c e ɹ 4 8 3 . S h o p i f y 4 7   D a i l y n u m b e r o f a d d i t i o n a l s i t e s i n t h e t o p 1 0 m i l l i o n

Slide 9

Slide 9 text

– ๭ α Π τ ੍ ࡞ ୅ ཧ ళ ͷ ੠ “ϝϯςφϯε΍ηΩϡϦςΟ͕໰୊ࢹ͞ΕΔ͕….  ։ൃऀͷϦιʔεௐୡ΍ϊ΢ϋ΢ɺΤϯυ͔Βͷೲظ΍ίετΛߟ͑Δͱ….”

Slide 10

Slide 10 text

– ๭ ৘ ใ γε ςϜ ୲ ౰ ऀ ͷ ੠ “৘γεࢹ఺Ͱ͸ར༻͸߇͑ͯ΋Β͍͍͕ͨ…..  શ͘ར༻͠ͳ͍Θ͚ʹ΋͍͔ͳ͍ͷ͕…ݱ࣮”

Slide 11

Slide 11 text

㱻 ར ศ ੑ ί ε τ

Slide 12

Slide 12 text

W O R D P R E S S ͷ η Ω ϡ Ϧ ςΟ

Slide 13

Slide 13 text

Wo rd P re s s αΠ τ ͷ վ ͟ Μ ඃ ֐ ͸ 1 5 0 ສ ݅ ௒ ʹ   ʮ ࠷ ѱ ڃ ͷ ੬ ऑ ੑ ʯ

Slide 14

Slide 14 text

Wo rd P re s s ͸ ࠜ ຊ త ʹ η Ω ϡ Ϧ ςΟ ͷ ໰ ୊ ͕ ͋ Δ ͷ ͔ʁ

Slide 15

Slide 15 text

“ ݸ ਓ త ͳ ܦ ݧ ͔ Β ݴ ͏ ͱ ܧ ଓ త ͳ ϝ ϯ ς φ ϯε Λ ߦ ͬͯ ͍ Ε ͹ க ໋ త ͳ ໰ ୊ ʹ ͳ ͬ ͨ ͜ ͱ ͸ ͳ ͍ ” – Զ

Slide 16

Slide 16 text

ɾ Wo rd P re s s C o re ͷ Ξ οϓ σ ʔ τ ͕ ස ൟ ͢ ͗ Δʁ   ɾ Wo rd P re s s P l u g i n ͕ ੬ ऑ ʁ   ɾ Wo rd P re s s T h e m e ͕ ෳ ࡶ Ͱ ϝ ϯ ς ෆ ೳ ʁ   ɾ ͦ ΋ ͦ ΋ … P H P ΍ M y S Q L ͳ Ͳͷ ϛ υϧ ΢ Σ Ξ ʹ ໰ ୊ ʁ

Slide 17

Slide 17 text

Wo rd P re s s C o re     Q . Ξ οϓ σ ʔ τ ͕ ස ൟ Ͱ େ ม ͬͯ ຊ ౰ ͳ ͷ ʁ   A . ຊ ౰ Ͱ ͢ɻ ͠ ͔ ͠ ɺ ਵ ෼ લ ͔ Β C o re ͷ Ξ οϓ σ ʔ τ ͸ ࣗ ಈ Խ ʹ ର Ԡ ͯ͠ · ͢ɻ  

Slide 18

Slide 18 text

ɾ C o re ͷ ϝ δ ϟ ʔ όʔ δ ϣ ϯ ͱ ϚΠφ ʔ όʔ δ ϣ ϯ   - 4 . X ϝδϟ ʔόʔ δϣ ϯ ͸ Ϣʔ βʔ ޲ ͚ ͷ ৽ ػ ೳ ͱ ։ ൃ ऀ ޲ ͚ ͷ A P I Λ ௥ Ճ ͢ ΔͨΊʹϦϦʔε͞Ε·͢ɻόάͷमਖ਼ͳͲ΋͋Γ·͕͢ɺओ໨త͸Ϣʔβʔ ମ ݧ ΍ ػ ೳ ੑ ͷ ޲ ্ ͱ ͳ ͬͯ ͍ · ͢ɻ   - 4 . 7 . X ϚΠφ ʔόʔ δϣ ϯ ͸ ઐ Β η Ω ϡ Ϧ ςΟ ੬ ऑ ੑ ͷ म ਖ਼ ͱ Ϋ Ϧ ςΟ Χ ϧ ͳ ό ά ͷ ର ॲ ͷ ͨ Ί ʹ Ϧ Ϧ ʔε ͞ Ε · ͢ɻ গ ͳ ͘ ͱ ΋ ɺ ϚΠφ ʔόʔ δϣ ϯ ͷ ࣗ ಈ Ξ οϓ σ ʔ τ Λ ༗ ޮ Խ ͯ͠ ໰ ୊ ͕ ى ͜ Δ ͜ ͱ ͸ ۃ Ίͯ গ ͳ ͍Ͱ ͢ɻ

Slide 19

Slide 19 text

ɾ ౾ ஌ ࣝ W P - c o n f i g . P H P ʹ Ҏ Լ ͷ Α ͏ ʹ ઃ ఆ Λ ม ߋ ͢ Δ ͜ ͱ ͕ Մ ೳ Ͱ ͢ɻ     # ϚΠφ ʔ Ϧ Ϧ ʔε ͷ ί Ξ ߋ ৽ Λ ༗ ޮ Խ ( σ ϑ Υϧ τ ) : d e f i n e ( ' W P _ A U T O _ U P D AT E _ C O R E ' , ' m i n o r ' ) ; # ϚΠφ ʔ Ϧ Ϧ ʔε ɺ ϝδϟ ʔ Ϧ Ϧ ʔε Λ ؚ Ή ͢΂ ͯͷ ί Ξ ߋ ৽ Λ ༗ ޮ Խ d e f i n e ( ' W P _ A U T O _ U P D AT E _ C O R E ' , t r u e ) ; # ͢΂ ͯͷ ί Ξ ߋ ৽ Λ ແ ޮ Խ ( Φ ε ε ϝ Ͱ ͖ ͳ ͍ ʂ ) : d e f i n e ( ' W P _ A U T O _ U P D AT E _ C O R E ' , f a l s e ) ;

Slide 20

Slide 20 text

Wo rd P re s s P l u g i n     Q . Wo rd P re s s P l u g i n ͕ ੬ ऑ ʁ   A . ͋ Γ ͑ · ͢ɻ     ͳ ͷ Ͱɺ બ ఆ ͕ ॏ ཁ Ͱ ͢ɻ

Slide 21

Slide 21 text

ɾ P l u g i n બ ఆ ͷ ϙΠ ϯ τ - ެ ࣜ σΟ Ϩ Ϋ τ Ϧ ʹ ܝ ࡌ ͞ Εͯ ͍ Δ - ස ൟ ʹ ϝ ϯ ς φ ϯε ͞ Εͯ ͍ Δ ʢ ࣗ ಈ Ξ οϓ σ ʔ τ Մ ೳ ʣ ɾ ར ༻ લ ʹ ί ʔ υ Ϩ Ϗϡ ʔ - σό ο Ϋ Ϟ ʔ υ # d e f i n e ( “ W P _ D E B U G " , t r u e ) ;     - P l u g i n - C h e c k ϓ ϥ άΠ ϯ h t t p s : / / w o rd p re s s . o rg / p l u g i n s / p l u g i n c h e c k /

Slide 22

Slide 22 text

Wo rd P re s s T h e m e     Q . Wo rd P re s s T h e m e ͕ ෳ ࡶ Ͱ ϝ ϯ ς ෆ ೳ ʁ   A . ͋ Γ ͑ · ͢ɻ     ಠ ࣗ ʹ Χ ε λ ϚΠ ζ ͯ͠ ར ༻ ͢ Δ Մ ೳ ੑ ͕ ߴ ͍Ͱ ͢ɻ ͦ ͷ ҝ ɺ ࣗ ݾ ਍ அ Ͱ ໰ ୊ ఺ Λ ݕ ࠪ ͯ͠ ͓ ͘ ඞ ཁ ͕ ͋ Γ · ͢ɻ ※ ༗ ྉ ͷ T h e m e ͩ ͔ Β ҆ ৺ Ͱ ͸ ͳ ͍ ʂ

Slide 23

Slide 23 text

ɾ T h e m e ͷ ࣗ ݾ ਍ அ ํ ๏ - T h e m e R e v i e w H a n d b o o k [ C o d i n g ͷ Ψ Π υ ϥ Π ϯ ]   h t t p s : / / m a k e . w o rd p re s s . o rg / t h e m e s / h a n d b o o k / re v i e w /   - T h e m e c h e c k p l u g i n [ ਍ அ π ʔϧ ]   h t t p s : / / w o rd p re s s . o rg / p l u g i n s / t h e m e - c h e c k /

Slide 24

Slide 24 text

ɾ ͋ Δ ͋ Δ ωλ ʢ ܦ ݧ ஊ ʣ Ξ οϓ σ ʔ τ ͢ Δ ͱ ໰ ୊ ͕ ى ͜ Δ Α͘ ͋ Δ ݪ Ҽ 1 . C o re ΍ P l u g i n ͕ ͦ ΋ ͦ ΋ ϋο Ϋ ͞ Εͯ ͍ Δ   2 . P l u g i n ΍ T h e m e ͕ C o d i n g Ψ Π υ ϥ Π ϯ ʹ ४ ڌ ͯ͠ ͳ ͍ 3 . P l u g i n ΍ T h e m e ͕ C o re ͷ Ξ οϓ σ ʔ τ ʹ ର Ԡ ͯ͠ ͍ ͳ ͍

Slide 25

Slide 25 text

Wo rd P re s s ͷ ಈ ࡞ ؀ ڥ     Q . ͦ ΋ ͦ ΋ … P H P ΍ M y S Q L ͳ Ͳͷ ϛ υϧ ΢ Σ Ξ ʹ ໰ ୊ ʁ   A . ͋ Γ ͑ · ͢ɻ     ͳ ͷ Ͱɺ ϗ ε ςΟ ϯ ά ؀ ڥ ΋ ϝ ϯ ς φ ϯε ͕ ॏ ཁ Ͱ ͢ɻ

Slide 26

Slide 26 text

ɾ ౾ ஌ ࣝ Wo rd P re s s ઐ ໳ ͷ Ϛ ω ʔ δ υ ϗ ε ςΟ ϯ ά Λ ར ༻ ͢ Δ ͜ ͱ Ͱ   ϝϯςφϯείετ΍φϨοδΛڞ༗Ͱ͖ΔͷͰ؅ཧϦιʔεΛܰݮͰ͖·͢ɻ   ୅ ද త ͳ α ʔ Ϗ ε - Wo rd P re s s V I P - W P E n g i n e - P a g e l y - A M I M O T O   ͳ Ͳ ͳ Ͳ …

Slide 27

Slide 27 text

ར ศ ੑ 㱻 ί ε τ

Slide 28

Slide 28 text

අ ༻ ର ޮ Ռ ͷ ߴ ͍ બ ୒ ࢶ ͕ ཉ ͠ ͍ ! ར ศ ੑ 㱻 ί ε τ

Slide 29

Slide 29 text

S H I F T W O R D P R E S S T O S E R V E R L E S S

Slide 30

Slide 30 text

S H I F T E R ͱ ͸ ?

Slide 31

Slide 31 text

S h i f t e r ͸ ɺ Wo rd P re s s αΠ τ Λ Ұ ࿈ ͷ ੩ త H T M L ϑ ΝΠϧ ʹ   ม ׵ ͠ ɺ C D N Λ հ ͯͦ͠ Ε Β Λ ఏ ڙ ͢ Δ ͜ ͱ Ͱ   ι ϑ τ ΢ Σ Ξ อ क ΍ α ʔό ؅ ཧ ͷ ෛ ୲ Λ ഉ আ ͠ · ͢ɻ

Slide 32

Slide 32 text

S h i f t e r Λ ࢖ ༻ ͢ Δ ͱ ɺ Wo rd P re s s ͷ Φ ϯ / Φ ϑ Λ ੾ Γ ସ ͑Δ ͜ ͱ ͕ Ͱ ͖ · ͢ɻ   ͜ ͷ α ʔ Ϗ ε ͸ ɺ Wo rd P re s s ͷ ੩ త αΠ τ ੜ ੒ π ʔϧ ͱ ϗ ε ςΟ ϯ ά ι Ϧ ϡ ʔ γ ϣ ϯ ͷ ϋΠ ϒ Ϧ ο υ Ͱ ͢ɻ     Wo rd P re s s ͷ ඪ ४ త ͳ ؅ ཧ ͱ ։ ൃ ͷ ϫ ʔ Ϋ ϑ ϩ ʔ ͸ ͦ ͷ · · Ͱɺ Ϣʔ βʔ ͕ Wo rd P re s s ಺ ͷ ϑ ΝΠϧ ΍ ί ϯ ς ϯ π Λ ߋ ৽ ͢ Δ ͱ ɺ ৽ ͠ ͍ όʔ δϣ ϯ ͷ ੩ త ϑ ΝΠϧ ͕ ί ϯύΠϧ ͞ Ε · ͢ɻ

Slide 33

Slide 33 text

L I F E C Y C L E • DockerͰWordPressΛߋ৽࣌ʹىಈ  (editorʣ • AWS ͷϦιʔεͰ੩తHTMLʹม׵  (generator) • CDN͔ΒίϯςϯπΛ഑৴  (Contents Delivery) A R C H I T E C T U R E

Slide 34

Slide 34 text

– S H A U N B A E R , J 2 D E S I G N “Shifter͚ͩͰWordPressϓϥοτϑΥʔϜʹ੩తͳαΠτΛߏஙͰ͖·ͨ͠ɻ  ੩తͳHTMLϑΝΠϧ͸CDN্Ͱϗετ͞ΕͯϋοΩϯά͢Δ΋ͷ͕ͳ͍ͷͰ ύϑΥʔϚϯε΍ηΩϡϦςΟ্ͷݒ೦Λؾʹ͢Δ͜ͱ͕ͳ͘ͳΓ·ͨ͠”

Slide 35

Slide 35 text

S H I F T E R ͷ Ϣʔεέ ʔε

Slide 36

Slide 36 text

S h i f t e r ͷ Ϣ ʔεέ ʔε     Q . S h i f t e r ͸ Wo rd P re s s ͷ ۜ ͷ ஄ ؙ ʹ ͳ Γ · ͢ ͔ʁ   A . ࢒ ೦ ͳ ͕ Β ೉ ͠ ͍Ͱ ͢ɻ     - ࠷ ద ͳ έ ʔε ɿ   Πϕ ϯ τ ɾ Ω ϟϯϖʔϯ ɾ ϥ ϯ σΟ ϯ άϖʔ δ ɾ ί ʔϙ Ϩ ʔ τ ͳ Ͳ - ෆ ޲ ͖ ͳ έ ʔε ɿ ί ϯ ς ϯ π ͷ ߋ ৽ ͕ ස ൟ ɾ ଟ ਓ ਺ Ͱ ར ༻ ͢ Δ ϝ σΟΞ ɾ ձ һ αΠ τ ͳ Ͳ

Slide 37

Slide 37 text

ղ ܾ ͢ Δ ໰ ୊   - η Ω ϡ Ϧ ςΟ ɾ ӡ ༻ ฤ • αʔόͷηοτΞοϓ • αʔόͷϝϯςφϯε • ιϑτ΢ΣΞͷΞοϓσʔτ • ηΩϡϦςΟରԠ • ͋ͳͨͷ࣌ؒͱίετ We b αΠ τ ͷ ߏ ங ɺ ࣮ ߦ ɺ อ क ʹ ͸ ࣌ ؒ ͕ ͔ ͔ Γ · ͢ɻ α ʔόʔ Λ η ο τΞ οϓ ͠ ɺ ద ੾ ͳ αΠ ζ Λ બ ୒ ͠ ɺ Ω ϟ ο γ ϡ ઓ ུ Λ ࡞ ੒ ͠ ɺ ҆ શ ੑ ͱ ύ ϑ Υ ʔϚ ϯε Λ ؂ ࢹ ͢ Δ ඞ ཁ ͕ ͋ Γ · ͢ɻ

Slide 38

Slide 38 text

• ༧ଌෆೳͳݟੵ • ࠷దͳϦιʔεͷௐୡ • νϟϯεϩε • ͋ͳͨͷਭ຾ͱ҆৺ ղ ܾ ͢ Δ ໰ ୊   - ί ε τ / ύ ϑ Υ ʔϚ ϯε ฤ ๚໰ऀͷτϥϑΟοΫΛਪଌ͠ɺͦΕʹԠͯ͡ϦιʔεΛௐ੔͠·͕ͨ͠ɺ ࣮ ࡍ ͷ τ ϥ ϑΟ ο Ϋ ͕ ༧ ૝ Α Γ ΋ ߴ ͘ ͳ Γ αΠ τ ͕ Ϋ ϥ ο γ ϡ ɻ ػ ձ ʢ ͓ Α ͼ ݱ ۚ ʣ ͕ ࣦ Θ Ε · ͠ ͨ ɻ

Slide 39

Slide 39 text

Πϕ ϯ τ ͷ τ ϥ ϑΟ ο Ϋ ͕ ٸ ૿ ͢ Δ ͱ ɺ ඞ ཁ ͳ αΠ τ σ ʔ λ ͱ ε τ Ϩ ʔ δ ػ ೳ ͩ ͚ Λ Χ όʔ͢ Δ Α ͏ ʹ ί ε τ ͕ ௐ ੔ ͞ Ε · ͢ɻ Πϕ ϯ τ ͕ ऴ ྃ ͠ ɺ τ ϥ ϑΟοΫ͕μ΢ϯ͢ΔͱɺίετͱετϨʔδػೳ͕ࣗಈతʹௐ੔͞Ε·͢ɻ • ༧ଌෆೳͳݟੵ • ࠷దͳϦιʔεͷௐୡ • νϟϯεϩε • ͋ͳͨͷਭ຾ͱ҆৺ ղ ܾ ͢ Δ ໰ ୊   - ί ε τ / ύ ϑ Υ ʔϚ ϯε ฤ

Slide 40

Slide 40 text

· ͱ Ί

Slide 41

Slide 41 text

ɾ S h i f t e r ͸ ͋ ͳ ͨ ʹ ଟ ͘ͷ ࣌ ؒ ͱ ࿑ ྗ ͷ અ ໿ Λ ఏ ڙ ͠ · ͢ - S h i f t e r Λ ར ༻ ͠ ͨ Wo rd P re s s αΠ τ ͸ ҆ શ Ͱ ϝ ϯ ς φ ϯε ෆ ཁ Ͱ ͢ɻ   - S h i f t e r Λ ࢖ ༻ ͢ Δ ͱ ί ϯ ς ϯ π Λ C D N ͔ Β ഑ ৴ ͠ · ͢ͷ Ͱ ά ϩ ʔό ϧ Ͱɺ Ϩε ϙ ϯε ΋ ߴ ଎ ʹ ͳ Γ · ͢ɻ     - ༧ ଌ ෆ ೳ ͳ τ ϥ ϑΟ ο Ϋ ɾ ε ύΠΫ ͷ ͨ Ί ʹ Π ϯ ϑ ϥε τ ϥ Ϋ ν ϟ Λ ௐ ੔ ͢ Δ ί ε τ ɺ ࿑ ྗ ɺ ͓ Α ͼ ػ ձ ଛ ࣦ ͷ Ϧε Ϋ Λ ࡟ ݮ Ͱ ͖ · ͢ɻ

Slide 42

Slide 42 text

Don’t waste another minute. Sign up for Shifter and let us do the heavy lifting. https://getshifter.io/ #getshifter #secjaws #secjaws04